Mailfence is run by ContactOffice Group sa, a Brussels company that launched the service in 1999 and today manages more than 600,000 accounts, most of them licensed to European companies and universities rather than sold to individuals. The consumer product is a webmail account with an OpenPGP keystore built into the browser, a calendar, a document store and contact groups attached, on servers the company owns and operates in Belgium. The privacy argument here is unusual in that its strongest component is not cryptographic at all: Belgian law does not permit gag orders, so a data request cannot be kept from the person it concerns. The cryptography is the more conventional part — OpenPGP, invoked per message, on a mailbox that is not encrypted by default.

Security

Encryption happens in the browser. Generating a key pair produces a 4096-bit OpenPGP key by default, the private key is stored encrypted under a passphrase using AES, and the passphrase check runs client-side and is never sent to the server. Mailfence’s own security breakdown states the case flatly: private-key decryption on the web server “does not apply to Mailfence,” because all of it happens on the client. Account passwords are a separate matter and are stored server-side as salted bcrypt hashes.

Splitting the account password from the key passphrase is a deliberate design decision and a good one. If someone obtains your login credentials, the passphrase still stands between them and any cryptographic operation — reading encrypted mail, signing a message, touching the keystore. The two secrets also fail differently: a lost account password is recoverable through a pre-configured reset address, while a lost OpenPGP passphrase is not recoverable at all. There is no reset path, no support escalation, no vendor copy. The documented remedy is a revocation certificate you generated in advance and stored yourself, and that only lets you disown the key going forward — mail already encrypted under it stays unreadable permanently.

Three limits need stating precisely, because the encryption terminology in this category is routinely used loosely. First, encryption is a per-message choice, not an account state. You select it when composing, either with OpenPGP or with a password-based symmetric option for recipients who have no PGP setup at all. An account where nobody ever turns it on gets none of the protection described above. Second, two Mailfence users do not get an encrypted conversation simply by both being Mailfence users — there is no automatic end-to-end layer between accounts. Third, and most concretely: the company’s own storage table lists message headers on the web server as not encrypted. Even for a message whose body and attachments the server genuinely cannot read, the envelope around it — who wrote to whom, when, about what subject — sits there in the clear.

Transport and infrastructure are handled properly. TLS is mandatory for both webmail and IMAP/POP/SMTP access, Perfect Forward Secrecy has been in place on HTTPS since launch, HSTS is set on every page, outgoing SMTP is forced to encrypt wherever the receiving server supports it, and inbound mail is checked against SPF and DKIM. Two-factor authentication is available. The servers are Belgian, owned and run by the company with no subcontractor and no third-party access, behind biometric entry controls and camera surveillance.

The published threat model is worth more than most vendor security pages because it names what the service does not defend against, not only what it does. A compromised device defeats client-side encryption outright — a keylogger reads the passphrase as you type it, and key length is irrelevant. A high-level man-in-the-middle attack with forged certificates is listed as unprotected. So are powerful state-funded attacks, beyond best-effort mitigation. That candour is credit-worthy.

What is missing is external verification. There is no published penetration test, no named auditing firm, no report with a date on it. The knowledge base states that the back-end is “always open to inspections by recognized auditing teams, academic researchers, and other reputed bodies” — a standing offer, not evidence that anyone has taken it up and published what they found. Twenty-six years of operation and a detailed internal threat model are real signals, but they are not a substitute for an outside party having actually looked and said so in public. That absence is the main reason Security sits at 7.0 rather than higher.

Privacy & Trust

The jurisdiction is the centrepiece. ContactOffice Group sa is registered at Avenue Franklin Roosevelt 47b in Brussels under company number BE 0466.241.584. Only a Belgian judge can compel information, and only with a court order. Crucially, Belgian law provides no mechanism for a gag order, which means the compliance and the secrecy cannot be bundled together the way they can under a US National Security Letter. Mailfence publishes a warrant canary anyway, stating it has never received an NSL or a FISA court order, has never been subject to a FISA gag order, and has never placed a backdoor in its hardware or software or been asked to. Because the gag-order mechanism does not exist locally, that canary is a statement about structure rather than a tripwire the company is hoping never to trip.

