Tuta

Free and open source email service based in Germany. It has a basic intuitive UI, secure native mobile apps and desktop email clients, anonymous signup, and an encrypted calendar. Tuta has a full-featured free plan and premium subscription plans allowing for custom domains (starting at $3/month). Tuta does not use OpenPGP like other encrypted mail providers, instead they use a standardized, hybrid method consisting of symmetrical and asymmetrical algorithms (with AES256, and RSA 2048 or ECC (x25519) and Kyber-1024). This causes compatibility issues when communicating with contacts using PGP. But it does allow them to encrypt much more of the header data (body, attachments, subject lines, and sender names etc) which PGP mail providers cannot do. The recent upgrades to Tuta's encryption algorithm makes data stored and sent with their service safe against attacks posed by quantum computers.

Open Source

Tuta Privacy Policy

Privacy Policy Summary

  • This service does not track you
  • Service does not allow alternative accounts
  • This service does not sell your personal data
  • The service does not share user information with third parties
  • There is a date of the last update of the agreements
  • Provides information on security practices
  • You can request access and deletion of personal data
  • User-generated content is encrypted, and this service cannot decrypt it
  • Accessibility to this service is guaranteed at 99% or more
  • Archives of their agreements are provided so that changes can be viewed over time
  • You will be notified about website maintenance
  • You are prohibited from sending chain letters, junk mail, spam or any unsolicited messages
  • The service claims to be GDPR compliant for European users
  • The service is open-source
  • You authorise the service to charge a credit card supplied on re-occurring basis
  • The data retention period is kept to the minimum necessary for fulfilling its purposes
  • Features of the website are made available under a free software license
  • You can retrieve an archive of your data
  • The court of law governing the terms is in Hanover, Germany
  • The court of law governing the terms is in a jurisdiction that is friendlier to user privacy protection.
  • IP addresses of website visitors are not tracked
  • The terms for this service are translated into different languages
  • You can access most of the pages on the service's website without revealing any personal information

Score

A

Documents

Domains Covered by Policy

  • tutanota.com
  • tuta.com

About the Data

This data is kindly provided by tosdr.org. Read full report at: #157

Tuta Source Code

Author

tutao

Description

Tuta is an email service with a strong focus on security and privacy that lets you encrypt emails, contacts and calendar entries on all your devices.

#email#encryption#javascript#mithril#privacy#security#tutanota

Homepage

https://tuta.com

Repository

  • LicenseGPL-3.0
  • Created28 Jul 14
  • Primary languageTypeScript
  • Size283,906 KB
  • Stars7,873
  • Forks636
  • Watchers7,873

Language Usage

Language Usage

Project Health

Recent Commits

  • jas(24 Aug 26)

    Remove console.time

  • jenkins build server(24 Aug 26)

    v357.260824.0

  • jenkins build server(24 Aug 26)

    update translations

  • osb(21 Aug 26)

    Add "date" chunk as dependency of "mail-editor" chunk The "date" chunk was already a transitive dependency of the "mail-editor" chunk -- "mail-editor" depended on "date-gui" depended on "date" -- so I don't think this functionally changes anything. This change was necessary because we needed to import the Time class in MailEditor.ts.

  • jas(21 Aug 26)

    Fix event time editor input values being out of sync with model values - we only accept updates from the model, in a text input, when the DOM input is blurred, to avoid the model value overwriting the inputted value - now toggling all-day on and off correctly restores the values from the model in the DOM inputs Co-authored-by: osb <[email protected]>

  • osb(21 Aug 26)

    when unfocusing the time picker, rewrite its value in the correct format

  • osb(21 Aug 26)

    Fix hasValidStartBeforeEnd being queried after setting the new start In the CalendarEventWhenModel, setting the new start first before querying whether the model was valid, resulted in the logic incorrectly assuming the model was invalid, when it actually wasn't. This meant that the end time was not updated correctly to keep the event duration constant because we do not preserve the duration when the event times are invalid to allow the user to recover from the invalid state. We also added a test for this case to avoid regression.

