Cock.li is a free email host that has been running since 2013 and says it has more than 1 million users. Sign-up asks for an address, a password and a captcha. There is no field for a phone number, a second e-mail address or an ID, and the donation page says the service has never required any of them.

The service does not encrypt mail in a way that keeps the operator out. Messages arrive in plaintext, are scanned for spam and stay on a server the operator controls. The homepage says this itself: under “How can I trust you?” the answer is “You can’t”, followed by advice to encrypt mail with GPG or X.509 and to download and delete it from the server regularly.

In June 2025 attackers offered for sale two tables from the old webmail database, with login times for about 1,023,800 accounts and the address books of about 10,400 users. The operator removed that webmail and later replaced it with a new client-side one, which is still in beta.

Security

Between mail servers, TLS is opportunistic: the Privacy Policy says that when the other mail server cannot set up a TLS connection, or does not try to, the message crosses the internet without encryption.

The same Privacy Policy states that “your information is encrypted server-side at all times”. This is the operator’s own claim, and it describes encryption at rest, not zero-access encryption. The policy also says that every message sent or received is scanned for spam by a robot, so the server handles mail in readable form. The homepage says the operator “doesn’t read or scan your e-mail content in any way”, which the spam-scanning sentence in the Privacy Policy contradicts. The homepage also explains that any provider receives incoming mail in plaintext before it can encrypt it.

There is no encryption between accounts: two cock.li users writing to each other get the same treatment as anyone else. The service offers no built-in PGP and no key management. If you want messages the operator cannot read, you and your correspondent set up GPG or X.509 in your own mail clients.

Account protection rests on the password alone. The site documents no two-factor authentication, and the Terms of Service answer the question of password resets with one word: “NONE.” There is no account recovery by e-mail, phone or support request. The Privacy Policy says that logging in is the only way to prove an account is yours, so a lost password means a lost address.

Privacy & Trust

Registration collects your chosen address, a hashed password, the IP address and browser user agent you signed up from, and timestamps. On top of that the Privacy Policy lists stored mail, filters, XMPP contact lists, 48 to 72 hours of IMAP and SMTP logs, and HTTP access logs with IP address and user agent. The policy says the service has no third parties and does not sell or share personal data. The operator says it owns all of its server hardware.

You can ask for your registration data to be deleted once the account is 30 days old. Mail, filters and contact lists you delete yourself. Backups cannot be changed, so the operator keeps only your e-mail address in order to delete your account again if a backup is ever restored.

The question of which law applies has no clear answer. The site names no company and no address, and the Terms of Service refer only to “the laws in which cock.li is governed”. The one jurisdiction the operator has named is Seychelles, in its 2022 transparency report. Press coverage of the 2025 leak described the operator as based in Germany. The two accounts do not match, and nothing on the site settles it.

The operator has published the legal requests it received: twelve entries from 2015 to 2018, mostly subpoenas, one of them marked as rejected, and the 2022 report. That report says the operator responded to two orders for user metadata, covering one account and four accounts, sent by French authorities in ransomware cases. Nothing newer than 2022 is listed. The Privacy Policy states that the service “complies with every legal order for user information under the jurisdictions which are applicable”.

The PGP-signed warrant canary, dated 20 October 2026, says the service received no gag order from 2017 to that date and has “never received a legal order enforceable in its jurisdiction for user data”. The 2022 report records two orders for metadata, so the canary statement holds only if metadata is counted separately from user data, and the canary does not say where that line runs.

Only the new webmail client has published source code. Nothing about the mail server software is published, so the service is only partly open source, and the site publishes no independent security audit. The financial reports have not been updated in three years, according to the operator’s own update log. The same log shows a November 2024 “red alert” donation appeal that described a small team of 3 to 5 unpaid people, and a multi-day outage in December 2024 after a datacenter failure.

Data breach and incident history

On 16 June 2025 the operator disclosed a data breach: attackers were selling two tables from its Roundcube webmail database. The users table covered about 1,023,800 accounts, everyone who had logged into webmail since 2016. For each account it held the address, the first and last webmail login times, the time and count of failed logins, the interface language and the Roundcube settings, including the e-mail signature. The contacts table held about 93,000 address-book entries from about 10,400 users, with names, e-mail addresses, vCards and comments.

According to the operator, passwords, mail content and IP addresses were not taken, and neither was any data about people who never used webmail. The operator’s guess at the cause is CVE-2021-44026, an SQL injection flaw in an old Roundcube version the service had stopped running long before. The post says the exact route was not established. It also says: “Cock.li should not have been running Roundcube in the first place.” BleepingComputer reported the leak on 17 June 2025 and gave the same figure of about 1,023,800 accounts.

