Proton vs. Gmail vs. black.com etc.

Is Your "Encrypted" Email Actually Secure?

Pretty much every email provider will tell you your email is encrypted. Google says Gmail "keeps your messages encrypted." Proton says its "emails are encrypted at all times." Apple, Microsoft, Tuta and we say it too.

Nobody is lying. But the word covers very different things. Google's own encryption whitepaper adds the sentence that matters: "Google manages cryptographic keys on behalf of its customers." Your mail is locked, and the company keeps a key to the lock. That protects you from a thief who steals a hard drive. It won't protect you from Google.

The word has been stretched before. In 2020, the US Federal Trade Commission alleged that Zoom had advertised "end-to-end, 256-bit encryption" while it "maintained the cryptographic keys that could allow Zoom to access the content of its customers' meetings." Today, Google calls a Gmail feature for large businesses "end-to-end encrypted." Its own FAQ then explains that real end-to-end keys are "generated on the client, so as an administrator, you don't have control over the keys." With this feature, the company's admins do, and Google says so itself.

So don't take "encrypted" at face value. For this tier list, we started with the question that matters most, who can read your email, and then looked at everything else that decides how safe it really is.

The Confusing Use of the Word "Encryption"

When a provider says "encrypted," it can mean four different things. Often it means several at once, each for a different part of your mailbox:

Gmail, Outlook, iCloud and Yahoo stop at the first two. Proton, Tuta and black.com use end-to-end encryption between their own users and zero-access encryption for everything else.

Encryption Isn't Everything

Strong encryption fails when everything around it is weak. A phished login, a breach of the provider's systems or a business model that runs on your data can undo the best cryptography. So we look at more than the math:

• Authentication. If someone can sign in as you, encryption doesn't matter. Your inbox decrypts for them just like it does for you.
• Transparency. Does the provider publish how often authorities ask for data, and does it tell you when they ask about you?
• Open source and audits. Published code and independent audits let outsiders check the claims. Closed code asks you to trust your provider.
• Ads and incentives. Ads aren't automatically a privacy problem. But a company that earns money from attention has a reason to learn about you, and few things say more about you than your inbox.
• Company values. Encryption is a decision someone has to keep making. In 2009, Google's then-CEO Eric Schmidt said: "If you have something that you don't want anyone to know, maybe you shouldn't be doing it in the first place." Tim Cook calls privacy "a fundamental human right," yet iCloud Mail still isn't end-to-end encrypted.
• In-house or outsourced. Every library a provider imports is code someone else wrote, and someone else can break. Tuta builds its apps, push notifications and cryptography itself, and says it's "not interested in needing to import a vast number of bloated libraries." Proton maintains OpenPGP.js, a library many other projects rely on. We rely on established libraries too: Apple's CryptoKit on iOS, Bouncy Castle on Android, liboqs on our servers and the browser's built-in WebCrypto for AES. Our email format and signing scheme are our own.

We grade nine categories below. Transparency, company values and in-house development don't get a letter, because there's no fair way to grade them. They still influence how far we trust each grade.

What the Encryption Tiers Mean

Every provider ends up in one of five tiers. Gmail and Outlook are the baseline: C is how most of the world's email works, not a failing grade.

Each of the nine categories below uses the same letters, with its own criteria stated at the top. We always grade default settings, because that's what most people use.

A Note on Ranking Ourselves

We make one of the products on this list, so read our grade with that in mind. To keep ourselves honest:

• We set the criteria before we graded anyone, and black.com is held to the same ones.
• Every claim about another provider links to that provider's own documentation, a court or government record, or reputable reporting. We checked all of it on November 1, 2026.
• We grade black.com v2 as it launched on November 2, 2026, not as it might look in a year. Plans don't count, ours included.
• We come out behind in three categories, and we tell you exactly where and why.

If you think we got something wrong, about anyone, tell us on X at @blackcom. The changelog at the end records every correction.

Who Can Read Your Emails

How we grade: A means only you, by default, for every email in your mailbox. B would mean only you, for every email, once you turn it on. C means the provider holds the keys or can unlock them.