  • osb(20 Aug 26)

    Fix toggling all-day on making event times invalid by removing time zones When you toggled all-day off in the event editor, time zones where removed but the hour and minute values where kept in the view model, so they could be restored when toggling all-day back on. This meant that for certain time zones, toggling all-day off could set the start time after the end time, because the time zone was removed, resulting in an invalid view model, resulting in an error popup when trying to save the event. To fix this we now store hour, minute and time zone values that are to be restored when all-day is toggled off in separate view model fields.

  • bir(18 Aug 26)

    [Android] Upgrade targetSdk to 36 close: #11342

  • and(20 Aug 26)

    Fix style and linter issues

  • jas(17 Aug 26)

    Remove unused ProgenitorsToUpdateExclusionDates Co-authored-by: osb <[email protected]>

  • jas(17 Aug 26)

    Modify parser to allow certain abnormal GMT/UTC offset TZIDs. Co-authored-by: osb <[email protected]>

  • jas(14 Aug 26)

    Allow for partial success when parsing iCal files that contain invalid events. Co-authored-by: osb <[email protected]>

  • osb(10 Aug 26)

    Remove test that does reflect the UTC+TZID behaviour we decided on

  • Lakshay(31 Jul 26)

    Ignore TZID when parsing time with UTC indicator # Conflicts: # src/applications/calendar-app/calendar/export/CalendarParser.ts

  • jas(07 Aug 26)

    Add repeat rule test and simplify ICal UNTIL RRULE value to enum conversion This commit is the result of looking into our repeat rule handling, which does not seem to be fully spec compliant, can maybe buggy for specific time zones... we'll look into this later. Co-authored-by: and <[email protected]>

  • jas(06 Aug 26)

    Allow importing of datetime string with Z-suffix together with UTC time zone And also simplify parser logic Co-authored-by: and <[email protected]>

  • osb(05 Aug 26)

    Fix broken repeat rule test for CalendarEventWhenModel

  • osb(05 Aug 26)

    Match-up names in enums for calendar event and import validation

  • osb(05 Aug 26)

    Remove dead code from CalendarSearchView

  • osb(05 Aug 26)

    Fix [Object object] date picker button label

  • jas(05 Aug 26)

    Fix formatDuration bug where time zones are not considered when checking if same-day Co-authored-by: and <[email protected]>

  • jas(05 Aug 26)

    Use year/month/day/hour/minute/timeZone objects for start and end in CalendarEventWhenModel Co-authored-by: and <[email protected]>

  • osb(05 Aug 26)

    Use year/month/day fields internally in the CalendarEventWhenModel

  • osb(04 Aug 26)

    Use Luxon DateTimes internally in the CalendarEventWhenModel

  • jas(05 Aug 26)

    Remove nonstandard async behavior that was causing multiple UserError popups to appear in the DOM. Co-authored-by: and <[email protected]>

  • osb(04 Aug 26)

    Inverse somewhat realistic CalendarEventWhenModel test for completeness

  • osb(04 Aug 26)

    Make parseFromString test more granular by splitting into scenarios

  • jas(03 Aug 26)

    WIP: Fix multiple duplicate Modal children components on Android by bypassing Mithril. Co-authored-by: osb <[email protected]>

  • osb(31 Jul 26)

    Fix time picker select dropdown button border sometimes clipping

Tuta Security

5.6/10

Repo Security Summary

Updated 17 Aug 26

  • Maintained10/10
  • Code-Review1/10
  • PackagingN/A
  • Security-Policy10/10
  • Dangerous-Workflow10/10
  • CII-Best-Practices0/10
  • Token-Permissions7/10
  • Binary-Artifacts8/10
  • License10/10
  • Branch-ProtectionN/A
  • Signed-Releases0/10
  • Pinned-Dependencies7/10
  • SAST0/10
  • Fuzzing0/10

Security Advisories (5)

  • highPatched

    GHSA-24v3-254g-jv85DOM attribute and CSS injection in contact viewer

  • mediumPatched

    GHSA-jj2j-5x96-gf8hRelative resource URLs in email body could cause a crash in iOS app

  • lowPatched

    CVE-2024-23330Images are loaded from external resources

  • highPatchedCVSS 7.5

    CVE-2024-23655Attacker can prevent users from accessing received emails

  • criticalPatchedCVSS 9.3

    CVE-2023-46116Remote Code Execution via insufficiently sanitized call to shell.openExternal

Tuta Website

Website

Tuta: Turn ON privacy for free with secure emails, calendars & contacts | Tuta

Tuta guarantees your data stays private for free & without ads. Quantum-resistant encryption makes Tuta the best secure technology solution to protect your privacy.

