Tuta

Tuta is the encrypted mail service of Tutao GmbH, a company founded in Hanover in 2011 and now used by more than ten million people. It is built for users who want the provider to hold no readable copy of anything — mail, calendar, contacts, even the search index — and who accept that this rules out standard mail clients and standard password resets. The trade-off is unusually sharp here: Tuta goes further on encryption coverage than most email, and further on what it refuses to support.

Security

Everything in a Tuta mailbox is stored encrypted, and that includes mail that arrives from outside. A message from a non-Tuta sender is encrypted the moment it lands on Tuta’s servers and is never written to storage in plaintext. The same applies to the calendar, the address book, inbox rules and the search index. The only data left unencrypted is the routing metadata the email protocol itself requires: sender and recipient addresses, and timestamps.

Between two Tuta accounts, encryption is end-to-end and automatic, subject lines included. For a recipient outside Tuta, the mechanism is a shared password rather than PGP: you agree a password with that contact once, and it covers the whole conversation thread with them. Tuta does not implement PGP at all, and its reasoning is technical rather than commercial. PGP cannot encrypt the subject line, which Tuta does. PGP’s algorithms cannot be swapped out quickly for post-quantum replacements, which Tuta has already done. PGP has no Perfect Forward Secrecy option, where Tuta has a prototype. S/MIME is rejected on the same grounds, with reference to the EFAIL vulnerability the EFF disclosed in 2018. The practical consequence is that correspondence with someone who already runs PGP cannot be encrypted in the way they expect — they either accept the password flow or get an unencrypted message.

The protocol underneath is TutaCrypt, a hybrid design combining AES-256 for symmetric encryption, classical elliptic curve x25519, and Kyber/ML-KEM for post-quantum resistance. It has been rolling out to all accounts since March 2024, which made Tuta the first email provider to deploy a post-quantum protocol in production. TutaCrypt has also had genuine outside cryptographic scrutiny: Christian Holler, Tibor Jager and Tom Neuschulten published a peer-reviewed analysis in IACR Communications in Cryptology, defining Bellare–Rogaway-style security models for the protocol and giving reduction-based proofs of the assumptions under which it holds. That is a stronger form of review than most mail providers’ cryptography receives — but it examines the protocol design, not the running service, and it is not a commissioned penetration test of the deployed system.

That distinction matters because the penetration-test record is thin. Tuta states that SySS GmbH tested its apps before the public release — around the 2011 to 2014 launch period — and that the testers could not break into the system or retrieve encrypted data. No report is linked anywhere on the site, so the scope and methodology cannot be checked, and no more recent named third-party penetration test or crypto audit has been published. This is not an absence of review; the academic work is real and the code is public. It is an absence of a verifiable, current audit report, and it is the main reason the Security score sits where it does.

Login security holds up on the details. Keys are derived with Argon2 and SHA256, the password never reaches the server in plaintext, and the private key is stored server-side encrypted under that password, so Tuta cannot decrypt it. Two-factor authentication supports both TOTP and U2F, with U2F the stronger option.

One vulnerability is worth stating plainly. An XSS flaw was introduced on 20 January 2021 on a payment-processing subpage used for Braintree 3D-Secure card verification — not the main webmail, and not the desktop or mobile clients. A crafted link to that page, if clicked during the window it was live, could have exposed a browser-stored password or hijacked an active session. Tuta’s own internal security review found it and patched it the same day, 25 February 2021, closing a 36-day exposure. No payment data was exposed and no exploitation attempts are known. Found in-house, fixed in-house, disclosed publicly: that is the behaviour you want, though the 36 days show how long a regression can sit unnoticed on a secondary page.

Privacy & Trust

Tuta operates under German law, which means GDPR plus the Federal Data Protection Act that GDPR was partly modelled on. Tuta’s position is that no German law permits gag orders or backdoor mandates — a narrower and more checkable claim than the usual gestures at a privacy-friendly country.

The company is not venture-backed, which removes the standard pressure toward an exit and a rewritten privacy policy. It has been run out of Hanover since 2011 by the same entity, Tutao GmbH, registered at the District Court of Hanover under HRB 208014.

