Tuta

Tuta is an email, calendar and contacts service built so that the provider cannot read what it stores. Mail is encrypted end-to-end by default, and the encryption covers subject lines, calendars and contacts as well as message bodies; keys are derived from the user's password, which is hashed and salted on the device before anything is sent. Tuta writes all of its own clients — web, Android, iOS, and desktop apps for Windows, macOS and Linux — and publishes them as open source. It deliberately supports no IMAP, since that would mean handing decrypted mail to a client, so the desktop apps are the way to use it outside the browser.

On the cryptography side, Tuta replaced RSA with ECDH (x25519) and Kyber-1024 to make key exchange post-quantum safe, offers two-factor authentication by TOTP or U2F, and hardens mail transport with MTA-STS, SPF, DKIM and DMARC. Searching runs against an encrypted index held on the user's own device rather than on the server. Plans run from a free mailbox with 1 GB of storage, one calendar and three labels up to 20 GB and 500 GB tiers that add alias addresses and custom domains; the company says more than 10,000 businesses use it, and sells a business tier aimed at organisations that need to hold mail in Germany under GDPR, with an order processing agreement available.

Tuta began in 2011 as a secure email service and is based in Hanover, Germany. The clients are open source while the service itself is operated by the company, which runs it on renewable energy and offers a discount to non-profits and schools. Its stated focus is privacy for individuals, journalists, whistleblowers and human rights organisations as much as for businesses.