Three providers on this list can't read the emails in your mailbox: Proton, Tuta and black.com. Each encrypts mail between its own users on the sender's device. Mail from everyone else arrives readable, because that's how SMTP works, and gets encrypted with your key the moment it lands. Proton describes the step plainly: inbound messages "are scanned for spam in memory, and then encrypted and written to disk." Tuta says they "are only encrypted once they reach our servers." We do the same.

Posteo and mailbox.org offer more protection if you ask for it, but neither fully locks itself out. Posteo's crypto mail storage encrypts everything you've saved with a key "protected by your personal password." It's off by default, and your password unlocks that key on Posteo's servers every time you sign in. mailbox.org can encrypt incoming mail with your own PGP key, but "Existing emails will remain unaffected," and your Sent folder stays unencrypted.

Gmail, Outlook, iCloud and Yahoo hold the keys. Microsoft even puts it as a feature: "Microsoft securely manages and stores the keys, so you don't have to." Apple is the most candid: "iCloud Mail does not use end-to-end encryption because of the need to interoperate with the global email system." That stays true even with Advanced Data Protection turned on.

What's Encrypted, and What Isn't

How we grade: A means subject lines, contacts, search and notifications are encrypted too, and only the unavoidable (addresses and dates) stays readable. B means the content is encrypted but some extras aren't. C means everything is readable to the provider.

Encrypting the body is fairly trivial. The interesting question is what's left around it. Security researcher Thomas Ptacek made the point in 2018: nobody would accept a secure messenger that exposed the envelope, let alone the subject line. In email, that's still common.

That's exactly where the criticism of Proton lands. In March 2026, the Freedom of the Press Foundation published "Proton Mail is not for anonymity". Its point: with Proton, "the subject line is not encrypted," so "what you're really doing is encrypting the body of the email." Proton agrees that "Subject lines in Proton Mail messages are not end-to-end encrypted," to stay compatible with the OpenPGP standard. Its privacy policy also lists attachment names among the metadata it can see, and contact names and addresses are "not secured using zero-access encryption."

Tuta goes furthest. It encrypts the subject, sender and recipient names, contacts, calendars, the search index and notifications: "The only data that is not encrypted in a Tuta email are the email addresses and the date of an email sent or received." It even replaced Google's push service with its own, so "no push notification data is shared with Google."

black.com encrypts the subject, the body and every attachment: end to end between black.com users, and with your key the moment mail from outside arrives. What we can still see is who writes to whom, when, how big each email is, your label names, your contacts' email addresses and your IP address when you connect. Encrypting label names is on our list. Until it ships, they count against us, and so do your contacts. Notifications pass through Apple and Google, but all they get is an ID and the placeholder "Message Encrypted." Your phone then decrypts the rest.

Posteo's crypto mail storage also encrypts headers, sender, recipient and subject at rest, but only if you turn it on, and Posteo's server unlocks it every time you sign in. That's how it works with any mail app.

Notifications are easy to forget. In 2023, Senator Ron Wyden revealed that governments had been requesting push notification records from Apple and Google. Those companies "might also receive unencrypted content," up to "the actual text displayed to a user." That is precisely why readable notifications are a threat to mailbox encryption.

What Happens When You Email a Gmail User?

How we grade: S would mean end-to-end encryption into the recipient's own inbox, by default. A would mean every email to an outside recipient is end-to-end encrypted by default, even if they have to open it in a browser. B means a real encrypted option for outside recipients. C means TLS between servers and nothing more. D means mail can leave without TLS.

Gmail can't open a Tuta or black.com ciphertext, so mail to Gmail leaves every provider over SMTP, protected only by TLS between the servers. Once it arrives, Google can read it.

The encrypted providers offer workarounds, and most of them send your contact a link instead of the email:

• Proton's password-protected emails open in the browser with a password you share some other way. Your contact can reply up to five times, and the message expires after at most 28 days.
• Tuta's version works the same way with a shared password, and replies come back end-to-end encrypted.
• Posteo turns the email into a password-protected PDF.
• mailbox.org opens a temporary mailbox that takes a link and a PIN.

