For instance, ProtonMail uses some integrations with closed-source third-party services, including for captcha and push notifications while we’ve developed our own open-source alternative to reCAPTCHA and we’ve published our Android app on F-Droid, making it one of the few email apps available without any ties to Google services. Tutanota excels in this regard as it pays more attention to the details, particularly when it comes to privacy-first solutions.

People choose to create email addresses with these two services to get rid of Big Tech. Tutanota and ProtonMail both prioritize user security and privacy over profits, unlike older generation email services like Gmail and Outlook. Additionally, we’ve been working on a research project to replace the current algorithms with quantum secure ones and our post-quantum prototype is already able to support Perfect Forward Secrecy. Tutanota is the only email service that automatically does this. Instead of using an implementation of PGP itself, Tutanota uses standard algorithms also being used by PGP (AES 128 / RSA 2048) for encrypting not just emails, but also other information that ProtonMail does not encrypt such as the entire address book and calendar metadata like calendar notifications. Additionally, the encryption protocols used in Tutanota enable us to easily upgrade to new algorithms and add support for Prefect Forward Secrecy. Tutanota encrypts not just bodies and attachments of emails, but also the subject line, which can contain very sensitive information. ProtonMail uses PGP encryption, which lacks important requirements that Tutanota is able to fix.

In addition, there are quite important differences in the encryption methods used. One major differentiation here is that in Tutanota external recipients can access the entire email thread via the shared password while recipients of encrypted messages from Proton Mail are limited to just seeing one message. Both Proton Mail and Tutanota offer end-to-end encryption for all emails, and both enable users to use a password for encrypting emails sent to recipients that don’t have an address with an encrypted email provider.

Protonmail mobile