Tuta

Free and open source email service based in Germany. It has a basic intuitive UI, secure native mobile apps and desktop email clients, anonymous signup, and an encrypted calendar. Tuta has a full-featured free plan and premium subscription plans allowing for custom domains (starting at $3/month). Tuta does not use OpenPGP like other encrypted mail providers, instead they use a standardized, hybrid method consisting of symmetrical and asymmetrical algorithms (with AES256, and RSA 2048 or ECC (x25519) and Kyber-1024). This causes compatibility issues when communicating with contacts using PGP. But it does allow them to encrypt much more of the header data (body, attachments, subject lines, and sender names etc) which PGP mail providers cannot do. The recent upgrades to Tuta's encryption algorithm makes data stored and sent with their service safe against attacks posed by quantum computers.

Open Source

Tuta Privacy Policy

Privacy Policy Summary

  • The service claims to be GDPR compliant for European users
  • Your personal data is not sold
  • There is a date of the last update of the agreements
  • This service claims User-generated content is encrypted, and they can not decrypt it
  • The terms for this service are translated into different languages (English, German)
  • You will be notified if personal data has been affected by data breaches

Score

A

Documents

About the Data

This data is kindly provided by tosdr.org. Read full report at: #157

Tuta Source Code

Author

tutao

Description

Tuta is an email service with a strong focus on security and privacy that lets you encrypt emails, contacts and calendar entries on all your devices.

#email#encryption#javascript#mithril#privacy#security#tutanota

Homepage

https://tuta.com

Repository

  • LicenseGPL-3.0
  • Created28 Jul 14
  • Primary languageTypeScript
  • Size291,058 KB
  • Stars7,985
  • Forks641
  • Watchers7,985

Language Usage

Language Usage

Project Health

Recent Commits

  • Kinan(06 Oct 26)

    [nextcloud] v1.2.3612610060

  • jenkins build server(06 Oct 26)

    v361.261006.0

  • jenkins build server(06 Oct 26)

    update translations

  • hrb-hub(02 Oct 26)

    Add delay before expanding mailSet on dragenter Close #11329

  • hnb(30 Sept 26)

    Edit labels and their colours without changing name Close #11575

  • hnb(30 Sept 26)

    Do not update mail's ReplyType before reply is actually sent Close #11545

  • hrb-hub(30 Sept 26)

    Fix Logged errors retrieved as ? when getting logs When retrieving logged error entries, we do an Object.assign: `Object.assign({ stack: null }, error)` to handle cases where `stack` is `undefined`. But because Error objects are not enumerable, the resulting object ends up being `{ stack: null }`. This improved logging would also help debug Undici `fetch failed` errors Close #11582

  • paw(15 Sept 26)

    [desktop] Update sqlcipher Fixes an issue with >4 GB archives failing integrity checks.

  • bir(21 Sept 26)

    Fix enabling mailIndexing from one/two column layout in webView Close #11499

  • bir(18 Sept 26)

    Defer loading ConfigurationDatabase until fully logged in We can't load it without the group key, and that isn't available until full login. As such, we'll need to keep the client in a sane (albeit slightly restricted) default state without ConfigurationDatabase. But once fully logged in, the client should be able to use it as normal. Close #11474 Co-authored-by: paw <[email protected]>

  • paw(18 Sept 26)

    Unset will-change when animations finish Some browsers, like Safari, will optimize rendering when will-change is set, and the way they do it can result in weird side effects. I suspect that one side effect is that dialogs are now is being rendered to a single texture (that is the size of the dialog), and all of its children, even position: fixed elements like the date picker, are being rendered to this texture, which means that if they extend outside the dialog, they get cut off. Closes #11513 Co-authored-by: bir <[email protected]>

  • paw(22 Sept 26)

    [ios] Fix iOS crash when logging out Apparently a request can be cancelled while failing for some other reason (such as when logging out briefly after logging in). Closes #11540 Co-authored-by: bir <[email protected]>

  • hnb(07 Sept 26)

    [android] Go back to search result list when using back button on result Close #11458 This adds the getViewSlider method to the search views. It is defined in the TopLevelView interface, which all of them implement. It is only used in handleBackPress of the WebMobileFacade, which is called by the mobile apps when one goes back using the OS's own controls (instead of our icon or the browser's function, which have separate handlers somewhere else).