If your contact already uses PGP, Proton looks up their key and encrypts for it automatically. Posteo and mailbox.org support PGP and S/MIME too. Tuta deliberately doesn't, arguing that "PGP algorithms can't be easily updated." We agree, and made the same call when we designed v2: black.com doesn't use PGP either, so we can switch algorithms whenever we need to.

We don't offer a password link. It's real encryption, but it's clumsy and not user friendly. Your contact reads your message on someone else's website, with a password you had to send separately, and it never reaches their own inbox. We doubt many people use it even twice. So black.com sends to Gmail the way Gmail itself sends to other providers: over TLS. Our servers can read the email for that one hop, and Google can read it once it arrives. That's a C. We'd rather be realistic and take the C than call a link end-to-end encryption.

One catch: if even one recipient isn't on black.com, CC included, the whole email goes out this way. Your black.com recipients then get the same zero-access encryption as mail from outside.

There's one more layer you never see: how strictly mail servers insist on encrypting the connection between them. Two standards, MTA-STS and DANE, let a domain say "only deliver to me over a verified, encrypted connection." Here's what we found when we checked on November 1, 2026:

• Gmail and Outlook.com have MTA-STS switched on and enforced.
• Yahoo has it in testing mode only.
• iCloud doesn't use it.
• Posteo has supported DANE since 2014 and won't send at all if it can't encrypt the connection.

We also refuse to send without TLS, but that's as far as we go for now. We don't check the receiving server's certificate, we don't use MTA-STS or DANE yet, and a server without TLS can still deliver mail to us unencrypted.

One more Gmail feature to clear up: confidential mode isn't encryption. Google notes that recipients "can still take screenshots or photos of your emails," and Google can still read them.

How Encryption Keys Are Made: Passwords vs. Passkeys

How we grade: A means there's no password to guess, or the password is protected by a memory-hard function. B means a password protected by a function that isn't memory-hard. C means the keys are the provider's, not yours.

End-to-end encryption has a practical problem: your private key has to be on every device you use. So most providers keep a copy of it on their servers, locked with your password. That makes your password the only thing standing between that copy and anyone who gets hold of it. If your password is easy to guess, so is your key.

And those copies don't always stay put. A breach, a rogue employee or a legal demand can put one in someone else's hands. From then on, they can try passwords on their own machines, as fast as their hardware allows, with no login page to lock them out after a few wrong guesses. That's what happened to LastPass users in 2022: attackers copied the encrypted vaults, and LastPass warned that they "may attempt to use brute force to guess your master password."

Brute force is simple arithmetic. With N possible characters, a password of length L and r guesses per second, trying every password takes:

The function that turns your password into a key sets r, and that's where providers differ:

• Proton uses bcrypt, with a cost factor of 10 in its own open-source code. That's the OWASP minimum. Scaling a published hashcat benchmark, we estimate about 5,750 guesses per second on one RTX 4090 graphics card: roughly 420 days to try every eight-letter lowercase password, and half an hour to work through a leaked list of 10 million common ones.
• Tuta switched to Argon2 in 2023 and had moved every account over by January 2024. Argon2 is memory-hard: every guess needs its own chunk of memory, which takes away most of a graphics card's advantage. Tuta doesn't publish its parameters.
• Posteo's crypto mail storage protects its key with bcrypt. mailbox.org's Guard uses a separate password and doesn't document how the key is derived.
• black.com has no password at all. Your keys come from your passkey through the WebAuthn PRF extension: a 32-byte secret your passkey computes, which never leaves your device. Guessing it means searching 2²⁵⁶ possibilities, and there's no encrypted key copy on our servers to steal in the first place.

