The most secure email services
Secure email protects messages in transit and at rest, supports end-to-end encryption, and hardens its servers against interception. Each service below supports end-to-end encryption, and each page shows automated tests of TLS, MTA-STS, DANE, DNSSEC, SPF and DMARC along with evidence for every answer.
1. Forward Email Grade A Our pick
Open-source email service with encrypted mailboxes, custom domains, and IMAP, POP3, SMTP, CalDAV and CardDAV on every paid plan.
Why it is our pick: The whole service is published on GitHub, server code included. Each mailbox is a separately encrypted SQLite file, IMAP, POP3, SMTP, CalDAV and CardDAV work with any app, and custom domains are included on low-cost plans.
Based in the United States (Five Eyes). Score 93/100.
2. mailbox.org Grade C
Paid email, calendar and office service from Berlin, Germany, with built-in PGP encryption and support for custom domains.
Based in Germany (Fourteen Eyes). Score 70/100.
3. StartMail Grade C
Paid email service from the Netherlands with built-in PGP encryption, unlimited aliases and custom domains.
Based in the Netherlands (Nine Eyes). Score 66/100.
4. Kolab Now Grade C
Paid email and groupware service from Apheleia IT in Switzerland, built on the open-source Kolab platform, with calendars, contacts, files and video calls.
Based in Switzerland. Score 64/100.
5. Proton Mail Grade C
End-to-end encrypted email service from Switzerland, with apps for web, Android, iOS and desktop.
Based in Switzerland. Score 64/100.
6. CounterMail Grade C
Paid email service in Sweden that encrypts mail with OpenPGP and stores it encrypted. New registrations are closed.
Based in Sweden (Fourteen Eyes). Score 62/100.
7. Posteo Grade C
Paid, ad-free email service from Germany that runs without collecting names or addresses and accepts anonymous payment.
Based in Germany (Fourteen Eyes). Score 62/100.
8. Tuta Grade C
End-to-end encrypted email and calendar service from Germany, with open-source apps for web, desktop and mobile.
Based in Germany (Fourteen Eyes). Score 61/100.
9. Disroot Grade D
Volunteer-run platform from the Netherlands offering email and other open services.
Based in the Netherlands (Nine Eyes). Score 59/100.
10. Mailfence Grade D
Email service from Belgium with built-in OpenPGP encryption and signing, plus calendar, contacts and document storage.
Based in Belgium (Fourteen Eyes). Score 54/100.
11. Infomaniak Mail Grade D
Email service from Swiss company Infomaniak, with free ik.me addresses and paid hosting for custom domains, plus web and mobile apps.
Based in Switzerland. Score 53/100.
12. Runbox Grade D
Paid email service from Norway with custom domain hosting, standard protocols and an open-source webmail app.
Based in Norway (Nine Eyes). Score 49/100.
13. Zoho Mail Grade D
Email service from Zoho for businesses and individuals, with custom domains, calendar and contacts, and an ad-free free plan.
Based in India. Score 45/100.
14. GMX Grade F
Free, ad-supported email service from 1&1 Mail & Media in Germany, with webmail, mobile apps, calendar and cloud storage.
Based in Germany (Fourteen Eyes). Score 31/100.
How this list is made
Entries are ranked with our picks first, then by score against public criteria. Every answer links to evidence, and hosted services are tested automatically. Only entries answering end-to-end encryption with evidence are included. The list updates when ratings change.
Compare all: email providers. Criteria and scoring.
Questions
What makes an email service secure?
Look for end-to-end encryption such as OpenPGP, encrypted storage, enforced transport security (MTA-STS or DANE), DNSSEC, strong TLS, two-factor sign-in and a recent independent security audit. The criteria and tests behind each rating are public.
Is end-to-end encrypted email possible with any recipient?
Only when both sides support the same system. OpenPGP works across providers and apps; some services use their own encryption between their own users and password-protected messages for everyone else.