Webmail privacy ratings

Email clients that run in the browser, hosted or self-hosted.

10 webmail are rated against 14 public criteria, and 10 have enough evidence for a letter grade. Our pick is Forward Email Webmail. Of the 3 with a known jurisdiction, 2 are based in a Five Eyes country, and 3 in the wider Fourteen Eyes.

Open-source webmail only · Criteria for this category · Suggest an addition · Markdown

Webmail privacy ratings, sorted by pick and then by grade
Name	Grade	Score	Data	Jurisdiction	Open source	No trackers or telemetry	No ads or data sales	Independent audit	Transparency report	Tells users about requests	OpenPGP support	Connects directly	Blocks remote content	Works with any provider	Self-hostable	TLS configuration	Security headers	Modern web standards
Forward Email Webmail Our pick Hosted webmail for Forward Email accounts, with mail, calendar and contacts, built-in OpenPGP and optional encryption of locally cached data. It shares one source-available codebase with the Forward Email desktop and mobile apps.	Grade C	74	100%	United States Five Eyes	Yes	Partial	Yes	Yes	Partial	Yes	Yes	Yes	Partial	No	Partial	Partial	Partial	Not tested yet
Horde Groupware Webmail Edition Self-hosted, open-source groupware suite built on the Horde framework, with the IMP webmail client, mail filters, calendar, contacts, tasks and notes.	Grade B	89	100%	–	Yes	Yes	Yes	No	Not applicable	Not applicable	Yes	Yes	Yes	Yes	Yes	Not applicable	Not applicable	Not applicable
SnappyMail Self-hosted, IMAP-only webmail client forked from RainLoop, with built-in OpenPGP support.	Grade B	89	100%	–	Yes	Yes	Yes	No	Not applicable	Not applicable	Yes	Yes	Yes	Yes	Yes	Not applicable	Not applicable	Not applicable
Cypht Self-hosted, open-source webmail that combines several IMAP, JMAP and SMTP accounts, plus feeds, in one interface, built from optional modules.	Grade B	84	100%	–	Yes	Yes	Yes	No	Not applicable	Not applicable	Partial	Yes	Yes	Yes	Yes	Not applicable	Not applicable	Not applicable
Nextcloud Mail Open-source mail app for self-hosted Nextcloud servers that adds webmail for any IMAP account, with S/MIME, Mailvelope support and integration with Nextcloud contacts and calendar.	Grade B	84	100%	Germany Fourteen Eyes	Yes	Yes	Yes	No	Not applicable	Not applicable	Partial	Yes	Yes	Yes	Yes	Not applicable	Not applicable	Not applicable
RoundCube Browser-based multilingual IMAP client with an application-like user interface.	Grade B	84	100%	–	Yes	Yes	Yes	No	Not applicable	Not applicable	Partial	Yes	Yes	Yes	Yes	Not applicable	Not applicable	Not applicable
SquirrelMail Self-hosted PHP webmail with built-in IMAP and SMTP support that renders plain HTML pages without JavaScript and is extended through plugins.	Grade B	79	100%	–	Yes	Yes	Yes	No	Not applicable	Not applicable	No	Yes	Yes	Yes	Yes	Not applicable	Not applicable	Not applicable
Afterlogic WebMail Lite Self-hosted, open-source PHP webmail for an existing IMAP server, with contacts, OpenPGP in the browser and a module system. A paid Pro edition adds more features.	Grade C	74	100%	–	Yes	No	Yes	No	Not applicable	Not applicable	Yes	Yes	Yes	Yes	Yes	Not applicable	Not applicable	Not applicable
SOGo Self-hosted, open-source groupware server with webmail, calendars and address books, supporting CalDAV, CardDAV and ActiveSync. It uses an existing IMAP server for mail.	Grade C	63	100%	–	Yes	No	Yes	No	Not applicable	Not applicable	No	Yes	Yes	Yes	Yes	Not applicable	Not applicable	Not applicable
Zimbra Collaboration Self-hosted email and collaboration server from Synacor, with a web client for mail, calendar, contacts and files. An open-source edition and a commercial Network Edition with extra features are offered.	Grade D	50	100%	United States Five Eyes	Partial	No	Yes	No	Not applicable	Not applicable	No	Yes	Yes	No	Yes	Not applicable	Not applicable	Not applicable

Questions

What is the most private option among webmail?

Our pick is Forward Email Webmail. Source-available webmail with built-in OpenPGP and no third-party analytics, covered by Cure53's audit. It works only with Forward Email accounts, not other IMAP and SMTP providers.

How are webmail rated?

Each entry answers 14 questions: open source, no trackers or telemetry, no ads or data sales, independent audit, transparency report, tells users about requests, TLS configuration, security headers, modern web standards, OpenPGP support, connects directly, blocks remote content, works with any provider and self-hostable. Answers need links to evidence. See the full criteria.

Does jurisdiction matter?

Jurisdiction decides which laws can compel a provider to hand over data. Each entry shows its country and whether it is in the Five, Nine or Fourteen Eyes. The data a provider can hand over depends mostly on what it stores and who holds the keys. Read about jurisdictions and the CLOUD Act.