Tuta

Tuta is the encrypted mail service of Tutao GmbH, a company founded in Hanover in 2011 and now used by more than ten million people. It is built for users who want the provider to hold no readable copy of anything — mail, calendar, contacts, even the search index — and who accept that this rules out standard mail clients and standard password resets. The trade-off is unusually sharp here: Tuta encrypts the mailbox, calendar, address book and search index, and refuses to support IMAP, PGP and S/MIME.

Security

Everything in a Tuta mailbox is stored encrypted, and that includes mail that arrives from outside. A message from a non-Tuta sender is encrypted the moment it lands on Tuta’s servers and is never written to storage in plaintext. The same applies to the calendar, the address book, inbox rules and the search index. The only data left unencrypted is the routing metadata the email protocol itself requires: sender and recipient addresses, and timestamps.

Between two Tuta accounts, encryption is end-to-end and automatic, subject lines included. For a recipient outside Tuta, the mechanism is a shared password rather than PGP: you agree a password with that contact once, and it covers the whole conversation thread with them. Tuta does not implement PGP at all, and its reasoning is technical rather than commercial. PGP cannot encrypt the subject line, which Tuta does. PGP’s algorithms cannot be swapped out quickly for post-quantum replacements, which Tuta has already done. PGP has no Perfect Forward Secrecy option, where Tuta has a prototype. S/MIME is rejected on the same grounds, with reference to the EFAIL vulnerability the EFF disclosed in 2018. The practical consequence is that correspondence with someone who already runs PGP cannot be encrypted in the way they expect — they either accept the password flow or get an unencrypted message.

The protocol underneath is TutaCrypt, a hybrid design combining AES-256 for symmetric encryption, classical elliptic curve x25519, and Kyber/ML-KEM for post-quantum resistance. Tuta says it has been rolling out to all accounts since March 2024 and calls it the first post-quantum email protocol. TutaCrypt has also had genuine outside cryptographic scrutiny: Christian Holler, Tibor Jager and Tom Neuschulten published a peer-reviewed analysis in IACR Communications in Cryptology, defining Bellare–Rogaway-style security models for the protocol and giving reduction-based proofs of the assumptions under which it holds. That is independent review of the cryptography — but it examines the protocol design, not the running service, and it is not a commissioned penetration test of the deployed system.

That distinction matters because the penetration-test record is thin. Tuta states that SySS GmbH tested its apps before the public release, with no date given, and that the testers could not break into the system or retrieve encrypted data. No report is linked anywhere on the site, so the scope and methodology cannot be checked, and no more recent named third-party penetration test or crypto audit has been published. This is not an absence of review; the academic work is real and the code is public. It is an absence of a verifiable, current audit report, and it is the main reason the Security score sits where it does.

Login security holds up on the details. Keys are derived with Argon2 and SHA256, the password never reaches the server in plaintext, and the private key is stored server-side encrypted under that password, so Tuta cannot decrypt it. Two-factor authentication supports both TOTP and U2F, with U2F the stronger option.

One vulnerability is worth stating plainly. An XSS flaw was introduced on 20 January 2021 on a payment-processing subpage used for Braintree 3D-Secure card verification — not the main webmail, and not the desktop or mobile clients. A crafted link to that page, if clicked during the window it was live, could have exposed a browser-stored password or hijacked an active session. Tuta’s own internal security review found it and patched it the same day, 25 February 2021, closing a 36-day exposure. No payment data was exposed and no exploitation attempts are known. Found in-house, fixed in-house, disclosed publicly: that is the behaviour you want, though the 36 days show how long a regression can sit unnoticed on a secondary page.

Privacy & Trust

Tuta operates under German law, which means GDPR plus the Federal Data Protection Act that GDPR was partly modelled on. Tuta says no German law permits gag orders or backdoor mandates.

German courts can still order surveillance of a single mailbox. Tuta’s transparency report explains that, on a valid court order for real-time monitoring, it has to hand over the contents of emails received after the order: mail sent unencrypted arrives in plain text, end-to-end encrypted mail only in encrypted form, and plain-text mail that arrived earlier was already encrypted on the server and cannot be decrypted by Tuta. The same kind of order can record IP addresses for one account, but not for the past. Tuta reports that between 1 January and 30 June 2026 it received 215 requests for inventory data and released it in 28 cases, received 14 requests for stored content data and released stored encrypted content in 11, and received 12 requests for real-time content data and released it in 6.

Tuta says it is not backed by large venture capitalists. It is run out of Hanover by Tutao GmbH, registered at the District Court of Hanover under HRB 208014.

