I'm trying to figure out how to run encrypted email. This market segment seems to have more media buzz than others, and deciphering marketing speak and wiki pages is tedious, especially factoring in a few years worth of buzz. I have not come across what I am looking for yet.

Back in the day, many email providers did not support, meaning they did not allow, encrypted email. Today, I keep coming across things like Proton Mail, Hushmail, and Lavabit (discontinued), that do some kind of encryption, but not "the good stuff"; email encrypted at the client, and either passes through or is stored on the providers servers only in encrypted form. Importantly, the provider must not be able to decrypt the emails.

I'm not interested in doing anything illegal; I'm interested in this from a technology and privacy perspective.

  • Do modern mail providers (Outlook.com, GMail, Yahoo, etc) allow for encrypted emails?
  • Do providers allow for anonymous encrypted email use? Meaning, no additional requirement for a phone number or otherwise identifying information.
  • Do providers allow for the caching of encrypted email on their server, such that they become a repository and each client has to decrypt the messages? Basically, webmail of encrypted emails, while also allowing endpoints to download copies of the encrypted emails.

Put another way, I am looking for a mail provider and client server software combination that meets the following criteria:

  • Client side encryption: the provider has no way to read the contents and just stores blobs of some kind.
  • Service does not offer proprietary in-house encryption for the services users. Or that feature can be turned off. I'd like to stick to well known solutions like PGP or GPG or similar, instead of what ProtonMail and Hushmail are doing.
  • Service does not retain emails any longer than I leave it on their server. Meaning if I delete the email, they will remove it from their server. If not immediately, then shortly afterwards(ie minutes).
  • Service does not keep unnecessary logs and/or purges what they do keep periodically.
  • Supported by popular mail clients like Thunderbird, K-9 Mail, and others.

Nice to haves:

  • Service is free
  • Service keeps no logs
  • Service has a well known history or track record of privacy and security endeavors. For example, PIA, a VPN, funds certain projects, has a no-holds-barred blog, and is currently funding an audit on OpenVPN. PIA puts their money where their mouth is. The founder of Lavabit put his money where his mouth was by shutting down the service. Conversely, HideMyAss and Hushmail make some bold claims, but have marks on their history that belie their marketing to a degree. It's arguable how dark the marks are, but they are still marks against themselves.

Ultimately, I am looking for Windows and Android clients, but Linux support would be nice too.

  • 2
    Asking for service recommendations is off-topic here. It’s on-topic to ask for client recommendations (that work with certain services). -- That said, I never heard of email services that would disallow receiving/sending encrypted mails. Are you that they didn’t/don’t allow it? -- Usually, your favorite email client with OpenPGP support + any email services should do the job.
    – unor
    Commented Jan 4, 2017 at 22:08
  • 1
    I was surprised by your comment; the question seems appropriate to me. After reading softwarerecs.stackexchange.com/tour, it still seems appropriate to me.
    – Ryan
    Commented Jul 26, 2017 at 22:43
  • I think my question fits this circumstance described in this meta answer softwarerecs.meta.stackexchange.com/a/686/13355 Commented Jul 27, 2017 at 11:37


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.