Private and open-source alternatives to WEB.DE
15 email providers rated against the same public privacy criteria as WEB.DE (WEB.DE FreeMail, WEB.DE Mail), with our picks first.
What is the best private alternative to WEB.DE?
Our pick is Forward Email. The whole service is published on GitHub, server code included. Each mailbox is a separately encrypted SQLite file, IMAP, POP3, SMTP, CalDAV and CardDAV work with any app, and custom domains are included on low-cost plans. Disclosure. Privacy Ratings is maintained by the team behind Forward Email. This entry is scored by the same criteria as every other email provider, and changes to it are reviewed under the published conflict-of-interest rules.
Why look for an alternative?
- Open source: no. Closed source.
- No trackers or telemetry: no. The home page loads a Criteo pixel, and the privacy policy describes usage analysis and personalized advertising based on consent.
- No ads or data sales: no. The free service is funded by advertising, including personalized ads. With consent, mail from commercial senders is analyzed to build an interest profile.
- Independent audit: no. No independent audit is published.
- Transparency report: partial. A yearly DSA transparency report, shared with GMX, counts only orders under the EU Digital Services Act. Other law enforcement requests are not counted.
- Tells users about requests: no. No published policy on notifying users about data requests.
- Security headers: partial. Grade B (75/100+)
- Modern web standards: partial. Score 86%
- End-to-end encryption: partial. OpenPGP encryption works through the Mailvelope browser extension and the WEB.DE apps, and is off by default. The help pages say new setup in webmail is not possible at the moment.
- Encrypted mailbox storage: no. Encryption at rest for stored mail is not documented.
- Sign up without personal data: no. Registration asks for name, date of birth and postal address, and requires a German or Swiss mobile number confirmed by SMS.
- Email security standards: partial. Score 82%
- SMTP submission: partial. smtp.web.de:465 (implicit TLS). Missing: SMTPUTF8, PIPELINING.
- Mail transport security: partial. Passes: SPF, DMARC quarantine, TLS-RPT, DNSSEC, DANE all. Missing: MTA-STS testing.
- Sender Rewriting Scheme: no. No published documentation on SRS for forwarded mail.
- ARC sealing: no. No published documentation on ARC signing or validation.
The alternatives
Forward Email Grade A Our pick
Open-source email service with encrypted mailboxes, custom domains, and IMAP, POP3, SMTP, CalDAV and CardDAV on every paid plan.
Why it is our pick: The whole service is published on GitHub, server code included. Each mailbox is a separately encrypted SQLite file, IMAP, POP3, SMTP, CalDAV and CardDAV work with any app, and custom domains are included on low-cost plans.
Disclosure. Privacy Ratings is maintained by the team behind Forward Email. This entry is scored by the same criteria as every other email provider, and changes to it are reviewed under the published conflict-of-interest rules.
Based in the United States (Five Eyes). Forward Email scores 98 out of 100 (grade A) on the email providers criteria. It meets 20 of 21 criteria: open source, no trackers or telemetry, no ads or data sales, independent audit, tells users about requests, TLS configuration, security headers, modern web standards, end-to-end encryption, encrypted mailbox storage, open protocols, custom domains, sign up without personal data, email security standards, IMAP support, POP3 support, SMTP submission, mail transport security, Sender Rewriting Scheme and ARC sealing.
mailbox.org Grade C
Paid email, calendar and office service from Berlin, Germany, with built-in PGP encryption and support for custom domains.
Based in Germany (Fourteen Eyes). mailbox.org scores 70 out of 100 (grade C) on the email providers criteria. It meets 12 of 21 criteria: no trackers or telemetry, no ads or data sales, transparency report, TLS configuration, security headers, modern web standards, open protocols, custom domains, sign up without personal data, IMAP support, POP3 support and mail transport security.
StartMail Grade C
Paid email service from the Netherlands with built-in PGP encryption, unlimited aliases and custom domains.
Based in the Netherlands (Nine Eyes). StartMail scores 69 out of 100 (grade C) on the email providers criteria. It meets 12 of 21 criteria: no ads or data sales, transparency report, TLS configuration, modern web standards, encrypted mailbox storage, open protocols, custom domains, sign up without personal data, email security standards, IMAP support, SMTP submission and mail transport security.
CounterMail Grade C
Paid email service in Sweden that encrypts mail with OpenPGP and stores it encrypted. New registrations are closed.
Based in Sweden (Fourteen Eyes). CounterMail scores 63 out of 100 (grade C) on the email providers criteria. It meets 10 of 21 criteria: no trackers or telemetry, no ads or data sales, TLS configuration, modern web standards, end-to-end encryption, encrypted mailbox storage, open protocols, custom domains, sign up without personal data and IMAP support.
Kolab Now Grade C
Paid email and groupware service from Apheleia IT in Switzerland, built on the open-source Kolab platform, with calendars, contacts, files and video calls.
