{
  "slug": "lavabit",
  "category": "email-providers",
  "name": "Lavabit",
  "description": "Email service from Lavabit LLC in the United States, founded by Ladar Levison. Its Magma mail server is open source. New registrations are closed, and the website states that mail services remain online.",
  "website": "https://lavabit.com",
  "source": "https://github.com/lavabit/magma",
  "license": "AGPL-3.0",
  "platforms": [],
  "jurisdiction": {
    "code": "US",
    "name": "United States",
    "eyes": "Five Eyes",
    "eu": false,
    "gdpr": false,
    "cloud_act": "provider"
  },
  "pick": false,
  "pick_reason": null,
  "disclosure": null,
  "grade": "F",
  "score": 26,
  "coverage": 60,
  "summary": "Lavabit scores 26 out of 100 (grade F) on the email providers criteria. It meets 3 of 21 criteria: no trackers or telemetry, TLS configuration and POP3 support. It partly meets email security standards, IMAP support, SMTP submission and mail transport security. It does not meet independent audit, transparency report, tells users about requests, security headers, modern web standards, Sender Rewriting Scheme and ARC sealing. Still needing evidence: open source, no ads or data sales, end-to-end encryption, encrypted mailbox storage, open protocols, custom domains and sign up without personal data. It is based in the United States: Five Eyes member; subject to the US CLOUD Act. Automated tests: SSL Labs grade A+, Mozilla HTTP Observatory grade D, Internet.nl website score 68% and Internet.nl email score 71%.",
  "url": "https://privacyratings.com/email-providers/lavabit/",
  "markdown": "https://privacyratings.com/email-providers/lavabit/index.md",
  "answers": {
    "open_source": {
      "title": "Open source",
      "weight": 3,
      "answer": "unknown",
      "evidence": null,
      "note": null
    },
    "no_trackers": {
      "title": "No trackers or telemetry",
      "weight": 3,
      "answer": "yes",
      "evidence": "https://lavabit.com",
      "note": "The website is a single static page with no scripts, cookies or third-party resources. No privacy policy is published."
    },
    "no_ads": {
      "title": "No ads or data sales",
      "weight": 2,
      "answer": "unknown",
      "evidence": null,
      "note": null
    },
    "independent_audit": {
      "title": "Independent audit",
      "weight": 2,
      "answer": "no",
      "evidence": null,
      "note": "No independent audit is published."
    },
    "transparency_report": {
      "title": "Transparency report",
      "weight": 2,
      "answer": "no",
      "evidence": null,
      "note": "No transparency report or government request policy is published."
    },
    "user_notice": {
      "title": "Tells users about requests",
      "weight": 1,
      "answer": "no",
      "evidence": null,
      "note": "No published policy on notifying users about data requests."
    },
    "tls": {
      "title": "TLS configuration",
      "weight": 2,
      "answer": "yes",
      "evidence": "https://www.ssllabs.com/ssltest/analyze.html?d=lavabit.com&hideResults=on",
      "note": "Grade A+"
    },
    "security_headers": {
      "title": "Security headers",
      "weight": 1,
      "answer": "no",
      "evidence": "https://developer.mozilla.org/en-US/observatory/analyze?host=lavabit.com",
      "note": "Grade D (30/100+)"
    },
    "web_standards": {
      "title": "Modern web standards",
      "weight": 1,
      "answer": "no",
      "evidence": "https://batch.internet.nl/site/lavabit.com/22660368/",
      "note": "Score 68%"
    },
    "e2ee": {
      "title": "End-to-end encryption",
      "weight": 3,
      "answer": "unknown",
      "evidence": null,
      "note": null
    },
    "encrypted_storage": {
      "title": "Encrypted mailbox storage",
      "weight": 3,
      "answer": "unknown",
      "evidence": null,
      "note": null
    },
    "open_protocols": {
      "title": "Open protocols",
      "weight": 2,
      "answer": "unknown",
      "evidence": null,
      "note": null
    },
    "custom_domains": {
      "title": "Custom domains",
      "weight": 1,
      "answer": "unknown",
      "evidence": null,
      "note": null
    },
    "anonymous_signup": {
      "title": "Sign up without personal data",
      "weight": 2,
      "answer": "unknown",
      "evidence": null,
      "note": null
    },
    "mail_standards": {
      "title": "Email security standards",
      "weight": 2,
      "answer": "partial",
      "evidence": "https://batch.internet.nl/mail/lavabit.com/22855378/",
      "note": "Score 71%"
    },
    "imap_standards": {
      "title": "IMAP support",
      "weight": 2,
      "answer": "partial",
      "evidence": null,
      "note": "lavabit.com:993 (implicit TLS). IMAP4rev1 advertised, no IDLE before login."
    },
    "pop3_standards": {
      "title": "POP3 support",
      "weight": 1,
      "answer": "yes",
      "evidence": null,
      "note": "lavabit.com:995 (implicit TLS). CAPA: TOP, USER, UIDL, PIPELINING, EXPIRE, LOGIN-DELAY, RESP-CODES, AUTH-RESP-CODE, IMPLEMENTATION."
    },
    "smtp_standards": {
      "title": "SMTP submission",
      "weight": 2,
      "answer": "partial",
      "evidence": null,
      "note": "lavabit.com:465 (implicit TLS). Missing: SMTPUTF8."
    },
    "transport_security": {
      "title": "Mail transport security",
      "weight": 3,
      "answer": "partial",
      "evidence": null,
      "note": "Passes: SPF, DMARC reject, DNSSEC, DANE all. Missing: MTA-STS missing, TLS-RPT."
    },
    "srs": {
      "title": "Sender Rewriting Scheme",
      "weight": 1,
      "answer": "no",
      "evidence": null,
      "note": "No published documentation on SRS for forwarded mail."
    },
    "arc": {
      "title": "ARC sealing",
      "weight": 1,
      "answer": "no",
      "evidence": null,
      "note": "No published documentation on ARC signing or validation."
    }
  },
  "tests": {
    "ssllabs": "A+",
    "observatory": "D",
    "internetnl_web": 68,
    "internetnl_mail": 71,
    "trackers": [],
    "tested_at": "2026-11-14T11:33:29.339Z"
  },
  "last_modified": "2026-11-14T11:57:57Z"
}