Tuta

Overview

Tuta (formerly Tutanota, rebranded in 2023) was founded in 2011, headquartered in Hanover, Germany, and is one of the earliest end-to-end encrypted email services in the world. Tuta's core philosophy is "privacy is a fundamental right"—all email and calendar content is encrypted on the user's device before being sent to the server, making it impossible for the provider to read any content. Tuta developed its proprietary TutaCrypt encryption protocol (based on AES-256 and RSA-2048 hybrid encryption) and fully open sourced all code—including web client, mobile apps, and server-side software. With over 10 million registered users, Tuta is one of the most popular privacy-focused email services in Europe, particularly strong in the German domestic market.

In privacy email comparisons, Tuta leads the secure email space with its end-to-end encryption, open source transparency, unique encrypted calendar, and generous free plan.

Key Strengths

• Proprietary TutaCrypt End-to-End Encryption: Rather than using standard PGP, Tuta developed the TutaCrypt hybrid encryption algorithm (AES-256 for email content, RSA-2048 for key exchange). All encryption occurs in the browser or mobile app—the server only stores ciphertext. Even if legally compelled, Tuta cannot read a single email's content.
• Fully Open Source: All Tuta code (web app, Android, iOS, desktop clients, server) is publicly available on GitHub. Anyone can audit the code for backdoors or vulnerabilities. This transparency is rare among email providers—most competitors (including ProtonMail) open source only their clients, keeping server code proprietary.
• Generous Free Plan, No Ads: The free plan includes 1GB storage, 1 user account, standard end-to-end encryption, and encrypted calendar. No credit card required for signup, zero ad tracking. For individual privacy users, the free plan is fully sufficient.
• Unique Encrypted Calendar: Tuta is the only mainstream email provider offering an end-to-end encrypted calendar. All event details, attendee information, and notes are encrypted client-side—invaluable for business users needing secure scheduling.
• Quantum-Safe Roadmap: Tuta has begun researching quantum-safe encryption transition plans, with a clear technical roadmap for addressing future quantum computing threats. This forward-looking approach surpasses competitors relying solely on standard RSA encryption.

Product Ecosystem

TutaCrypt Encrypted Email

Tuta's email system is built on the proprietary TutaCrypt protocol. Each email uses a unique AES-256 key for encryption, which is then encrypted with the recipient's RSA-2048 public key and transmitted alongside the email. The recipient decrypts the AES key using their private key, then uses the AES key to decrypt the email content. The entire process happens client-side—the server only handles ciphertext.

Encrypted Calendar

Tuta's calendar achieves the same level of end-to-end encryption as its email—creating, modifying, and viewing events all happen client-side decryption. The calendar supports recurring events, attendee invitations (internal Tuta users get automatic encryption, external users access via secure links), color coding, and multi-calendar management.

Tuta Desktop & Mobile Apps

Tuta provides Windows, macOS, Linux desktop clients and Android, iOS mobile apps. All clients use the same TutaCrypt encryption engine, with data synchronization over end-to-end encrypted channels. Desktop clients support offline mode—viewing synced emails even without network connectivity.

Secure Link Sharing

Tuta supports secure sharing with non-Tuta users via Secure Links. The sender sets a password and expiration date, generating a link that the recipient opens in a browser to view encrypted content—no Tuta account required.

Limitations

• No PGP Interoperability: Tuta uses its proprietary TutaCrypt protocol instead of standard PGP, making end-to-end encrypted communication with non-Tuta users impossible. When communicating externally, email automatically falls back to TLS transport encryption. For PGP support, ProtonMail offers PGP external interoperability.
• Encrypted Emails Not Searchable: Without decryption keys on the server, Tuta's search only covers email subjects and sender addresses—not email body content. For high-volume email users, this is a significant friction point.
• Limited Third-Party Client Support: Tuta does not offer standard IMAP/SMTP access (encryption requires client-side decryption), making it incompatible with Outlook, Thunderbird, Apple Mail, and other third-party clients. Users must use Tuta's official clients or webmail.
• Custom Domain Requires Payment: Free users cannot use custom domains. Paid plans start at €3/month for custom domain support. For users wanting their own domain on a budget, Mailbox.org at €1/month is more affordable.

Use Cases

• Maximum Privacy Protection (★★★★★): Content is completely hidden, on par with Signal and ProtonMail's privacy philosophy. Ideal for journalists, activists, lawyers, and anyone requiring absolute email confidentiality.
• Personal Privacy Beginners (★★★★★): Free plan requires no credit card—the best zero-cost way to experience end-to-end encrypted email.
• Business Users Needing Encrypted Calendar (★★★★☆): Tuta is the only mainstream provider with an end-to-end encrypted calendar. Ideal for secure scheduling.
• Users Dependent on Third-Party Email Clients (★☆☆☆☆): No IMAP/SMTP support means you cannot use familiar clients. Consider Mailbox.org or ProtonMail for client compatibility.

Pricing

Note: Annual billing gives 2 months discount. Business plan includes priority support and SLA.

FAQ

• Tuta vs ProtonMail: which is more secure? Both offer end-to-end encryption. ProtonMail's advantages are Swiss privacy law and PGP external interoperability. Tuta's advantages are fully open source (including server) and encrypted calendar. Security levels are comparable. See privacy email comparison for details.

• Is Tuta's free plan sufficient? 1GB storage, standard encryption, and encrypted calendar are sufficient for daily personal use. For more storage, custom domains, or multiple aliases, upgrade to Premium (€3/month). See Email Service Provider Comparison.

• Why is Tuta's search limited? Email content is end-to-end encrypted—the server has no decryption keys and cannot index email bodies. Tuta only builds local search indexes for subjects and sender addresses. See Email Service Provider Comparison.

• What clients does Tuta support? Tuta offers webmail, Windows desktop, macOS desktop, Linux desktop, Android app, and iOS app. No IMAP/SMTP support—third-party email clients cannot be used. See SMTP Configuration Guide.

• How to migrate from Tuta? Emails can be individually downloaded as .eml files via webmail, but end-to-end encrypted emails must be decrypted in Tuta's client before export. For batch migration, use Tuta's "Export" function. See Business Email Service Guide.