The operator had already removed Roundcube on 15 June 2025, after checking its installation for a newer Roundcube flaw and finding no sign it had been used. In January 2026 it announced Cock-mail, a replacement webmail.

Features

An address can sit on any of 14 domains the operator owns; several of them are joke names, so check how an address will look to the people you write to. You cannot use your own domain, and the site documents no aliases. The operator also runs an XMPP chat server.

The website, webmail, IMAP, POP and XMPP are all reachable as Tor hidden services. Spam filtering is automatic, and the Privacy Policy publishes no detail about how it works. The site does not state a mailbox size limit.

Usability

The operator offers no mail app. You use the webmail or set up any IMAP, POP or SMTP client yourself with the server addresses from the homepage.

The webmail, Cock-mail, is a single HTML file that runs in your browser and talks to the mail servers directly. The current version is beta 0.5.2 from 21 September 2026. It converts HTML mail to plain text and never loads remote images. It has no filter support yet. Version 0.5.2 fixed a bug that wrote SMTP passwords into debug logs.

A new account cannot send mail straight away. First the browser has to complete a proof-of-work challenge that takes a few minutes of CPU time.

Price & Value

Cock.li has a free tier and nothing else: there is no paid plan and no feature reserved for donors. The service runs on donations in Monero or Bitcoin, split between a fund that pays the team and a fund for running costs.

What you give up instead of money is mail that the operator can read, any way to recover a lost password, and the assurance of a staffed service. For a throwaway or Tor-only address that is a fair exchange. For an address you plan to keep for years and tie to other accounts, the December 2024 outage and the lack of recovery matter more than the price.

Pros and Cons

Sign-up asks only for an address, a password and a captcha, with no phone number, second e-mail or ID
The Privacy Policy rules out third parties and the sale of personal data, and the operator says it owns all its server hardware
Published legal requests from 2015 to 2022 and a PGP-signed warrant canary dated October 2026
Completely free, with no paid plan and no features reserved for donors
Website, webmail, IMAP, POP and XMPP are all reachable as Tor hidden services
Works with any IMAP, POP or SMTP mail client
The operator removed Roundcube webmail and published in detail what the 2025 leak contained and what it did not

Mail arrives in plaintext, is scanned for spam and is stored where the operator can read it
No built-in PGP and no encryption between cock.li accounts, so private mail depends on you and your correspondent setting up GPG or X.509
Mail to or from a server without TLS crosses the internet unencrypted
The operator responded to two orders for user metadata in 2022 and says it obeys every applicable legal order
No password reset under any circumstances, and the site documents no two-factor login
No legal entity, address or independent security audit is published, and the only named jurisdiction conflicts with press reports
In 2025 the webmail login times of about 1,023,800 accounts and the address books of about 10,400 users were leaked
Registration IP address is kept until you ask for deletion, alongside IMAP, SMTP and HTTP access logs

Our Rating

Cock.li suits someone who needs an address with no link to their phone number or real name, reachable over Tor and set up in a mail client. It scores low as a private mailbox: mail sits readable on the server, the operator responded to two orders for user metadata, a 2025 leak exposed login times and contacts, and a forgotten password ends the account. Treat it as a free address for mail you encrypt yourself or do not mind the operator seeing.

Security3.5/10
Mail between servers uses TLS when the other side supports it, and the operator says stored data is encrypted on its servers. Mail still arrives in plaintext and is stored where the operator can read it, there is no built-in PGP, mail to a server without TLS travels unencrypted, and the site documents no two-factor login and offers no password reset.
Privacy & Trust4.5/10
Sign-up asks for no personal data, the Privacy Policy rules out third parties, and the operator publishes legal requests and a signed warrant canary. It responded to two orders for user metadata in 2022, names no legal entity or address, has no independent security audit, and in 2025 leaked webmail login times for about 1,023,800 accounts and the address books of about 10,400 users.
Features3.0/10
An account comes with an address on one of 14 operator-owned domains, XMPP chat and Tor access to webmail, IMAP, POP and XMPP. The site documents no aliases, no custom domain and no mailbox size, and the new webmail has no filters yet.
Usability3.0/10
Any IMAP, POP or SMTP client works, but the operator offers no mail app, its webmail is a beta that shows HTML mail as plain text, and a new account cannot send mail until the browser finishes a proof-of-work step. A forgotten password means the account is lost.
Price & Value6.0/10
The whole service is free, with no paid plan and nothing held back for donors. It runs on Monero and Bitcoin donations, and the operator's own November 2024 appeal described a team of 3 to 5 unpaid people, which matters if you want an address that lasts for years.

Overall3.9/10

Security 30% · Privacy & Trust 30% · Features 15% · Usability 15% · Price & Value 10%

See our rating methodology →