Redirects

Does not redirect

Security Checks

All 65 security checks passed

Server Details

  • IP Address185.205.69.12
  • LocationHanover,Niedersachsen,Germany,EU
  • ISPTutao GmbH
  • ASNAS210909

Associated Countries

  • USUS
  • DEDE

Safety Score

Website marked as safe

100%

Blacklist Check

tuta.com was found on 0 blacklists

  • AntiSocial Blacklist
  • Artists Against 419
  • Badbitcoin
  • Bambenek Consulting
  • CERT Polska
  • CoinBlockerLists
  • CRDF
  • CryptoScamDB
  • EtherAddressLookup
  • EtherScamDB
  • Fake Website Buster
  • MetaMask EthPhishing
  • NABP Not Recommended Sites
  • OpenPhish
  • PetScams
  • PhishFeed
  • PhishFort
  • Phishing.Database
  • PhishStats
  • PhishTank
  • Phishunt
  • RPiList Not Serious
  • Scam.Directory
  • SecureReload Phishing List
  • Spam404
  • StopGunScams
  • Suspicious Hosting IP
  • ThreatFox
  • ThreatLog
  • TweetFeed
  • URLhaus
  • ViriBack C2 Tracker

Website Preview

Website preview

Tuta Android App

APK Info

De-Googled Compatibility

Native3.96/ 457 ratings
microG4.00/ 425 ratings
  • GrapheneOSNative4.0 / 4(46)
  • CalyxOSmicroG4.0 / 4(14)
  • LineageOSmicroG4.0 / 4(7)
  • LineageOSNative4.0 / 4(3)
  • crDroidNative4.0 / 4(3)
  • e OSmicroG4.0 / 4(2)

Tested on Android 11–17 · Updated 30 Aug 26 · View on Plexus →

Trackers

No trackers found

    Permissions

    • Access Network State
    • Internet
    • Read Contacts
    • Read External Storage
    • Vibrate
    • Wake Lock
    • Receive
    • C2d Message

    Tuta iOS App

    App Info

    Tuta Mail: Secure Email

    PROTECT YOUR PRIVACY WITH TUTA MAIL – FREE, SECURE & ENCRYPTED EMAIL Take control of your email with Tuta Mail, the world’s most secure email service, trusted by over 10 million users. With end-to-end encryption, your emails and contacts stay private. Fast, open source, and free: Tuta Mail is built with the highest security standards. WHY CHOOSE TUTA MAIL? Stay Secure • Quantum-Safe Encryption: Your entire mailbox and contacts are fully end-to-end encrypted – only you can access them. • Zero Tracking: We never track or profile you. Your data is yours. • Anonymous Registration: Sign up without providing a phone number or personal details – for free or pay anonymously with cash or cryptocurrency. • Open Source: Our code is publicly available for independent security review. Boost Your Productivity • Free Secure Email: Get a free email address with @tutamail.com, @tutanota.com, @tutanota.de, @tuta.io, or @keemail.me and 1 GB of free storage. • Exclusive Domain: Upgrade to a paid plan to create a short @tuta.com email address. • Auto-Sync: Your emails and contacts sync seamlessly across the app, web, and desktop clients. • Offline Access: Read and manage your encrypted emails even without an internet connection. • Contacts App: Sync your Tuta contacts to your phone. Simple & Intuitive • User-Friendly Interface: Clean, modern design with light and dark mode. • Quick Swipe Gestures: Easily organize emails with swipe-to-archive or swipe-to-trash. • Full-Text Search: Securely search your encrypted emails. • Smart Notifications: Delete or move emails directly from notifications to save time. BONUS: FREE ENCRYPTED CALENDAR APP Your Tuta Mail account includes a free encrypted calendar, giving you the same privacy for scheduling and event management. Stay organized while keeping your data safe. WHO IS BEHIND TUTA MAIL? Freedom fighters committed to protecting freedom of speech and your right to privacy! • Developed & Hosted in Germany: Adheres to strict GDPR data protection laws. • Private by Design: We can’t access your data – secure password reset ensures your privacy. • Secure Transmission: Industry-leading security with TLS, PFS, DMARC, DKIM, DNSSEC, and DANE for safe email delivery. TRUSTED BY SECURITY EXPERTS "Tuta provides an exceptional level of security and privacy... If security is your priority, there’s not much better than Tuta." — TechRadar "Since Tuta is open source and has amazing products in development, I moved my email there." — Journalist Dan Arel "Tuta’s email security is unmatched. Its mobile apps are fast and user-friendly, with fair pricing and a free option." — CyberSynchs JOIN MILLIONS WHO TRUST TUTA MAIL Keep Your Email Private: Download Tuta Mail today and join millions who trust us for secure, encrypted communication. Website: https://tuta.com Open Source Code: https://github.com/tutao/tutanota Terms of Use: https://www.apple.com/legal/internet-services/itunes/dev/stdeula

