Encrypted email providers, alias services and disposable inboxes, and what email encryption can and cannot hide.
Last reviewed · 13 entries
Your email address is the key to most of your other accounts and one of the easiest ways to link them together. It turns up in data breaches, data-broker files and password resets, and a mainstream provider can read everything stored in your mailbox and tie it to your phone number and other services.
Email was never designed to be private. A good provider can protect what sits on its servers, and an alias service can stop one address from following you everywhere, but neither can hide who you write to and when. For conversations that must stay private, use an end-to-end encrypted messenger instead (see the Messaging guide).
This guide covers long-term providers, alias services that keep your real address out of sign-up forms, and disposable inboxes, followed by the habits that matter more than which provider you pick.
Every message carries an envelope that mail servers must read to deliver it: sender and recipient addresses, the date, and a chain of Received headers recording each server it passed through. Encryption can protect the body and attachments, but the envelope stays readable to every provider along the way. "Encrypted email" can mean several different things:
Protection
What it covers
Who can still read the content
Transport encryption (TLS)
The connections between your device and your provider, and between mail servers
Both providers, in full
Zero-access storage
Mail stored on the provider’s servers, encrypted so that staff cannot read it later
Mail from outside senders arrives in plain text and is encrypted only after the provider has received it
Provider-internal end-to-end
Mail between two users of the same service, such as Proton to Proton or Tuta to Tuta
Only sender and recipient; the envelope stays visible, and at Proton so does the subject line
OpenPGP or S/MIME
Body and attachments between any two people who have exchanged keys
Only sender and recipient; in standard OpenPGP mail the subject line is not encrypted
What each layer of email encryption protects
Privacy is not anonymity
An encrypted provider protects the contents of your mailbox. It does not stop the account from being tied to you. Every provider must obey the courts where it is based and hand over what it holds: recovery addresses, payment records, and IP addresses logged once an order arrives. After one such case, Proton described its own service as offering "privacy by default and not anonymity by default". The cases below show what providers have handed over, and what would have limited the damage.
Year
Provider
What was handed over
Lesson
2016
Riseup
Complied with two sealed FBI warrants for accounts used in extortion schemes (Riseup statement)
Even collectives that keep almost no logs must obey local courts
2021
Proton Mail
IP address and device details of a French activist, logged after a Swiss order (TechCrunch)
Connect through Tor or a VPN when your IP address matters
2024
Proton Mail
The recovery address of an account (an iCloud address), which Apple then linked to a name (TechCrunch)
Never use a personal address or phone number for recovery
2025–26
Tuta
Real-time copies of unencrypted mail and traffic data under German court orders (transparency report)
Only mail sent end-to-end encrypted stays out of reach
2026
Proton Mail
Payment data, passed via Swiss authorities to the FBI, which used it to identify the alleged account holder (404 Media)
Full mailboxes you can keep for years. None of them makes email anonymous by itself: how you sign up, pay and connect matters as much as the provider. German providers (Tuta, mailbox.org, Posteo) can be ordered by German courts to intercept unencrypted mail, and Proton must comply with Swiss orders, including requests that foreign police route through Swiss authorities.
German provider, formerly called Tutanota, that encrypts mailboxes, subject lines, contacts and calendars end-to-end with its own protocol, which now includes post-quantum cryptography.
Berlin provider that asks for no personal data, keeps payments separate from mailboxes and charges a flat €1 per month. Standard IMAP with optional encrypted storage.
Platform Support
WebNo phone number
Advantages
+No personal data at sign-up; says it does not collect IP addresses
+Cash by post; payment records kept apart from mailboxes
+Optional encryption of stored mail, contacts and calendars
+PGP in webmail; works with any IMAP or POP3 client
+Flat €1 per month
+Released no user or traffic data in 2025, per its transparency report
Drawbacks
-No free plan; at least €12 must be prepaid
-No cryptocurrency payments
-Not end-to-end encrypted by default
-Carried out two German court-ordered mailbox interceptions in 2025
Seattle-based collective, active since 1999, that provides email and other services to activists. Keeps almost no logs, but new accounts need an invite code from an existing user.
