“Privacy email” is mostly a marketing phrase. Underneath it there are four properties that actually vary across providers, and a useful comparison aligns on those:
- Signup posture — what does the provider know about you from the moment you register?
- Cryptography model — what does the provider see on your mail at rest and in transit?
- Operator jurisdiction and posture — what does compelled disclosure look like?
- Practical interoperability — does it deliver mail to the people you actually email?
Comparing on threat model#
| Provider | Signup | Crypto model | Jurisdiction | Cash payment | Inbox interop |
|---|---|---|---|---|---|
| Proton Mail | Email-or-anon; abuse-prevention can ask for SMS | E2E (Proton↔Proton, PGP); at-rest E2E inbound | Switzerland | Crypto / card | Excellent |
| Tuta | Username only | E2E in-protocol (subjects too) | Germany | Crypto / card / bank | Good (closed protocol; no IMAP) |
| Mailfence | Username + email recovery | PGP-only | Belgium | Crypto / card | Excellent (IMAP/SMTP) |
| cock.li | Username only | At-rest, PGP-on-demand | Romania | Crypto only | Frequently blocked |
| Posteo | Username only; cash-by-mail funded | At-rest by user key | Germany | Cash-by-mail | Excellent |
| Riseup | Invite-only / justification | At-rest by user key | United States | Donation | Good (collective context matters) |
| Disroot | Username only | At-rest | Netherlands | Donation | OK |
What each provider buys you#
Proton Mail is the well-funded mainstream choice. Strong cryptography, audited clients, professional product. The cost is that the signup happy path involves an email-or-phone fallback if you trip an anti-abuse heuristic, and Switzerland’s legal context can compel IP-at-login disclosure under court order. Best fit for users who want a polished product and accept the operator-side trust profile.
Tuta maximizes default-on encryption — subjects, address book, and attachment metadata are all encrypted at rest. The cost is the closed protocol: no PGP interop, no IMAP, no SMTP. You use Tuta’s client. Best fit when default-on metadata encryption is the requirement.
Mailfence is the PGP-native, IMAP-supporting, Belgian alternative. End-to-end encryption is PGP, so it interops with anyone else who uses PGP; metadata is visible to the operator. Best fit for users who want IMAP-compatible mail with explicit PGP support.
cock.li is the minimal-signup choice. Username only, no recovery email, donation-funded. The trade-off is delivery — many systems block the domain by default. Best fit as a side address for accounts that accept it.
Posteo is the cash-payment choice. Username at signup, cash-by-mail accepted as funding, operator explicitly does not bind payment to account. Cryptography is at-rest by user key, not E2E. Best fit when payment-side de-linking is the binding requirement.
Riseup is the activist-collective choice. 25+ years of operating, invite-only signup, U.S. operator with a strong community-trust record. Best fit for users embedded in activist contexts who already have an invite.
Disroot is the small-FOSS-collective choice. One username, several bundled services. Volunteer-grade reliability. Best fit as a side account in the FOSS-collective space.
How to combine them#
Most users who think hard about email privacy end up with a small portfolio:
- A primary inbox with one of Proton, Tuta, or Mailfence — usable, deliverable, end-to-end where it counts.
- A payment / billing inbox on Posteo (because cash-funded) or Tuta (because polished but minimal signup).
- A throwaway inbox on cock.li or a SimpleLogin-style alias provider, for sites that ask for an email but should not have your real one.
The portfolio model exists because the trade-offs cannot all be satisfied by one provider. Tuta encrypts subjects but doesn’t do IMAP. Proton does IMAP (via Bridge) but knows your IP at login. Posteo accepts cash but encrypts only at rest. The portfolio buys you the union of strengths.
What it doesn’t buy you#
A privacy email provider does not change:
- What recipients do with your mail. The most secure provider in the world cannot stop a recipient from forwarding your message to a list, replying with the original quoted, or screenshotting your message.
- How email metadata leaks at the protocol level. SMTP envelopes are visible to every relay between sender and receiver. End-to-end encryption hides the content; it does not hide who sent to whom and when.
- Your association with the inbox. If you signed up via your home IP without Tor, the operator can correlate the account to a network identity. Signup transport hygiene is part of the threat model.
A note on threat-model honesty#
There is a tendency in privacy-email discussions to grade providers on whether they are “really” private. The honest answer is that all of these providers are dramatically more private than mainstream alternatives, and the differences between them are about which specific failure modes you are most concerned about. The right comparison is “Proton vs. Tuta given my threat model,” not “is X really private.”
This directory’s job is to make the threat-model dimensions explicit so you can match.