Based in Switzerland. Kolab Now scores 63 out of 100 (grade C) on the email providers criteria. It meets 10 of 21 criteria: open source, no trackers or telemetry, no ads or data sales, TLS configuration, open protocols, custom domains, IMAP support, POP3 support, SMTP submission and mail transport security.
Posteo Grade C
Paid, ad-free email service from Germany that runs without collecting names or addresses and accepts anonymous payment.
Based in Germany (Fourteen Eyes). Posteo scores 63 out of 100 (grade C) on the email providers criteria. It meets 10 of 21 criteria: no trackers or telemetry, no ads or data sales, transparency report, TLS configuration, modern web standards, encrypted mailbox storage, open protocols, sign up without personal data, IMAP support and POP3 support.
Aster Mail Grade C
Email service from Aster Communications Inc. in the United States, with servers in Germany. Mail between Aster users is end-to-end encrypted with a hybrid post-quantum key exchange. Free and paid plans, no ads in the service.
Based in the United States (Five Eyes). Aster Mail scores 62 out of 100 (grade C) on the email providers criteria. It meets 9 of 20 criteria: transparency report, tells users about requests, TLS configuration, security headers, modern web standards, end-to-end encryption, encrypted mailbox storage, custom domains and email security standards.
Tuta Grade C
End-to-end encrypted email and calendar service from Germany, with open-source apps for web, desktop and mobile.
Based in Germany (Fourteen Eyes). Tuta scores 62 out of 100 (grade C) on the email providers criteria. It meets 10 of 20 criteria: no trackers or telemetry, no ads or data sales, transparency report, security headers, modern web standards, end-to-end encryption, encrypted mailbox storage, custom domains, sign up without personal data and mail transport security.
Proton Mail Grade C
End-to-end encrypted email service from Switzerland, with apps for web, Android, iOS and desktop.
Based in Switzerland. Proton Mail scores 60 out of 100 (grade C) on the email providers criteria. It meets 8 of 21 criteria: no ads or data sales, transparency report, tells users about requests, TLS configuration, end-to-end encryption, encrypted mailbox storage, custom domains and mail transport security.
Disroot Grade D
Volunteer-run platform from the Netherlands offering email and other open services.
Based in the Netherlands (Nine Eyes). Disroot scores 59 out of 100 (grade D) on the email providers criteria. It meets 9 of 21 criteria: open source, no trackers or telemetry, no ads or data sales, TLS configuration, open protocols, custom domains, IMAP support, POP3 support and mail transport security.
Infomaniak Mail Grade D
Email service from Swiss company Infomaniak, with free ik.me addresses and paid hosting for custom domains, plus web and mobile apps.
Based in Switzerland. Infomaniak Mail scores 56 out of 100 (grade D) on the email providers criteria. It meets 8 of 21 criteria: no ads or data sales, TLS configuration, modern web standards, open protocols, custom domains, email security standards, IMAP support and POP3 support.
Soverin Grade D
Paid email service from Soverin B.V. in Amsterdam, the Netherlands, with custom domains, unlimited aliases and calendar and contact sync. There is no free plan and no advertising.
Based in the Netherlands (Nine Eyes). Soverin scores 56 out of 100 (grade D) on the email providers criteria. It meets 9 of 20 criteria: no trackers or telemetry, no ads or data sales, TLS configuration, modern web standards, open protocols, custom domains, email security standards, IMAP support and Sender Rewriting Scheme.
Riseup Grade D
Email, mailing list and VPN service run by an autonomous tech collective in Seattle for activists and social movements. Accounts need an invite, and the service is funded by donations.
Based in the United States (Five Eyes). Riseup scores 55 out of 100 (grade D) on the email providers criteria. It meets 9 of 21 criteria: no trackers or telemetry, no ads or data sales, TLS configuration, encrypted mailbox storage, open protocols, sign up without personal data, IMAP support, POP3 support and SMTP submission.
Purelymail Grade D
Low-cost email hosting from the United States with custom domains, standard protocols and mail stored encrypted with the user's password.
Based in the United States (Five Eyes). Purelymail scores 51 out of 100 (grade D) on the email providers criteria. It meets 8 of 21 criteria: no trackers or telemetry, no ads or data sales, TLS configuration, encrypted mailbox storage, open protocols, custom domains, sign up without personal data and IMAP support.
Mailfence Grade D
Email service from Belgium with built-in OpenPGP encryption and signing, plus calendar, contacts and document storage.
Based in Belgium (Fourteen Eyes). Mailfence scores 50 out of 100 (grade D) on the email providers criteria. It meets 8 of 21 criteria: no trackers or telemetry, no ads or data sales, transparency report, TLS configuration, custom domains, IMAP support, POP3 support and mail transport security.
Compare all 44 email providers