The transparency report carries numbers rather than reassurances. Between 1 July and 31 December 2025, Mailfence received 21 requests for user identification and provided identification in 9 of them, each under a valid Belgian court order. Cumulatively from launch through 30 June 2025: 228 requests received, 105 complied with. The report also defines what counts — only requests arriving through a legal channel, with Belgian court orders being the only legally binding kind. Roughly half of all requests received over the service’s lifetime were not acted on, and the ones that were can in principle be disclosed to the affected user.

Against that sits the metadata. The privacy policy is explicit about what is collected: IP addresses, message IDs, sender and recipient addresses, subjects, browser versions, countries and timestamps. Incoming and outgoing messages pass through anti-spam, anti-virus and anti-abuse routines, and a search index is built across messages, calendar, contacts and documents. The company states it runs no Google Analytics, sells nothing to third parties, and compiles no user profiles, and staff have signed confidentiality agreements. None of that is unusual for a provider operating its own anti-abuse and search infrastructure. But it is the precise category of data a Belgian court order can reach, and it is the same data the unencrypted-headers point above concerns. Encrypting a message body protects the contents of the conversation, not the fact of it.

Retention has hard limits written down. Backups of deleted messages and documents are kept for 45 days and then permanently deleted. A closed account’s data is permanently erased 30 days after the legal expiry date, which Belgian law sets at 365 days from closure.

The code is closed. Asked directly whether the service is open source, Mailfence’s own knowledge base answers “Not yet,” with a plan to eventually open-source the front-end and no commitment on the back-end. Combined with the absent audit, that means the privacy claims here rest on jurisdiction, documentation and track record — three things Mailfence has in unusual quantity — but not on anything an outside party can independently verify in the code.

The company donates 15% of its Ultra plan revenue to the Electronic Frontier Foundation and European Digital Rights. That is a small, checkable commitment rather than a slogan.

Features

The paid plans are a small productivity suite rather than a mailbox alone: Calendars, a Documents store, and Groups for organising contacts across accounts, all inside the same subscription.

The keystore is the feature that defines the product. It generates, imports, publishes and manages OpenPGP key pairs entirely in the browser, with no add-on to install, and it handles multiple key pairs at once. Because it is standard OpenPGP rather than a house protocol, correspondence interoperates with any other OpenPGP-speaking service and your keys remain yours if you leave. For recipients with no PGP at all, password-encrypted messages provide a symmetric fallback, and digital signatures let a recipient verify a message actually came from you.

Custom domains arrive on the Entry plan — two of them, with DKIM, SPF and DMARC — and a catch-all address can be assigned to a domain, so anything sent to an address that does not otherwise exist still reaches you. The numeric alias caps below that are modest: none on Free, 10 on Base, 50 on Entry.

Mail access is broad on paid tiers: POP, IMAP and SMTP, plus ActiveSync and third-party mailbox access on Entry. Anti-spam, anti-virus and anti-abuse scanning run automatically on incoming and outgoing mail at the transport layer, which is consistent with the encryption model — a message body actually sent under OpenPGP never resolves on the server, so it is not what the scanners are reading.

The gap in the feature set is the one the Security section describes: there is no always-on encryption layer to switch to, and nothing that encrypts two Mailfence accounts’ mail to each other automatically. Everything encrypted here is encrypted because the sender chose it, message by message.

Usability

There is no native desktop application for Windows, macOS or Linux. Desktop access is webmail, or standard POP/IMAP/SMTP through whatever client you already use. On mobile the coverage is better than most in this category: genuine native apps on the App Store and Google Play, plus an installable progressive web app for both iOS and Android.

Whether the missing desktop client matters depends on your habits. If you already work in a third-party mail client, the standard protocols mean nothing changes and setup is the usual server-settings dialogue. If you expected a first-party desktop app with its own encryption UI, there is nothing to install.

OpenPGP itself carries the rest of the learning curve. The keystore removes the plugin step, which is genuinely the worst part of most PGP setups, but it does not remove the concepts: you still decide which messages to encrypt, still exchange public keys with correspondents, still keep a passphrase whose loss is permanent, and still need to have generated a revocation certificate before you need it. A service where encryption is simply on and invisible asks none of that. Usability at 6.0 reflects a competent interface wrapped around a protocol that is inherently demanding.

Price & Value

The free tier is usable rather than decorative: 1 GB total, split 500 MB for mail and 500 MB for documents, with the encryption and keystore intact. The limits are support through the knowledge base only, and no custom domain.