  • paw(09 Sept 26)

    Fix progress bar indicator for OfflineMailIndexer Fix the progress bar indicator not having much meaning in the OfflineMailIndexer. This commit also ensures we download complete archives only once. Fixes #11492

  • tutao-mac(09 Sept 26)

    [ios] Fix sharing files to create draft Close #11317 Co-authored-by: hnb <[email protected]> Co-authored-by: bir <[email protected]> Was broken since eff866c1acb03c88275a067407fa2078891546af.

  • paw(21 Aug 26)

    Add mail bodies to cache once retrieved We want to make sure that mail bodies are put in the cache iff we had had to download them. Closes #11422

  • hnb(07 Sept 26)

    Do not reset contact search bar focus on input Close #11451

  • paw(28 Aug 26)

    Add ArchiveEnumerationService and use it Add a service that allows the user to query MailDetailsBlob archives directly from the server, and use this to allow the user to get all archives upfront. Closes #11417 Co-authored-by: hnb-hub <[email protected]>

  • Sudip G.(06 Oct 26)

    fix expanded AttachmentBubble padding Co-authored-by: Kinan <[email protected]> Co-authored-by: jhm <[email protected]>

  • Kinan(05 Oct 26)

    [doc] fix typos

  • Kinan(05 Oct 26)

    [build] allow settings to import from plugin-manager

  • Kinan(05 Oct 26)

    [build] exclude plugins from tsconfig-dist-rollup.json

  • Kinan(05 Oct 26)

    [nextcloud] improve theme switching - account for Nextcloud following the browser's theme - account for other nextcloud dark theme (like with high contrast) fixes #11590

  • Sudip G.(05 Oct 26)

    Allow attaching keydown listener to shadowRoot in KeyManager When inside nextcloud, this allows us to attach eventListener to the shadowRoot, which will not be fired when user interact with nextcloud ui outside tuta shadowDOM Fixes: https://github.com/tutao/tutanota/issues/11596 Co-authored-by: FranzTutao <[email protected]>

  • Kinan(05 Oct 26)

    fix plugin tests

  • FranzTutao(05 Oct 26)

    [Test] use o.test and o.check instead of "o" Co-authored-by: Sudip G. <[email protected]>

  • Kinan(02 Oct 26)

    [plugin-kit] fix opening external links on iOS

  • Kinan(02 Oct 26)

    [ios] fake allowed asset://app origin for intercepted requests on ios Co-authored-by: Sudip G. <[email protected]>

  • Kinan(02 Oct 26)

    [plugin-kit] return empty string if config field is missing Co-authored-by: Sudip G. <[email protected]>

  • Kinan(02 Oct 26)

    [plugin-kit] pass Env to plugin workers when loading Co-authored-by: Sudip G. <[email protected]>

Tuta Security

5.5/10

Repo Security Summary

Updated 24 Aug 26

  • Code-Review0/10
  • Maintained10/10
  • PackagingN/A
  • Dangerous-Workflow10/10
  • CII-Best-Practices0/10
  • Security-Policy10/10
  • Token-Permissions7/10
  • License10/10
  • Branch-ProtectionN/A
  • Binary-Artifacts8/10
  • Signed-Releases0/10
  • SAST0/10
  • Pinned-Dependencies7/10
  • Fuzzing0/10

Security Advisories (6)

  • highPatched

    GHSA-mgq4-4gm5-rcw9Signing oracle for 2FA challenges in the Tuta Web app

  • highPatched

    GHSA-24v3-254g-jv85DOM attribute and CSS injection in contact viewer

  • mediumPatched

    GHSA-jj2j-5x96-gf8hRelative resource URLs in email body could cause a crash in iOS app

  • lowPatched

    CVE-2024-23330Images are loaded from external resources

  • highPatchedCVSS 7.5

    CVE-2024-23655Attacker can prevent users from accessing received emails

  • criticalPatchedCVSS 9.3

    CVE-2023-46116Remote Code Execution via insufficiently sanitized call to shell.openExternal

Tuta Website

Website

Tuta: Turn ON privacy for free with secure emails, calendars & contacts | Tuta

Tuta guarantees your data stays private for free & without ads. Quantum-resistant encryption makes Tuta the best secure technology solution to protect your privacy.