Passkeys move the risk rather than erase it. Lose your passkey and you lose your keys. Identity standards expert Tim Cappalli has warned that using passkeys for encryption makes the "blast radius" of losing one "immeasurably larger." We take that seriously. It's why every black.com account comes with a 24-word recovery phrase, and why the account behind your passkey (Apple, Google or your password manager) deserves a strong lock of its own.

Within A, there's still a difference: Tuta makes guessing slow, while we leave nothing to guess.

Can You Verify Their Claims?

How we grade: A means open-source apps, published independent audits and a bug bounty. B means open code, published audits or a certification that covers the mailbox you use. A bug bounty alone doesn't count: it helps the provider find bugs, but it doesn't let you check anything. C means you have to take the provider's word for it.

Everything so far relies on what providers say about themselves. Open code, outside audits and paid bug hunting let you check.

Proton does this best. Its apps are open source, it maintains the OpenPGP.js library, it has published outside audits of its apps, and it pays up to $100,000 for serious bugs. Two caveats: its server code is closed, and the public audits date from 2019 to 2021.

Tuta publishes all its app code under the GPLv3 license, and researchers at the University of Wuppertal formally analyzed its post-quantum protocol in a 2026 paper. But the only outside penetration test it names dates back to its 2014 launch, and we found no bug bounty. Posteo had Cure53 audit its crypto mail storage in 2015 and its S/MIME add-on in 2026, and it keeps a public table of every vulnerability reported to it. mailbox.org holds ISO 27001 and the German BSI's C5 certification, which check processes not code.

Gmail, Outlook, iCloud and Yahoo are closed source. Google, Microsoft and Apple run large bug bounties, and Google and Microsoft certify their business products. For your personal mailbox, you're trusting their word.

The same is true of us, for now. Our code isn't open source yet, and it hasn't been independently audited. That puts black.com in C here, next to Gmail. Fixing that is our most urgent next step: we'll open up our entire codebase before the end of 2026. Until then, it doesn't count.

One criticism applies to every web app on this list. A web app downloads its encryption code from the provider's server every time you open it, so you're trusting that server each time. Cryptographer Nadim Kobeissi made that case in a 2018 analysis of Proton, and it applies to us just as much. Apps from an app store don't change between updates, which narrows that risk.

Breaches and Track Record

How we grade: A means no known breach, and vulnerabilities fixed fast and in public. B means a serious flaw that stayed open for weeks, a paid ransom or a small, targeted intrusion. D means attackers got into many mailboxes or took user data at scale.

Two of the biggest names have the worst records. Yahoo says "all accounts that existed at the time of the August 2013 theft were likely affected," which is about 3 billion. In a separate breach in 2014, hackers working with Russia's FSB stole data from at least 500 million accounts, according to the US Justice Department. The SEC later fined Yahoo $35 million for keeping it quiet.

Microsoft's worst incident came from a stolen key. In 2023, the Chinese group Storm-0558 used an old Microsoft signing key to forge logins and read mail in Outlook.com and Exchange Online. A US government review board counted "22 organizations and over 500 individuals" affected and found the intrusion "was preventable and should never have occurred." Months later, Russian hackers read the email of Microsoft's own senior leadership.

Google and Apple fare better. Google's best-known incident is Operation Aurora, an attack from China that Google disclosed in January 2010. It reached two Gmail accounts, though only their metadata and subject lines. We found no confirmed breach of Gmail since, and Google disputed the 2025 "Gmail breach" headlines. Apple traced the 2014 celebrity photo leak to "a very targeted attack on user names, passwords and security questions," not a breach of its systems.

We found no breach of user data at Proton, Tuta, Posteo or mailbox.org. They've had serious bugs, though:

• In 2022, researchers at SonarSource found a flaw in Proton Mail that "allowed attackers to steal decrypted emails and impersonate their victims, bypassing the end-to-end encryption." Proton deployed the fix about five weeks after the report.
• The same team found a flaw in Tuta that led to code execution in its desktop app. Tuta patched it two days after the report.
• During a 2015 DDoS attack, Proton paid the attackers' ransom and later called it "clearly a wrong decision." mailbox.org refused a similar demand in 2021.
• In September 2026, ETH Zurich researchers reported 29 attacks across four email encryption gateways, one of them Proton Mail Bridge. Their published proofs of concept include two against Bridge, and both require tampering with the traffic between Bridge and Proton's servers. The researchers disclosed the flaws to the vendors before publishing.