The architecture is the part that distinguishes Tuta most. Rather than assembling a mail service from existing components — Dovecot, Roundcube, Google Push — Tuta writes essentially the entire stack itself: web, desktop for Windows, macOS and Linux, Android and iOS. The stated reason is that every integrated component brings its own security weaknesses and tracking behaviour along with it. Tuta says it has built its own captcha and Android push service instead of using Google’s. All clients are open source under GPLv3 on GitHub, Tuta says its desktop builds are signed so the code can be checked against GitHub, and says it was the first open-source email app published on F-Droid.

Tuta’s security page describes no analytics or tracking. Registration requires no phone number, including over Tor, Tuta says it does not log IP addresses at login or when sending mail by default, and outgoing mail has its IP headers stripped.

There is no VPN in the subscription, and Tuta says there never will be. Its argument is that as your mail provider it already sees your real IP, so routing your traffic through its own VPN would remove nothing while doubling what one company can observe.

Features

The free plan gives 1 GB of storage, one calendar, three labels, no custom domain and no extra addresses. Paid plans open up custom domains — three on Revolutionary, ten on Legend — with 15 and 30 extra addresses respectively, unlimited calendars and labels on both, and a family option.

Calendar is bundled and encrypted to the same standard as mail, including event attendees, reminders and push notifications: Tuta says reminders are handled on the device, so its servers never learn when your events are or what they are called. Tuta Drive, its encrypted file storage, is in closed beta and is not part of the plans listed on the pricing page.

Spam and phishing defence has to work without reading message bodies. Tuta covers the protocol layer with SPF, DKIM, DMARC and MTA-STS, blocks external content such as images and video by default until you allow it per message, and warns when the technical sender does not match the visible From address. That is less aggressive than content-scanning filters, which is the direct cost of the encryption.

The largest gap is IMAP, and it is deliberate and permanent. Tuta explains that IMAP would require sending decrypted data out to the client device, which the architecture does not allow. There is no bridge or workaround. You cannot move a Tuta mailbox into Outlook, Thunderbird or Apple Mail, and you cannot use a third-party client on any platform. If a standard mail client is part of how you work, Tuta is not a candidate.

Account recovery follows the same logic. There is no reset-link flow, because offering one would require Tuta to hold your password in a form it can read. Instead a recovery code is generated at signup, or on demand afterwards, that decrypts the private key independently of the password. You store it yourself, on paper or somewhere equally separate. Lose the password and the recovery code together and the account is gone — there is no support path, no identity check, no second chance.

Usability

Native clients cover Windows, macOS, Linux, Android and iOS, plus the web app, and all of them are Tuta’s own code rather than wrappers. Android users can install from F-Droid without touching Google’s services.

Day to day it behaves like a normal mailbox. Encryption between Tuta accounts is invisible, external mail arrives and reads the way external mail does, and the calendar works without any key handling. The friction sits in two specific places. Sending an encrypted message outside Tuta means agreeing a password with that person through some other channel first. And the recovery code has to be dealt with at signup, when you have the least sense of why it matters — the decision is cheap to postpone and expensive to have postponed.

The no-IMAP rule is the other thing to weigh before signing up rather than after. Migration into Tuta’s clients is the only path in, and there is no route to an existing mail client on the way out.

Price & Value

The free plan at €0 is tight — 1 GB, one calendar, three labels — but it does include the full encryption model rather than a stripped version of it.

Revolutionary is €3 per month billed yearly, or €3.60 billed monthly, both taxes included. That covers 20 GB of storage, unlimited calendars and labels, 15 extra addresses, three custom domains and a family option.

Legend is €8 per month billed yearly, or €9.60 monthly, for 500 GB, unlimited calendars and labels, 30 extra addresses, ten custom domains, the family option and priority support.

The pricing page shows one price per plan and billing period, taxes included, and lists no separate introductory rate. It also says that the final amount may vary with payment platform fees and exchange rates, and that after the first period the plan becomes a non-fixed-term contract that can be cancelled at any time.

Pros and Cons

Our Rating

Tuta suits people who want the provider to hold nothing readable at all and who run their mail entirely inside the provider’s own apps. The encryption covers subject lines, calendar reminders and the search index, and the post-quantum protocol has real academic scrutiny behind it. It suits you less if you need IMAP, correspond with people who insist on PGP, or want a documented recent audit report to point at; the first two are permanent design decisions, and the third is a gap Tuta could close but has not.