Email is how most people first get in touch, but it was not built to keep secrets. This guide explains what email gives away, when to avoid it, and how encrypted providers and password-protected messages help or fall short. It describes providers without recommending one: each provider's facts come from its own pages.
Security in a Box says ordinary email is stored unencrypted on your provider's servers and your recipient's, and can sit on several of the recipient's devices.
- Every email carries metadata: who wrote to whom, when, and usually the subject line. EFF calls it the envelope of a message and says end-to-end encryption doesn't hide it.
- Depending on the provider, the header can also include the sender's IP address, which shows roughly where you were.
- Even encrypted email services see some metadata. Proton says it can see sender and recipient addresses, the IP address incoming mail came from, attachment names, subject lines and times. Tuta says it can see sender and recipient addresses and the date. Apple says iCloud Mail is not end-to-end encrypted, even with Advanced Data Protection.
- When you write to someone on another service, that service may keep a copy, Proton notes, whatever you use yourself.
- Keep subject lines bland. Proton recommends subjects that say as little as possible about the content.
EFF says metadata can reveal a great deal about you even when the content stays secret.
FPF warns that a single email between a reporter and a source already leaves a record with the providers, and moving to a safer channel later can't undo it.
- For sensitive conversations, use Signal instead: see Keep sensitive conversations private.
- If a source writes to you by email, CPJ advises moving to an end-to-end encrypted app as soon as possible and deleting the original. CPJ notes that a copy is likely to stay on the provider's server anyway.
- Publish a Signal contact so sources can skip email entirely: see Plan how sources first reach you.
- FPF notes it is hard to tell in advance when a conversation will become sensitive. Move early rather than late.
Encrypted email is still email: FPF notes that if you write to someone on Gmail, Google can read the message.
An attacker who gets into your email can read everything in it and reset your other passwords.
- Use a security key or passkey where you can: see Use security keys or passkeys instead of codes.
- Check for forwarding addresses and filters you didn't create: see Remove forwarding and filters in your email.
- Check which devices are signed in and sign out the ones you don't know. In Tuta: Settings → Login.
- Proton says its recovery email or phone number can be used to switch off two-step verification. If that email or number is less protected than your account, it is a way in. On a separate address, don't add recovery details in your name at all: they link the account to you. Use the recovery phrase or code instead.
- Security in a Box suggests giving made-up answers to security questions, and keeping them in your password manager.
See also Plan how you will get back in.
CPJ advises a new email account used only for contact with a source, with no real name and not linked to your phone number or any account in your name.
- Don't rely on aliases. Security in a Box says they can usually be traced back to your main address through the headers of messages you send.
- Disposable inboxes can receive but not send, Security in a Box notes, so they don't work for a conversation.
- Proton may ask you to solve a CAPTCHA or verify a phone number or email when you sign up. Its privacy policy says it keeps them only for a while, and long term only as a cryptographic hash. A number or address in your name still links the account to you. Proton says people using Tor Browser are more likely to be asked for a phone or email.
- Tuta says it needs no phone number to sign up, but may hold new accounts for approval, usually within 24 hours on working days, and can't send or receive until then. Tuta says this often affects people using a VPN or Tor.
- Sign in regularly: Tuta deletes free accounts after six months without a login, and Proton deletes inactive free accounts too. Its own page gives different periods, so sign in at least once a year.
A separate address helps only if you never mix it with your own: don't sign in to both on the same device at the same time, and don't forward between them. See Avoid the mistakes that give you away.
Proton and Tuta encrypt mail so that they can't read the content of your stored messages. What that covers depends on who you write to.
Some services let you send an encrypted message to someone on another provider, who opens it with a password.
Files and pictures in email can reveal more than the message.
- Remove hidden data from files before you send them: see Remove hidden data from files.
- Images loaded from the internet can tell the sender that you opened the message, and sometimes where you are. Turn off automatic loading, or use a setting that loads images privately.
OpenPGP lets you encrypt email yourself, with any provider. EFF says tools like it are rarely used now and take technical skill to use safely.
- OpenPGP doesn't hide who wrote to whom or when. In Proton the subject isn't encrypted; Thunderbird encrypts it by default, but other apps may then show only "...". Keep subjects bland either way.
- Thunderbird has OpenPGP built in since version 78. The old Enigmail add-on is no longer used.
- Both people need to set it up correctly, and a mistake can send a message unencrypted. If the other person uses Signal, that is usually simpler.
Security in a Box lists OpenPGP tools as an advanced step. Use them if your contacts already do, not as your first protection.
No steps to show. Turn off a filter to see the rest.