Tuta, Posteo and mailbox.org earn their A by how they handled problems. Posteo even publishes reported vulnerabilities, including a critical crypto flaw that Cure53 found on the day its crypto mail storage launched in 2015.

We've had no breaches or leaks since black.com launched, and we're proud of that. We're smaller than Proton, so we've also been a smaller target. We strongly intend to keep the record clean as we grow.

Ads and Email Scanning

How we grade: A means no ads and no scanning of your mail for anyone else's benefit. B means no ads, but some scanning. C means ads, but not based on what you write unless you opt in. D means your email content shapes the ads you see.

Ads aren't the same as surveillance. But they change who the customer is, and they give a company a reason to learn about your personal data.

Google promised in 2017 that "Consumer Gmail content will not be used or scanned for any ads personalization." Gmail's help page still says "We will not scan or read your Gmail messages to show you ads." But on October 16, 2026, Google's privacy policy gained an exception: no personalized ads based on Gmail content "unless you choose to make data from these services available to other Google services that support personalized ads."

In practice, that means connecting Gmail to Google's AI features in Search or Gemini. If you do, Google says ads "will not be based directly on your Gmail inbox," but "summaries, excerpts, generated media, and inferences" from your emails can be used to show you ads. Connecting is opt-in, and the Gemini feature that reads your Gmail, called Personal Intelligence, isn't available in the European Economic Area, Switzerland or the UK.

You may also have read that Gmail started training Gemini on your email in November 2025. That was misreported. Malwarebytes corrected its article, and Google said on X: "We do not use your Gmail content to train our Gemini AI model."

Yahoo goes furthest. Its privacy policy, updated March 2026, still describes "Analysis of email content to create advertising interest profiles to personalize the ads we show you." It covers emails from retailers and other organizations, "not personal emails between individuals," and you can opt out.

Free Outlook.com shows ads, and in some regions, if you opt in, Outlook "may also use the email you receive to identify the brands and businesses you prefer and shop with." Microsoft says it doesn't analyze emails "from your friends, family, or other individuals" for ads. Yet, its privacy statement adds: "we may use your data to develop and train our AI models." Apple shows no ads in Mail, but it has scanned iCloud Mail attachments for CSAM since 2019.

Proton, Tuta, Posteo, mailbox.org and black.com show no ads at all. Subscriptions pay the bills, and we've never had ads, not even before v2. Proton's AI writing assistant runs on your device by default and "does not use content data or any of your data to train its models."

Login Security: Passwords, 2FA and Passkeys

How we grade: A means phishing-resistant passkeys are the default way in. B means passwords backed by strong second factors, like security keys. C means passwords with app codes only. D means passwords alone.

This is the one category where the big providers beat most of the encrypted ones.

A passkey can't be phished, because it only works on the site it was made for. The WebAuthn standard scopes every operation "to a particular origin," so a look-alike site gets nothing it can use. More than one in three successful sign-ins now use a passkey, according to the FIDO Alliance.

Google made passkeys the default for personal accounts in 2023, and its Advanced Protection Program requires "security keys or passkeys." Microsoft made new accounts "passwordless by default" in 2025. Apple supports passkeys for web sign-in and hardware security keys. Yahoo offers passkeys to some accounts.

