ProtonMail vs Tutanota vs CTemplar: which is the best?

in Privacy4 years ago (edited)

email.png

ProtonMail, Tutanota, and CTemplar are secure email service providers that heavily value your privacy and anonymity. That said, I shall focus on their differences here.

CTemplar is short for "Crypto Templar". Tutanota is a combination of the Latin words "tuta" which means "secure", and "nota" which means "note".


Anonymity

All three email service providers heavily value anonymity and privacy, but they differ on their implementations.

Both Tutanota and ProtonMail log IP addresses in an anonymous way to prevent abuse of their services.

Tutanota allows anonymous sign-ups, but subject to anti-spam measures (which may result in your new account remaining unusable unless you contact them with another e-mail address). They also don't accept any cryptocurrency, which is a nightmare for those who want to remain totally anonymous (where using Tor browser is an important requirement).

ProtonMail requires verification (through another e-mail address or phone number) upon signing up for a free account. However, when you do want to upgrade to premium immediately, ProtonMail accepts Bitcoin and cash (through envelope mail), along with conventional payment methods such as PayPal and credit card.

CTemplar never logs your IP address - not even in an anonymous way. If you are applying for a free account, you are required to email them using any other email address (ProtonMail or Tutanota emails are recommended) to get an invitation code for free signup. The email address which you used to get a registration code will not be linked to the CTemplar free account you will create. For premium, you are not required to email them to get a registration code, and they accept Bitcoin, Stripe, and credit card for payment. The best part is that CTemplar accepts XMR (Monero) as payment, though it is subject to manual processing.

CTemplar clearly wins.


Encryption

All three automatically encrypt the contents of the email. They even offer end-to-end encryption for recipients not using their respective services, by protecting the email with a pre-shared password between sender and recipient.

Tutanota encrypts the entire email (except the sender and recipient e-mail addresses, which makes sense), though it does not support PGP ("Pretty Good Privacy") encryption supported by nearly all email clients. If users want to send end-to-end encrypted messages to non-Tutanota email addresses, Tutanota creates a temporary email addresses to the recipient(s) which can be read only with a password.

ProtonMail encrypts only the content of the email, not the subject, when sending to ProtonMail addresses. However, it supports PGP encryption which is compatible with most other email providers.

CTemplar allows the encryption of email subject for paid accounts, but not for free accounts. CTemplar also does not offer PGP.

For those who are using the Tor browser and do not entirely trust SSL certificate authorities (even if they are based on Switzerland and Iceland), both ProtonMail and CTemplar offer .onion links for their web-based email clients, while CTemplar offers it for their entire website. This technically guarantees the encryption of your data in transit.

There is no clear winner here. While Tutanota encrypts the subject for both free and paid accounts and CTemplar for paid accounts, some users might find the need to use ProtonMail's PGP functionality for recipients using other email providers.


Integrity

Both ProtonMail and Tutanota offer zero-knowledge end-to-end encryption, but there is nothing stopping them from serving malicious javascript that can capture the users' passwords (even though they risk their entire business whenever they do it).

CTemplar offers SRI (subresource integrity) and checksums, to ensure that nobody including CTemplar itself can serve users malicious code that can capture passwords.

CTemplar clearly wins here.


Jurisdiction

Tutanota is based in Germany, which is a member of the 14 Eyes countries. Germany is an ally of the United States, which is the worst in privacy in all "free" countries. When the German courts find a data request from the United States government valid, the German government (and corporations) will provide their residents' data to the US government (while it is also possible for the German government to request data from the United States).

ProtonMail is based in Switzerland, which is a neutral country and has one of the best privacy laws in the world. However, Switzerland has data sharing ties (specifically about banking and taxation) with the United States, which may concern for privacy enthusiasts.

CTemplar is based in Iceland, which is probably the country with the strongest privacy laws. Iceland also does not have any data sharing ties with any country.

The clear winner here is CTemplar.


Pricing

All providers, on their premium plans, provide you with the ability to use custom domains, add email aliases, and add custom filters. Each premium plan comes with add-ons (such as additional aliases and storage size) that can be purchased separately.

