# Webmail privacy ratings

Email clients that run in the browser, hosted or self-hosted.

**Our pick:** [Forward Email Webmail](https://privacyratings.com/webmail/forward-email-webmail/): Source-available webmail with built-in OpenPGP and no third-party analytics, covered by Cure53's audit. It works only with Forward Email accounts, not other IMAP and SMTP providers.

| Name | Grade | Jurisdiction | Description |
| --- | --- | --- | --- |
| [Forward Email Webmail](https://privacyratings.com/webmail/forward-email-webmail/) (our pick) | C (74/100) | United States (Five Eyes) | Hosted webmail for Forward Email accounts, with mail, calendar and contacts, built-in OpenPGP and optional encryption of locally cached data. It shares one source-available codebase with the Forward Email desktop and mobile apps. |
| [Horde Groupware Webmail Edition](https://privacyratings.com/webmail/horde-groupware/) | B (89/100) | Unknown | Self-hosted, open-source groupware suite built on the Horde framework, with the IMP webmail client, mail filters, calendar, contacts, tasks and notes. |
| [SnappyMail](https://privacyratings.com/webmail/snappymail/) | B (89/100) | Unknown | Self-hosted, IMAP-only webmail client forked from RainLoop, with built-in OpenPGP support. |
| [Cypht](https://privacyratings.com/webmail/cypht/) | B (84/100) | Unknown | Self-hosted, open-source webmail that combines several IMAP, JMAP and SMTP accounts, plus feeds, in one interface, built from optional modules. |
| [Nextcloud Mail](https://privacyratings.com/webmail/nextcloud-mail/) | B (84/100) | Germany (Fourteen Eyes) | Open-source mail app for self-hosted Nextcloud servers that adds webmail for any IMAP account, with S/MIME, Mailvelope support and integration with Nextcloud contacts and calendar. |
| [RoundCube](https://privacyratings.com/webmail/roundcube/) | B (84/100) | Unknown | Browser-based multilingual IMAP client with an application-like user interface. |
| [SquirrelMail](https://privacyratings.com/webmail/squirrelmail/) | B (79/100) | Unknown | Self-hosted PHP webmail with built-in IMAP and SMTP support that renders plain HTML pages without JavaScript and is extended through plugins. |
| [Afterlogic WebMail Lite](https://privacyratings.com/webmail/afterlogic-webmail-lite/) | C (74/100) | Unknown | Self-hosted, open-source PHP webmail for an existing IMAP server, with contacts, OpenPGP in the browser and a module system. A paid Pro edition adds more features. |
| [SOGo](https://privacyratings.com/webmail/sogo/) | C (63/100) | Unknown | Self-hosted, open-source groupware server with webmail, calendars and address books, supporting CalDAV, CardDAV and ActiveSync. It uses an existing IMAP server for mail. |
| [Zimbra Collaboration](https://privacyratings.com/webmail/zimbra/) | D (50/100) | United States (Five Eyes) | Self-hosted email and collaboration server from Synacor, with a web client for mail, calendar, contacts and files. An open-source edition and a commercial Network Edition with extra features are offered. |

## Criteria

- **Open source** (weight 3): Is all the source code needed to run the product public?
- **No trackers or telemetry** (weight 3): Are the website and apps free of third-party trackers, with any analytics anonymous and any telemetry off by default?
- **No ads or data sales** (weight 2): Is the product funded without advertising, ad targeting or selling user data?
- **Independent audit** (weight 2): Has an independent security or privacy audit been published within the last three years?
- **Transparency report** (weight 2): Does the provider regularly publish how many government and legal requests it receives and how it responds?
- **Tells users about requests** (weight 1): Does the provider promise to tell users about requests for their data, unless a court forbids it?
- **TLS configuration** (weight 2, automated): Does the website pass the Qualys SSL Labs test with a grade of A or better?
- **Security headers** (weight 1, automated): Does the website pass the Mozilla HTTP Observatory test with a grade of A or better?
- **Modern web standards** (weight 1, automated): Does the website score 90% or higher on the Internet.nl website test?
- **OpenPGP support** (weight 2): Can the app encrypt and sign mail with OpenPGP, built in or through an official add-on?
- **Connects directly** (weight 3): Does the app connect directly to your mail server, without passing mail or passwords through the vendor's servers?
- **Blocks remote content** (weight 2): Are remote images and tracking pixels blocked by default?
- **Works with any provider** (weight 1): Does the app work with any standard IMAP and SMTP provider?
- **Self-hostable** (weight 1): Can the webmail be installed on your own server?

Source: https://privacyratings.com/webmail/