Proton and Tuta still start with a password. Both accept security keys as a second factor, but neither lets you sign in with a passkey instead. At Proton, a request for passkey sign-in has been "Under review" since January 2026. Posteo's two-factor codes work for webmail only, because turning them on "blocks access for email programs." mailbox.org offers one-time codes, and WebAuthn is "not yet supported", according to Privacy Guides.

black.com is passkey-only. There's no password to phish, leak or reuse. If you lose your passkey, your 24 words get you back in, old emails included. They're a backup of your keys written as ordinary words, the same idea as a crypto wallet's recovery phrase. We never see them, so write them down and keep them somewhere safe. Lose both your passkey and your 24 words, and nobody can bring back your old mail, not even us. That's the price of a mailbox only you can read. Soon after v2 launches, we're adding a second way back in: recovery through your phone number. It can't replace your passkey, so it gets you back into your account but not into your old emails, which stay locked to keys only your passkey or your 24 words can unlock. And because phone numbers can be hijacked, a recovered account can't send email for one to two weeks. That cooldown gives you time to notice if someone else got in, long before they could write as you. It isn't live yet, so it doesn't count in this ranking.

Which Encrypted Email Is Quantum Safe?

How we grade: A means post-quantum encryption by default for every account. B means it's available, but opt-in or partial. C means nothing for stored mail.

Let's start with the elephant in the room: a quantum computer that breaks today's public-key encryption doesn't exist yet. The threat is real anyway. Attackers can record encrypted mail now and decrypt it once the hardware arrives. NIST calls this the "harvest now, decrypt later" threat, and its October 2026 transition plan deprecates quantum-vulnerable algorithms after 2030 and disallows them after 2035. Email is the ideal target, because it sits in mailboxes for years.

Tuta moved first. It launched its post-quantum protocol, TutaCrypt, on March 11, 2024, on by default for new accounts. It pairs ML-KEM (Kyber-1024) with the classical X25519. Don't let the names scare you: that's nerd talk for two very complex algorithms, one new and built to withstand quantum computers, the other older and well tested. Since March 2026, "100% of Tuta users are protected." A peer-reviewed analysis of the protocol followed this year. One caveat: Tuta still keeps RSA for "old existing data, that is still encrypted with RSA and was not yet decrypted," so some older mail may not be covered yet.

Proton followed on May 5, 2026. It's available on every plan, but you have to manually turn it on. It covers only Proton Mail, and it "does not retroactively re-encrypt emails that are already in your mailbox, for now." Turning it on also pauses end-to-end encrypted forwarding. Proton co-authored RFC 9980, the new standard for post-quantum OpenPGP, so one can expect this to improve in the future.

black.com went post-quantum with v2 on November 2, 2026, for every account. We use ML-KEM-1024 and ML-DSA-87, from NIST's highest security category, and we use them on their own instead of pairing them with a classical algorithm the way Tuta and Proton do. We explain that choice in detail. The strongest case against it comes from cryptographer Daniel J. Bernstein, who argues that keeping the classical algorithm limits the damage if ML-KEM ever fails. JP Aumasson summed up the debate: hybrid is "what's getting deployed and recommended in most official guidelines," and "those who'll choose nonhybrid will have their reasons not necessarily unwise." Mail from before v2 moves too: every old email, draft and attachment gets its key re-wrapped with ML-KEM-1024. That happens once, on our servers, so they can read old mail while the move runs. Our encryption article describes it step by step.

Posteo says its servers support post-quantum key exchange for connections. That protects connections, not stored mail. mailbox.org, Gmail, Outlook, iCloud and Yahoo document no post-quantum protection for stored mail. Microsoft plans to complete its transition by 2033.

The Final Email Security Tier List

We didn't just average the grades. One question matters more than all the others: who can read your email? If the provider holds your keys, it stays at C, no matter how good its login is. To reach A, a provider also needs post-quantum encryption by default and code anyone can check. The other categories then decide whether a provider keeps its tier or drops one.

Tuta is the only provider that clears every bar for A, and it encrypts more of your mailbox than anyone else here. Its weak spot is login: you still start with a password.

Proton misses A on post-quantum protection, which is opt-in and only covers new mail. Its readable subject lines cost it in the metadata category, too. It's still the provider whose claims are easiest to check.

black.com misses A for one reason: you can't check our code yet. Our own rules say that means B, and we'd grade anyone else the same way. We're behind on mail to Gmail and on what stays visible around your email. We're at the top for login, key protection, post-quantum encryption and track record.