Redirects

Does not redirect

Security Checks

All 65 security checks passed

Server Details

  • IP Address185.205.69.12
  • LocationHanover,Niedersachsen,Germany,EU
  • ISPTutao GmbH
  • ASNAS210909

Associated Countries

  • USUS
  • DEDE

Safety Score

Website marked as safe

100%

Trackers

No known trackers found

Blacklist Check

tuta.com was found on 0 blacklists

  • AntiSocial Blacklist
  • Artists Against 419
  • Badbitcoin
  • Bambenek Consulting
  • CERT Polska
  • CoinBlockerLists
  • CRDF
  • CryptoScamDB
  • EtherAddressLookup
  • EtherScamDB
  • Fake Website Buster
  • MetaMask EthPhishing
  • NABP Not Recommended Sites
  • OpenPhish
  • PetScams
  • PhishFeed
  • PhishFort
  • Phishing.Database
  • PhishStats
  • PhishTank
  • Phishunt
  • RPiList Not Serious
  • Scam.Directory
  • SecureReload Phishing List
  • Spam404
  • StopGunScams
  • Suspicious Hosting IP
  • ThreatFox
  • ThreatLog
  • TweetFeed
  • URLhaus
  • ViriBack C2 Tracker

Website Preview

Website preview

Tuta Android App

APK Info

De-Googled Compatibility

Native3.97/ 462 ratings
microG4.00/ 426 ratings
  • GrapheneOSNative4.0 / 4(50)
  • CalyxOSmicroG4.0 / 4(15)
  • LineageOSmicroG4.0 / 4(7)
  • LineageOSNative4.0 / 4(3)
  • crDroidNative4.0 / 4(3)
  • e OSmicroG4.0 / 4(2)

Tested on Android 11–17 · Updated 09 Oct 26 · View on Plexus →

Trackers

No trackers found

    Permissions

    • Access Network State
    • Authenticate Accounts
    • Foreground Service
    • Get Accounts
    • Internet
    • Manage Accounts
    • Post Notifications
    • Read Contacts
    • Receive Boot Completed
    • Request Ignore Battery Optimizations
    • Schedule Exact Alarm
    • Use Biometric
    • Use Credentials
    • Use Exact Alarm
    • Use Fingerprint
    • Vibrate
    • Write Contacts
    • Write External Storage

    Tuta iOS App

    App Info

    Tuta Mail: Secure Email

    PROTECT YOUR PRIVACY WITH TUTA MAIL – FREE, SECURE & ENCRYPTED EMAIL Take control of your email with Tuta Mail, the world’s most secure email service, trusted by over 10 million users. With end-to-end encryption, your emails and contacts stay private. Fast, open source, and free: Tuta Mail is built with the highest security standards. WHY CHOOSE TUTA MAIL? Stay Secure • Quantum-Safe Encryption: Your entire mailbox and contacts are fully end-to-end encrypted – only you can access them. • Zero Tracking: We never track or profile you. Your data is yours. • Anonymous Registration: Sign up without providing a phone number or personal details – for free or pay anonymously with cash or cryptocurrency. • Open Source: Our code is publicly available for independent security review. Boost Your Productivity • Free Secure Email: Get a free email address with @tutamail.com, @tutanota.com, @tutanota.de, @tuta.io, or @keemail.me and 1 GB of free storage. • Exclusive Domain: Upgrade to a paid plan to create a short @tuta.com email address. • Auto-Sync: Your emails and contacts sync seamlessly across the app, web, and desktop clients. • Offline Access: Read and manage your encrypted emails even without an internet connection. • Contacts App: Sync your Tuta contacts to your phone. Simple & Intuitive • User-Friendly Interface: Clean, modern design with light and dark mode. • Quick Swipe Gestures: Easily organize emails with swipe-to-archive or swipe-to-trash. • Full-Text Search: Securely search your encrypted emails. • Smart Notifications: Delete or move emails directly from notifications to save time. BONUS: FREE ENCRYPTED CALENDAR APP Your Tuta Mail account includes a free encrypted calendar, giving you the same privacy for scheduling and event management. Stay organized while keeping your data safe. WHO IS BEHIND TUTA MAIL? Freedom fighters committed to protecting freedom of speech and your right to privacy! • Developed & Hosted in Germany: Adheres to strict GDPR data protection laws. • Private by Design: We can’t access your data – secure password reset ensures your privacy. • Secure Transmission: Industry-leading security with TLS, PFS, DMARC, DKIM, DNSSEC, and DANE for safe email delivery. TRUSTED BY SECURITY EXPERTS "Tuta provides an exceptional level of security and privacy... If security is your priority, there’s not much better than Tuta." — TechRadar "Since Tuta is open source and has amazing products in development, I moved my email there." — Journalist Dan Arel "Tuta’s email security is unmatched. Its mobile apps are fast and user-friendly, with fair pricing and a free option." — CyberSynchs JOIN MILLIONS WHO TRUST TUTA MAIL Keep Your Email Private: Download Tuta Mail today and join millions who trust us for secure, encrypted communication. Website: https://tuta.com Open Source Code: https://github.com/tutao/tutanota Terms of Use: https://www.apple.com/legal/internet-services/itunes/dev/stdeula