The architecture is the part that distinguishes Tuta most. Rather than assembling a mail service from existing components — Dovecot, Roundcube, Google Push — Tuta writes essentially the entire stack itself: web, desktop for Windows, macOS and Linux, Android and iOS. The stated reason is that every integrated component brings its own security weaknesses and tracking behaviour along with it. Building it all in-house is slow and means fewer features per year, which shows elsewhere in this review, but it also means there is no third-party analytics library or push service quietly observing usage. All clients are open source under GPLv3 on GitHub, desktop builds are signed and independently verifiable, and Tuta was the first open-source email app published on F-Droid.

Nothing in the product describes any analytics or tracking. Registration requires no phone number, IP addresses are not logged by default — including at signup, including over Tor — and outgoing mail has its IP headers stripped.

There is no VPN in the subscription, and Tuta says there never will be. Its argument is that as your mail provider it already sees your real IP, so routing your traffic through its own VPN would remove nothing while doubling what one company can observe. Declining to bundle a service it could easily sell is a better trust signal than most of what providers write about themselves.

Features

The free plan gives 1 GB of storage, one calendar, three labels, no custom domain and no extra addresses. Paid plans open up custom domains — three on Revolutionary, ten on Legend — with 15 and 30 extra addresses respectively, unlimited calendars and labels on both, and a family option.

Calendar is bundled and encrypted to the same standard as mail, including event attendees, reminders and push notifications: reminders are encrypted client-side, so Tuta’s servers never learn when your events are or what they are called. Drive is included as well.

Spam and phishing defence has to work without reading message bodies. Tuta covers the protocol layer with SPF, DKIM, DMARC and MTA-STS, blocks external content such as images and video by default until you allow it per message, and warns when the technical sender does not match the visible From address. That is less aggressive than content-scanning filters, which is the direct cost of the encryption.

The largest gap is IMAP, and it is deliberate and permanent. Tuta explains that IMAP would require sending decrypted data out to the client device, which the architecture does not allow. There is no bridge or workaround. You cannot move a Tuta mailbox into Outlook, Thunderbird or Apple Mail, and you cannot use a third-party client on any platform. If a standard mail client is part of how you work, Tuta is not a candidate.

Account recovery follows the same logic. There is no reset-link flow, because offering one would require Tuta to hold your password in a form it can read. Instead a recovery code is generated at signup, or on demand afterwards, that decrypts the private key independently of the password. You store it yourself, on paper or somewhere equally separate. Lose the password and the recovery code together and the account is gone — there is no support path, no identity check, no second chance.

Usability

Native clients cover Windows, macOS, Linux, Android and iOS, plus the web app, and all of them are Tuta’s own code rather than wrappers. Android users can install from F-Droid without touching Google’s services.

Day to day it behaves like a normal mailbox. Encryption between Tuta accounts is invisible, external mail arrives and reads the way external mail does, and the calendar works without any key handling. The friction sits in two specific places. Sending an encrypted message outside Tuta means agreeing a password with that person through some other channel first. And the recovery code has to be dealt with at signup, when you have the least sense of why it matters — the decision is cheap to postpone and expensive to have postponed.

The no-IMAP rule is the other thing to weigh before signing up rather than after. Migration into Tuta’s clients is the only path in, and there is no route to an existing mail client on the way out.

Price & Value

The free plan at €0 is tight — 1 GB, one calendar, three labels — but it does include the full encryption model rather than a stripped version of it.

Revolutionary is €3 per month billed yearly, or €3.60 billed monthly, both taxes included. That covers 20 GB of storage, unlimited calendars and labels, 15 extra addresses, three custom domains and a family option.

Legend is €8 per month billed yearly, or €9.60 monthly, for 500 GB, unlimited calendars and labels, 30 extra addresses, ten custom domains, the family option and priority support.

The useful detail is what is absent: there is no introductory rate that jumps at renewal. The €3 and €8 figures are what you pay in year one and in year five alike, taxes included, with no separate VAT line at checkout. For a paid encrypted mailbox with a custom domain, €3 a month at steady state is at the low end of this category.

Pros and Cons

Our Rating

Tuta suits people who want the provider to hold nothing readable at all and who run their mail entirely inside the provider’s own apps. The encryption coverage is wider than most of this category — subject lines, calendar reminders and the search index included — and the post-quantum protocol has real academic scrutiny behind it. It suits you less if you need IMAP, correspond with people who insist on PGP, or want a documented recent audit report to point at; the first two are permanent design decisions, and the third is a gap Tuta could close but has not.