Posteo and mailbox.org have solid track records, and both offer extra encryption. Neither fully locks itself out, though: Posteo's server unlocks your key when you sign in, and mailbox.org's PGP option leaves older and sent mail readable. That keeps both in C.

Gmail, Outlook.com and iCloud Mail hold your keys, so C is as high as they go. Gmail and Outlook share the best logins on the list with us. Outlook keeps its C despite a D for its 2023 breach, because that attack was targeted, while Yahoo's likely hit every account it had.

Yahoo Mail is the only D, and the only provider with two Ds: every account was likely breached in 2013, and it still builds ad profiles from the email retailers send you.

Every grade, side by side:

Why None of Us Is S-Tier

S-tier is easy to describe: you write to anyone, on any provider, and the email is end-to-end encrypted without either of you lifting a finger. Nobody on this list can do that, us included. To see why, you have to go back to 1982.

That's the year RFC 821 defined SMTP, the protocol email still runs on. Think of it as a postal service: it carries envelopes from one server to the next and has no idea what a key is. End-to-end encryption needs two things SMTP never gave us: a way to look up your contact's public key, and software on their side that can use it. Between two different providers, neither is there by default.

People have tried to bolt this on since the 1990s. PGP and S/MIME let you encrypt for anyone, as long as both of you set them up. Almost nobody does, and it's hard to blame them: in 2015, even PGP's inventor, Phil Zimmermann, admitted he couldn't decrypt an encrypted message because he didn't "have a version of PGP that runs on any of my devices."

Many cryptographers have given up on it. Matthew Green wrote in 2014 that "It's time for PGP to die," because "Manual key management is a mug's game." Latacora was blunter in 2019: "Encrypting email is asking for a calamity." And in 2018, the EFAIL attacks showed how mail apps could be tricked into leaking the decrypted text of PGP and S/MIME emails.

The standards haven't solved it either. The IETF's 2025 guidance on encrypted email, RFC 9787, lists "interoperability and usability concerns" with "no current broadly accepted technical standard for resolution." And Web Key Directory, the closest thing PGP has to a phone book, is still an individual draft with "no formal standing" at the IETF.

So even the encrypted providers are islands. Proton speaks OpenPGP, Tuta deliberately doesn't, and we use our own post-quantum format. Write from Proton to Tuta, or from Tuta to us, and you get the same deal as writing to Gmail: TLS between the servers, or a password-protected link. Each of us built end-to-end encryption that stops at our own front door.

So S-tier isn't something one provider can ship alone. It takes two providers that agree on how to find each other's keys and how to encrypt for them. That's what we're working on. In our encryption article, we announced that we're building "a way for any two email providers to exchange end-to-end encrypted, signed, post-quantum mail." It doesn't need every mail server on Earth to switch, just two providers willing to speak the same language. We haven't published it yet, so it earns us nothing in this ranking. When we do, it gets graded like everything else.

End-to-end encryption needs two ends. For S-tier, they have to belong to different companies.

Which Email Provider Should You Choose?

There's no single winner, so here's what we'd tell a friend, depending on what they need.

• You want the strongest login and no password to lose: black.com. There's nothing to phish, leak or forget. Your keys come from your passkey, with 24 words as your backup. Post-quantum encryption is on for every account, your subject lines are encrypted, and we've never had a breach. The one thing we can't offer yet is proof you can check yourself, which is why we're opening our code before the end of 2026.
• You want end-to-end encryption you can verify today: Tuta or Proton. Pick Tuta if you want the most of your mailbox encrypted, and post-quantum protection without touching a setting. Pick Proton if you want open apps, published audits and a bug bounty.
• You use PGP or a desktop mail app: Proton, Posteo or mailbox.org. Proton finds your contacts' PGP keys automatically, and Proton Mail Bridge connects apps like Thunderbird or Apple Mail. Posteo and mailbox.org work with any mail app. Tuta "doesn't support the IMAP protocol or the use of third-party email clients," according to Privacy Guides.
• You need to stay anonymous: Posteo, Tuta or mailbox.org, not us. With Posteo, you "sign up without having to enter any personal information," and you can pay in cash by mail. Tuta asks for no phone number and allows sign-up over Tor. mailbox.org asks for a name but never checks it. black.com asks for a phone number when you sign up, which makes us the wrong tool here. Proton isn't built for this either, as the Freedom of the Press Foundation explains.
• You'd rather stay with a big provider: Gmail or Outlook.com. Their passkey logins are among the strongest on this list, and Google's Advanced Protection Program is built for people at high risk. The trade-off: Google and Microsoft still hold the keys to your mail.
• Your business needs certifications: mailbox.org. It holds ISO 27001 and the German BSI's C5 certification.
• You're on Yahoo Mail: move. The same goes for the mailbox your internet provider set up for you years ago.