    Rating

    Rated 4.72 out of 5 stars by 3,483 users

    Version Info

    • Current Version355.260720.0
    • Last Updated23 Jul 26
    • First Released30 Nov 14
    • Minimum iOS Version16.0
    • Device Models Supported127

    App Details

    • IPA Size81.44 Mb
    • PriceFree (USD)
    • Age Advisory4+
    • Supported Languages59
    • DeveloperTutao GmbH
    • Bundle IDde.tutao.tutanota

    Screenshots

    • App screenshot
    • App screenshot
    • App screenshot
    • App screenshot
    • App screenshot
    • App screenshot
    • App screenshot
    • App screenshot

    Tuta Reviews

    More Encrypted Email

    • A Berlin-based, eco-friendly secure mail provider. There is no free plan, the standard service costs €12/year. You can use your own domain, with the option of a catch-all alias. They provide good account security and email encryption, with OpenPGP, as well as encrypted storage. There is no dedicated app, but it works well with any standard mail client with SSL. There's also currently no anonymous payment option.

    • Mailfence supports OpenPGP so that you can manually exchange encryption keys independently from the Mailfence servers, putting you in full control. Mailfence has a simple UI, similar to that of Outlook, and it comes with bundled with calendar, address book, and files. All mail settings are highly customizable, yet still clear and easy to use. Sign up is not anonymous, since your name, and prior email address is required. There is a fully-featured free plan, or you can pay for premium, and use a custom domain ($2.50/ month, or $7.50/ month for 5 domains), where Bitcoin, LiteCoin or credit card is accepted.

      Not Open Source
    • An end-to-end encrypted anonymous email service. ProtonMail has a modern easy-to-use and customizable UI, as well as fast, secure native mobile apps. ProtonMail has all the features that you'd expect from a modern email service and is based on simplicity without sacrificing security. It has a free plan or a premium option for using custom domains (starting at $5/month). ProtonMail requires no personally identifiable information for signup, they have a .onion server, for access via Tor, and they accept anonymous payment: BTC and cash (as well as the normal credit card and PayPal).

    About the Data: Tuta

    Change History

    • Amended (description) by @Lissy93 #387
    • Amended (description, openSource) by @brnsuh #262
    • Amended (androidApp, iosApp, subreddit)
    • Renamed previously: Tutanota from Communication › Encrypted Email by @thezacharytaylor #213

    Edit Tuta Data

    You can edit Tuta's entry in this section of awesome-privacy.yml by submitting a PR to our GitHub repo.
    Note that some of the information shown above has been aggregated from external sources, a list of these can be found data documentation.

    Origin Data

    Modify Data

    API

    You can access Tuta's data programmatically via our API. Simply make a GET request to:

    https://api.awesome-privacy.xyz/v1/services/tuta

    The REST API is free, no-auth and CORS-enabled. To learn more, view the API Docs or read the API Usage Guide.

    Share Tuta

    Help your friends compare Encrypted Email, and pick privacy-respecting software and services.
    Share Tuta and Awesome Privacy with your network!