End-to-end encrypted email, explained

How end-to-end encryption works with two keys, which mail Proton Mail, Tuta, Posteo, and Hushmail encrypt on their own, why Tuta does not use PGP, and what stays visible.

Key points

With end-to-end encryption, only the sender and the recipient hold the keys. The providers in between store scrambled text.
Mail between two Proton Mail users or two Tuta users is encrypted end-to-end on its own. Mail to Gmail and other services is not, unless you use a password or PGP.
Email addresses and the time stay visible to the provider. Proton Mail does not encrypt subject lines end-to-end; Tuta does.

Two keys

End-to-end encryption uses a pair of keys for each person. The public key may be known to anyone: it locks messages for you. The private key opens them, and only you hold it. At Tuta and Hushmail, your password unlocks your private key. That is why a forgotten password can cost you your mail, as the guide How to set up a private email account shows.

OpenPGP and Tuta’s own way

OpenPGP is the open standard for encrypted email. Proton Mail follows it and states that it maintains the most widely used open-source OpenPGP library in JavaScript. Hushmail uses OpenPGP too. At Posteo, you use OpenPGP in the webmail with the browser add-on Mailvelope, and your private key stays with you.

Tuta does not use PGP. It states that “PGP lacks important requirements that we have for Tuta,” and uses its own method instead, which it says is quantum-safe.

Which mail is encrypted on its own

	To users of the same service	To Gmail and other services
Hushmail	yes, automatically	only if you turn on the encryption switch
Posteo	only with OpenPGP or S/MIME, which you set up yourself	the same, or as a password-encrypted email
Proton Mail	yes, always	transport encryption only; end-to-end with a password-protected email or PGP
Tuta	yes	end-to-end with a password-protected email

In its webmail, Hushmail encrypts on its own server. Hushmail states that the message body “is temporarily exposed to the server before the PGP encryption takes effect.”

What stays visible

	Subject line	Email addresses	Time
Proton Mail	encrypted, but not end-to-end	encrypted, but not end-to-end	visible to Proton
Tuta	encrypted end-to-end	not encrypted	not encrypted

The addresses have to stay readable, because the servers need them to deliver the mail. Proton says that it does not encrypt subject lines end-to-end “to remain compliant with standards and ensure interoperability.”

Posteo’s crypto mail storage also encrypts stored metadata, such as subject lines and headers. Posteo states that it is “no substitute for regular end-to-end encryption set up by the sender of an email.”

Zero-access is not end-to-end

Mail from a Gmail user reaches a private provider as readable text. Proton says that it encrypts such mail immediately after receiving it, with your public key. From then on, only you can read it. This is zero-access encryption. Proton calls end-to-end encryption the stronger of the two, because then Proton never sees the unencrypted message.

Next step

How to send an encrypted email to someone who does not use the same provider is explained in the guide How to send an encrypted email to any address.