Whatever you choose, two settings matter more than the logo. Sign in with a passkey or a security key wherever you can. And turn on the encryption your provider offers but leaves off: Proton's post-quantum protection, Posteo's crypto mail storage or mailbox.org's encrypted mailbox.

FAQ

Is Gmail Encrypted?

Yes, but Google holds the keys. Gmail encrypts your mail with TLS between servers and again on Google's servers, and Google can decrypt both. The only way to keep Google out is client-side encryption, which is limited to large business plans, and then the company's admins hold the keys.

Is Proton Mail End-to-End Encrypted?

Between Proton users, yes. Mail from other providers gets zero-access encryption the moment it arrives. Mail to other providers leaves over TLS, unless you send a password-protected email or your contact has a PGP key. Subject lines aren't end-to-end encrypted.

Is Tuta or Proton More Secure?

In our ranking, Tuta, by one tier. It encrypts subject lines, contacts and notifications, and it's post-quantum by default for every account. Proton is easier to verify, with published audits and a bug bounty, and it works with PGP and desktop mail apps.

What Is Zero-Access Encryption?

It's how encrypted providers handle mail from outside. The email arrives readable, because SMTP can't deliver it any other way, and the provider encrypts it with your public key right away. After that, only you can read it. It isn't end-to-end encryption, because the provider could read the email in the moment before it was encrypted.

Is iCloud Mail End-to-End Encrypted?

No. Apple says that "iCloud Mail does not use end-to-end encryption," and that stays true with Advanced Data Protection turned on.

Which Email Providers Are Quantum Safe?

Tuta, by default since March 2024. black.com, by default for every account since November 2, 2026. Proton, since May 2026, if you turn it on, and only for new mail. Nobody else on our list documents post-quantum protection for stored mail.

Does Google Use My Emails for Ads?

Not by default. Since October 16, 2026, if you connect Gmail to Google's AI features in Search or Gemini, Google can use "summaries, excerpts, generated media, and inferences" from your emails to show you ads. Gemini's Gmail feature isn't available in the European Economic Area, Switzerland or the UK.

Can I Send an Encrypted Email to Someone on Gmail?

Yes, with a workaround. Proton, Tuta, Posteo and mailbox.org can send a password-protected message that your contact opens in a browser, and PGP works if your contact sets it up. No provider encrypts end to end into a Gmail inbox by default. We don't offer the link at all, for reasons we explain in the section on emailing Gmail users.

Why Does black.com Rank Itself B?

Because our code isn't open source yet, and A requires code that others can check. We'd grade any other provider the same way. The rest of what A asks for, end-to-end encryption, zero-access encryption for outside mail and post-quantum protection by default, shipped with v2 on November 2, 2026.

How Did You Decide the Tiers?

We graded nine categories, each against criteria we wrote down before grading anyone. Who can read your email sets the ceiling for the final tier, and the other eight decide whether a provider keeps it. Every claim links to a source we checked on November 1, 2026.

Changelog

Providers change, and so will this ranking. Every update and correction gets logged here. If you spot something out of date, tell us on X at @blackcom.

• November 1, 2026: First version. black.com is graded as v2 launched on November 2, 2026.