Base is $2.50 a month billed yearly, for 11 GB total (5 GB mail, 6 GB documents), 10 aliases and email support, still without a custom domain. Entry is $3.50 a month billed yearly, for 40 GB total (10 GB mail, 30 GB documents), 50 aliases, two custom domains with DKIM/SPF/DMARC, and the full protocol set including ActiveSync.

These are recurring prices, not first-year promotions that jump on renewal, and $3.50 a month for a custom-domain mailbox with catch-all, a calendar, 30 GB of document storage and native mobile apps is at the low end of this category. Price & Value at 8.0 is the highest score on this card, and it is earned by the combination of that entry price with a free tier you can actually keep using.

Pros and Cons

Belgian jurisdiction where gag orders are not legally possible, so compliance with a data request can be disclosed to the affected user
Warrant canary states no US National Security Letter, no FISA court order, and no backdoor request has ever been received
Transparency report gives itemised figures — 21 identification requests and 9 complied with in H2 2025, 228 and 105 cumulatively since launch through June 2025
OpenPGP keystore runs in the browser with 4096-bit default keys, handles multiple key pairs, and interoperates with any other OpenPGP service
Account password and OpenPGP passphrase are separate secrets — a stolen login alone unlocks no cryptographic operation
Servers owned and operated by the company in Belgium, no subcontractor, no third-party access, biometric entry and camera surveillance
Entry supports two custom domains with DKIM/SPF/DMARC and a catch-all address, alongside POP/IMAP/SMTP and ActiveSync
Base at $2.50/month and Entry at $3.50/month billed yearly are recurring rates, not first-year pricing, alongside a free 1 GB tier that keeps encryption and the keystore
Retention is bounded in writing: 45 days for deleted-item backups, permanent erasure 30 days after the 365-day legal window on a closed account

Encryption is a per-message choice, not an account default — a mailbox where it is never invoked gets none of the protection
Message headers in storage on the server are explicitly not encrypted, even for messages whose body is
No automatic end-to-end encryption between two Mailfence accounts; both parties must use OpenPGP deliberately
Closed source — the company's own knowledge base answers "Not yet" and commits only to eventually opening the front-end
No published independent audit or penetration test; the back-end being "open to inspections" is an offer, not a report
The privacy policy confirms collection of IP addresses, message IDs, sender and recipient addresses, subjects, timestamps, browser versions and countries
A lost OpenPGP passphrase is unrecoverable by design, and a revocation certificate only disowns the key — it does not restore encrypted mail
No desktop application on Windows, macOS or Linux; desktop use is webmail or a third-party IMAP/POP/SMTP client
Free and Base tiers have no custom domain, and aliases are capped at 0 and 10 respectively

Our Rating

Mailfence fits someone who wants standards-based OpenPGP they can carry to any other provider, hosted by a company whose jurisdiction makes secret data demands structurally impossible rather than merely discouraged by policy, at an entry price near the bottom of this category. It fits you less if you want encryption that is on from the first message without a decision, if unencrypted headers sitting on a server trouble you as much as message contents would, or if you need a published third-party audit rather than a twenty-six-year track record and a standing invitation to inspect.

Security7.0/10
Client-side OpenPGP with a 4096-bit default key length, bcrypt-hashed account passwords, and a private-key passphrase that never reaches the server — but encryption is opt-in per message rather than a default, and message headers in storage are explicitly not encrypted
Privacy & Trust7.5/10
Belgian jurisdiction with a legally-grounded no-gag-order warrant canary and itemised transparency reporting is the strongest trust signal in this row, offset by closed-source code with no published third-party audit and metadata collection (IP, sender/recipient, subject, timestamps) confirmed in the privacy policy
Features6.5/10
Custom domains with catch-all aliases and a genuine productivity bundle (Calendars, Documents, Groups) on paid tiers, but the Free tier is capped at 1 GB with no custom domain and no independent audit backs the crypto implementation
Usability6.0/10
No native desktop application on any platform — webmail plus IMAP/POP/SMTP for desktop, a PWA plus native iOS/Android apps for mobile — and per-message OpenPGP key management carries a real learning curve
Price & Value8.0/10
Base renews at $2.50/month and Entry at $3.50/month billed yearly, both with a genuinely usable free tier alongside them — among the lowest entry prices in this category

Overall7.0/10

Security 30% · Privacy & Trust 30% · Features 15% · Usability 15% · Price & Value 10%

See our rating methodology →