Platform Support
WebOnion serviceNo phone number
Advantages
+Retains no IP addresses for any service
+Personally encrypted mailbox storage for accounts created since 2017
+Onion services for email
+Free and donation-funded; no payment or phone number needed
Drawbacks
-Invite code from an existing user required
-US jurisdiction
-Complied with two sealed FBI warrants in 2016
-Storage encryption is not end-to-end: the server handles plain text while you are logged in
-Meant for activists and social movements, not general use
Swiss provider with end-to-end encryption between Proton users and zero-access encryption for stored mail. It holds identifying data that it has handed over under Swiss legal orders.
March 2026: court records showed that payment data Proton supplied to Swiss authorities helped the FBI identify an account holder. Proton has also moved part of its infrastructure to Germany and Norway, citing proposed Swiss surveillance rules.
Free mail host, running since 2013, that never asks for personal information and is reachable over Tor. It offers no encryption beyond transport and suffered a large data leak in 2025.
June 2025: database tables from its old webmail, covering about 1,023,800 accounts (addresses, login times, settings and some contacts), were offered for sale. cock.li says passwords and mail were not included; it had removed that webmail the day before confirming the leak.
Advantages
+Never asks for personal information
+Onion services for the website, IMAP, POP and webmail
+Standard IMAP/POP, so you can use PGP in your own mail client
+Free; donations accepted in cryptocurrency
Drawbacks
-No end-to-end or zero-access encryption; the operators say you simply have to trust them
-By its own account, the 2025 leak likely came from an old webmail vulnerability
-Old webmail removed in 2025; its replacement launched as an early alpha in January 2026
-Operators and server locations are not stated on its website
-Several of its address domains contain slurs or obscenities
An alias service gives you a separate address for every site, all forwarding to your real inbox. If one address leaks or fills with spam, you switch it off. Because no two sites see the same address, breached databases and data brokers cannot use it to link your accounts together.
The trade-off: the alias service sees every forwarded message and knows which real address sits behind each alias. A legal order to it can undo the separation, so pick one you would trust as much as your mail provider, and pay for it the same way you pay for your mailbox.
Open-source alias service run by an independent UK developer, previously known as AnonAddy. Even the free plan gives unlimited aliases on your own username.
Platform Support
AndroidiOSWebBrowser extensionOpen sourceSelf-hostableNo phone number
Advantages
+Open source (AGPL) and self-hostable
+Free: unlimited username aliases plus 10 random aliases
+Optional PGP encryption of forwarded mail
+Stores mail only when delivery fails
+Paid plans from $1 per month (billed yearly) add replies, custom domains and tracking-pixel blocking
+Audited by Securitum in 2023
Drawbacks
-Run by a single developer
-Free plan: no replies and 10 MB of forwarded mail per month
Disposable inboxes need no account and expire on their own. They are fine for a one-off download or a forum you will never revisit, and for nothing else: the inbox is usually open to anyone who types the same address, and once it expires you cannot receive a password reset. Many sites also reject well-known disposable domains.
Separate your identities. Use one mailbox for banks and government, another for everyday accounts, and an alias for each site. Keep pseudonymous identities completely apart from your real one; see the alting guide.
Sign up cleanly. Create anonymous accounts over Tor or a VPN (VPN guide), skip the recovery email and phone number, and store the recovery code offline instead.
Pay without your name. Proton, mailbox.org and Posteo accept cash by post; Tuta and SimpleLogin vouchers can be bought with cryptocurrency, including Monero, through ProxyStore. See the crypto guide, and check the rules on cash and cryptocurrency where you live.
Block remote images. Tracking pixels report when, where and on what device you opened a message. Turn off automatic image loading in your mail app; DuckDuckGo and paid addy.io plans also strip trackers.
Keep subject lines generic. They are not end-to-end encrypted at Proton or in standard PGP mail.
Protect the mailbox itself. It can reset most of your other passwords. Give it a unique password and app-based or hardware two-factor authentication; see the Password guide.
Plan for your provider disappearing. Skiff, an encrypted mail service, was wound down after Notion bought it in 2024, and in October 2026 users of the provider Disroot were cut off from their mailboxes after a storage server failed. Back up mail you need, and consider a custom domain so you can move without changing addresses (the domain registration itself may be tied to your identity).
Use PGP carefully. One unencrypted reply quotes the whole thread in plain text, and a key you have not verified may not belong to your contact. See the Encryption guide.