    Rating

    Rated 4.72 out of 5 stars by 3,483 users

    Version Info

    • Current Version355.260720.0
    • Last Updated23 Jul 26
    • First Released30 Nov 14
    • Minimum iOS Version16.0
    • Device Models Supported127

    App Details

    • IPA Size81.44 Mb
    • PriceFree (USD)
    • Age Advisory4+
    • Supported Languages59
    • DeveloperTutao GmbH
    • Bundle IDde.tutao.tutanota

    Screenshots

    • App screenshot
    • App screenshot
    • App screenshot
    • App screenshot
    • App screenshot
    • App screenshot
    • App screenshot
    • App screenshot

    Tuta Reviews

    More Encrypted Email

    • A Berlin-based, eco-friendly secure mail provider. There is no free plan, the standard service costs €12/year. You can use your own domain, with the option of a catch-all alias. They provide good account security and email encryption, with OpenPGP, as well as encrypted storage. There is no dedicated app, but it works well with any standard mail client with SSL. There's also currently no anonymous payment option.

    • Mailfence supports OpenPGP so that you can manually exchange encryption keys independently from the Mailfence servers, putting you in full control. Mailfence has a simple UI, similar to that of Outlook, and it comes with bundled with calendar, address book, and files. All mail settings are highly customizable, yet still clear and easy to use. Sign up is not anonymous, since your name, and prior email address is required. There is a fully-featured free plan, or you can pay for premium, and use a custom domain ($2.50/ month, or $7.50/ month for 5 domains), where Bitcoin, LiteCoin or credit card is accepted.

      Not Open Source
    • An end-to-end encrypted anonymous email service. ProtonMail has a modern easy-to-use and customizable UI, as well as fast, secure native mobile apps. ProtonMail has all the features that you'd expect from a modern email service and is based on simplicity without sacrificing security. It has a free plan or a premium option for using custom domains (starting at $5/month). ProtonMail requires no personally identifiable information for signup, they have a .onion server, for access via Tor, and they accept anonymous payment: BTC and cash (as well as the normal credit card and PayPal).

    About the Data: Tuta

    Change History

    • Amended (description) by @Lissy93 #387
    • Amended (description, openSource) by @brnsuh #262
    • Amended (androidApp, iosApp, subreddit)
    • Renamed previously: Tutanota from Communication › Encrypted Email by @thezacharytaylor #213

    Edit Tuta Data

    You can edit Tuta's entry in this section of awesome-privacy.yml by submitting a PR to our GitHub repo.
    Note that some of the information shown above has been aggregated from external sources, a list of these can be found data documentation.

    Origin Data

    Modify Data

    API

    You can access Tuta's data programmatically via our API. Simply make a GET request to:

    https://api.awesome-privacy.xyz/v1/services/tuta

    The REST API is free, no-auth and CORS-enabled. To learn more, view the API Docs or read the API Usage Guide.

    Share Tuta

    Help your friends compare Encrypted Email, and pick privacy-respecting software and services.
    Share Tuta and Awesome Privacy with your network!