Tutanota provides 1 GB of storage and allows only a few emails per hour (based on their anti-spam algorithm) for free accounts. Their cheapest premium option costs at least 1 euro per month. It allows you to get help from their support, which is not provided to free accounts. However, upgrading to premium does not increase your storage capacity. (Upgrading your storage further from 1 GB to 10 GB costs at least an additional 2 euros per month.)

ProtonMail provides 500 MB of storage and allow 150 messages per day for free acccounts. Their cheapest premium option costs at least 4 US dollars per month. It increases your storage capacity from 0.5 GB to 5 GB. It should be taken note that when paying for premium, using either the USD, EUR, or CHF currency does not change the absolute amount. For example, the premium monthly subscription costs either 5 USD, 5 EUR, or 5 CHF, ignoring foreign exchange rates. (Upgrading your storage from 5 GB to 10 GB costs at least an additional 5 dollars per month.)

CTemplar provides 1 GB of free storage. They allow 200 messages per day for free accounts. Their cheapest premium option costs at least 6 US dollars per month. While they are more expensive than their competitors, they are transparent about the reason why they have to charge this much - they are never sponsored by any government or corporation. It increases your mailbox storage capacity to 5GB.

ProtonMail premium is more expensive, but it comes with even more features than Tutanota. CTemplar must charge higher than average to technically guarantee your privacy. Regardless, Tutanota wins in both free features and premium pricing.


Customer support

Tutanota does not offer support for users having free accounts. You can still access their knowledgebase if you want to solve the problems yourself, or you can try asking the community on third-party platforms for free support.

ProtonMail offers "limited" support for users having free accounts.

CTemplar offers support for all accounts, whether free or paid. (There comes the assumption that paid accounts have priority support than free accounts, but it is not stated on CTemplar's website.)

CTemplar wins.


Interface

ProtonMail has a cozy interface, which shows you upon logging in a big banner asking you to upgrade to premium (if you haven't done it yet). It also shows another banner asking you to visit their online shop. However, ProtonMail has a lot more features which are visible just by looking on the home screen.

Tutanota has a clean interface, and does not immediately ask you to upgrade to premium (unless you stumble upon some of their premium-only features, for which you would see a pop-up asking you to upgrade to premium).

CTemplar has a cozy interface, but it does not bother you with upgrading to premium unless you stumble on their advanced settings.

CTemplar has a slight edge on this one because it offers a good compromise between interface and accessibility. Tutanota would be more appreciated by non-technical users, while ProtonMail would be favored more by experienced users.


Conclusion

CTemplar wins in jurisdiction, anonymity, integrity, and interface. Tutanota wins in both free features and premium pricing. ProtonMail is a runner-up in jurisdiction and interface. All are at par with each other in terms of encryption.

It is worth noting that ProtonMail already existed some time before the Edward Snowden revelations, while Tutanota and CTemplar came after. Therefore, it can be assumed that ProtonMail has much more experience in the field of secure and private email than the other two.

I highly recommend CTemplar among the three email service providers. It is worth noting however that Tutanota has the cleanest interface, while ProtonMail has the largest experience in privacy-centric email.

Sort:  

@chrisrice, @vimukthi, @shainemata, @theophile.roos

I believe you would really like this post of mine. While I have already posted ProtonMail vs Tutanota before, I have added to the comparison CTemplar which is a great contender.

This is a great post detailing the advantages of each email service. I was thinking of registering so this will be a useful guide for me. Thanks @anonymouser. :)

Thanks for reading and appreciating my article!

You're welcome. Keep safe. :)

Nice writeup, tho I generally don't value location that much, since...

And they admit the operation is becoming more and more effective as time goes on (you can learn more about the history of the "eyes" here [archive]). What does it mean for the people, though? Choosing a provider from a supposedly privacy-respecting country does not help avoid surveillance - many of them are apart of the fourteen eyes and even if they aren't, they might still cooperate with foreign intelligence. I mean that's exactly what Iceland (non-14 eyes) did during the Silk Road investigation (archive). They've literally let USA agents in to do whatever they wanted. Therefore, in the end, you shouldn't focus too much on the country issue (just assume they're all in it together anyway), but instead on the provider's actual policies, history and trustworthiness. That plus using encryption, a VPN and good OPSEC should protect you from surveillance way better than falling for red herrings like the service's location.