Interactive matcher

Encrypted Email Provider Matcher

Hard-requirement knockout filters plus a threat-model selector. We rank the providers that survive your requirements and flag the crypto trade-offs that matter — not marketing.

Hard requirements are knockout filters: a provider that fails one is eliminated, not just down-ranked. Provider details were last reviewed 2026-10.

1. Hard requirements (knockout)

Toggle only the things you genuinely cannot live without. Each one removes providers that don't meet it.

PGP interoperability You need to exchange OpenPGP-encrypted mail with people who use GPG/Thunderbird/other PGP tools. Knocks out providers that use a proprietary scheme with no PGP. Subject-line encryption Subject lines must be encrypted at rest, not just the body. Most PGP-based providers store subjects in plaintext because IMAP and search depend on them. Zero-access encryption at rest Mail is stored encrypted with a key derived from your password, so a server compromise leaks ciphertext, not plaintext. IMAP without a bridge You want to use Thunderbird / Apple Mail over standard IMAP/SMTP with no extra bridge software or paid add-on. S/MIME support You need S/MIME (certificate-based) encryption, common in corporate or government contexts. Custom domain support You want to use you@yourdomain.com so your address is portable if you ever switch providers. Open-source clients The client (and ideally server) code must be open source so the encryption claims can be independently audited. Has a free tier You need a genuinely free plan, not just a trial. Low budget (≈ €1–3/mo if paid) If you pay, the entry plan should be roughly €1–3/month. Knocks out providers whose cheapest usable plan is higher.

Jurisdiction preference

A specific jurisdiction acts as a knockout. "EU" includes Germany; "outside the US" includes all of the above.

2. Who must not read your mail?

Select the threats that actually apply. Some imply a hard requirement; some can't be solved by any provider — we'll tell you which.

My current provider profiling my mail for ads Any zero-access provider here fully addresses this — the server cannot read message content. This is the most common, realistic reason to switch. I must exchange real PGP mail with a specific GPG contact Requires genuine OpenPGP interop. Proprietary-crypto providers (Tuta) only reach outsiders via password-protected links, which a GPG user cannot consume as PGP. My subject lines themselves are sensitive (source/legal work) Plaintext subjects are metadata the provider retains and can be compelled to produce. Only subject-line encryption addresses this. A court order to my provider for stored content Zero-access at rest means a content order returns ciphertext. Note: metadata (sender, recipient, timing, and subjects on PGP providers) can still be compelled — see the threat-model post. Someone phishing or breaking into my account No provider choice fixes this — it is the highest-probability threat. Strong unique password + TOTP 2FA on whichever provider you pick. Covered in the threat-model post. Keeping mail to ANY recipient (incl. Gmail users) private No encrypted-email provider solves this. Mail to a non-encrypted recipient is readable by their provider. For two specific people, use Signal/Wire instead — this is a tool-choice problem, not a provider problem.

Full comparison matrix

Provider	Jurisdiction	Crypto	PGP	Subj. enc	Zero-access	IMAP no bridge	S/MIME	Custom domain	Open src	Free	From
Proton Mail ↗	Switzerland	OpenPGP	✓	—	✓	—	—	✓	✓	✓	≈ $4/month (Mail Plus); custom domain needs a paid plan
Tuta (Tutanota) ↗	Germany	Proprietary TutaCrypt (AES-256 + x25519/Kyber-1024, post-quantum)	—	✓	✓	—	—	✓	✓	✓	≈ €3/month (custom domain included at this tier)
Mailbox.org ↗	Germany	OpenPGP / S/MIME	✓	—	✓	✓	✓	✓	—	—	€1/month (Light) / €3/month (Standard)
Posteo ↗	Germany	OpenPGP (with at-rest encryption option)	✓	—	✓	✓	—	—	—	—	€1/month
StartMail ↗	Netherlands	OpenPGP (PGP vault)	✓	—	—	✓	—	✓	—	—	≈ $5/month (annual)

None of these make mail to a non-encrypted recipient private — see the email security threat model.

Related tools in this network

Other interactive tools across the network that pair well with this one.