Tutanota — End-to-End Encrypted Email Service
General Information
Tutanota is one of those projects that put privacy front and center. Based in Germany, it offers a mailbox where encryption is always on — not something users need to enable. Unlike many providers, even subject lines and contacts are encrypted. That detail alone made it stand out when it first appeared and it still does today.
It’s widely used by journalists, NGOs, and people who don’t trust the “free” webmail model. For admins, the appeal is that there’s nothing to maintain on-prem — it’s hosted — but still delivers more privacy than mainstream services.
How It Works
The setup is straightforward: accounts live on Tutanota’s servers, and users connect through a browser or the official desktop/mobile apps. All encryption and decryption happen locally in the client, so keys never leave the user’s device.
Custom domains are supported, and admins just need to add DNS records (MX, SPF, DKIM, DMARC). Calendars and contacts are built-in and encrypted the same way as mail. TLS is mandatory, and MFA can be enabled on top.
Functions
| Feature | In practice |
| Platforms | SaaS; web client, desktop apps, Android/iOS apps |
| Security | End-to-end encryption (mail, contacts, calendars) |
| Privacy | No tracking, no ads, anonymous signup possible |
| Webmail | Minimal UI with folders, filters, search |
| Calendar | Encrypted by default, supports sharing |
| Mobile apps | Push notifications on iOS/Android |
| Authentication | MFA, encrypted credentials |
| License | Proprietary backend, open-source clients |
Installation Guide
1. Register on the Tutanota site.
2. Add your custom domain if needed and configure DNS (MX, SPF, DKIM, DMARC).
3. Create user accounts and aliases in the admin console.
4. Install desktop or mobile apps for daily use.
5. Enable MFA for extra security.
Migration is usually done via IMAP import tools or manual export/import of old mail.
Everyday Use
– NGOs and activists choose it when surveillance is a concern.
– Freelancers adopt it as a clean, ad-free alternative to Gmail.
– Small companies use it with custom domains without running their own mail server.
– Privacy-conscious users like that encryption “just happens” without setup.
Most users don’t even notice what’s going on under the hood — they log in, send mail, and everything’s encrypted by default.
Limitations
– No IMAP or SMTP bridge — you’re locked to Tutanota’s apps and web client.
– Doesn’t integrate with Outlook or Thunderbird.
– Mailbox size is limited unless upgraded.
– Collaboration is narrower than what Google Workspace or Microsoft 365 offer.
Comparison
| Tool | Platforms | Strengths | Best Fit |
| Tutanota | SaaS, apps | Full E2E encryption (incl. subject lines) | NGOs, journalists, privacy users |
| Proton Mail | SaaS, apps | PGP-based, has IMAP bridge | Users wanting desktop client support |
| Posteo | SaaS | Privacy-first, eco-friendly, anonymous signup | Individuals, NGOs |
| Gmail | SaaS | Wide ecosystem, collaboration features | Enterprises, SaaS-first users |
| Outlook (M365) | SaaS/desktop | Deep MS integration | Corporates tied to Microsoft stack |
Notes from the Field
Admins often say Tutanota is the closest thing to “encrypted by default” email that regular users can handle. There are no keys to manage, no plugins to install. The flip side: some teams dislike the lack of IMAP, since it means giving up Outlook. In environments that are ready to standardize on its own apps, though, Tutanota is easy to roll out and hard to beat for privacy.