Today, we're going to dive into a detailed comparison between two of the biggest secure email platforms on the market: Proton and Tuta. These two companies have gained prominence for promising and delivering not only privacy, but also high-level security for their users. But which is the best option for you?
Which offers more features, better value for money and, most importantly, greater protection for your data? In this video we will analyze everything about these two platforms, highlight the differences, the negative points and help you decide which email to choose. So, let's do another analysis, grab your coffee and let's go.
[VIGNETTE] Formerly known as Tutanota, the encrypted email service now called Tuta was created in Germany in 2011. The idea was simple: create a secure alternative in a market dominated by giants that profit from user data. Today, in addition to email, they offer an encrypted calendar and contacts.
ProtonMail, now Proton, was founded in 2014 by scientists at CERN, in response to Edward Snowden's revelations about mass surveillance. Based in Switzerland, Proton today offers a complete ecosystem of services, including email, VPN, file and calendar storage, password manager and Bitcoin wallet. This video was inspired by a question from subscriber Reinaldo Nascimento, he asked: "What's the difference between Tuta and Proton Mail?
" So the idea today is to compare the services common to both companies. The other services, which in this case are exclusive to Proton, I will not be able to compare with Tuta, but I will still bring my general perceptions about them. If you like this type of content, be sure to support it with your like and also complement the information in the video by leaving your opinion in the comments, okay?
Now, a quick warning: on November 28th, at 7pm, we will have a free class on digital security to protect your devices — both computers and cell phones. And on November 29th , we will have Privacy Friday, the Black Friday of digital security. We will do a live at 7pm and Proton and Tuta will participate in Black Friday.
I'll bring you exclusive discounts on services like VPNs, encrypted emails, ad blockers and more. . .
All links are in the description. Evaluation Criteria To evaluate Proton and Tuta's services, we will use five essential criteria: 1. Technology Here, we will analyze the infrastructure and technological resources, functionalities, and compatibility with different devices.
We want to know: is the platform technically robust? 2. Security We focus on protection against threats, security of your data, protection against phishing.
We seek to understand the security practices adopted by these providers. 3. Privacy Let's understand how each company handles your data.
Do they record your activities? How do you deal with requests for information from governments? 4.
Trust Trust, reputation and transparency are essential when choosing an email provider. We will evaluate each provider, prioritizing those that are transparent about their ownership and leadership. 5.
Documentation and Support Lastly, let's point out the quality of the guides and documentation. Do they help you set up and secure your email with ease? Having defined the criteria, let's analyze the email.
E-mail Nowadays, having an e-mail is practically mandatory to use anything online. Ordinary emails leak a lot of information about you. Therefore, it is better to use an email that takes care of your privacy.
Services like Proton Mail and Tuta keep your data secure and don't use your information for advertising. But how is this done? Proton Mail Let's start with Proton Mail.
It uses open end-to-end (E2E) and zero-access encryption standards to protect all email, contacts, and calendar data. All your data is encrypted when stored on Proton Mail servers, except for some email metadata such as email subject lines (more on this later). All settings and programs that run on Proton Mail servers are not open-source yet.
However, all encryption libraries, clients and codes that are executed by Proton servers on users' devices are Open Source. It is an email that supports the OpenPGP protocol, allowing you to send emails with end-to-end encryption (E2EE) regardless of the provider. Speaking of features, in Proton Mail: You can send "self-destructing emails" - they are automatically deleted at the time you choose.
Address verification, a way to ensure that a public key received from another user has not been tampered with since you first verified it. We also have premium accounts with a series of additional benefits, with multiple email addresses, unlimited folders and more features. Proton to Proton, emails are end-to-end encrypted, but you can also send encrypted emails to non- Proton Mail users using PGP or by password.
Own server infrastructure in Switzerland It has open-source apps for Android and iOS, as well as a web client. Proton Mail Bridge, which allows Proton Mail to integrate with other email clients that support IMAP and SMTP protocols . Easy Switch makes it easy to migrate to Proton Mail, importing messages from other services like Gmail.
Plans in reais for Brazilians. Registration may require a phone number to create account confirmation. It is important to remember that inactive accounts on the free plan are deleted after one year.
Overall, we have great features, a good interface, experience, and we've seen improvements since our last review. With a Proton account on the free plan, you already get free access with limitations to other Proton services such as VPN, Calendar, Drve and Pass. Tuta Mail Let's go to Tuta Mail.
Tuta uses a zero-knowledge architecture and proprietary implementation of end-to-end encryption to protect Email, Calendar and Contacts. All data stored on Tuta servers is encrypted and is only accessible when you log in via your browser or with a Tuta email client. Instead of using the IMAP and PGP protocols, they chose to develop their own implementation, which encrypts more data and fields in emails.
They explain that if they used standard protocols like Proton Mail, they would have to give up this greater encryption. Tuta Highlights: All clients and applications are Free Software and can be audited by the community at any time. Wide compatibility: available for Windows, macOS, Linux, iOS and Android (on the Play Store but also on F-Drid, without any dependence on Google).
They are the first email service to release a free app with nothing from Google on F-Drid. Encrypted emails by default for Tuta users Option for encrypted emails for external recipients. You can send secure emails even to those who don't use Tuta, encrypting only with a password.
Own server infrastructure in Germany. Anonymous registration. It does not require a phone number or personal information to create an account.
You can also create the email using VPN or TOR. It is possible to sign using Monero or Bitcoin through a partner store Customizable interface: light and dark themes for better usability. Premium plans: support for custom domains, unlimited number of calendars, additional emails and for companies a Whitelabel solution.
Inactive accounts on the free plan are blocked after six months and can be reactivated on paid plans. Technology To the inattentive eye and testers on duty, Proton and Tuta may seem the same, but calm down my friends, they are not. When we analyze the technology used in both, there are important differences.
Proton Mail only end-to-end encrypts the email body and attachments. When you send an email from Proton to Proton, only the two users can access the content of the email and the attachment. If you send an email to a Gmail user without Proton password protection, the content of the email will be accessible to Google.
And is it accessible for Proton too? No, they inform you that all messages are kept in an encrypted state and they do not have access. They also use PGP encryption, which despite bringing interoperability, that is, allowing multiple providers to use it, also lacks important protections.
A PGP encrypted email still exposes metadata information such as: subject, recipient, sender, dates, times, IP addresses, and sometimes the email application used. Proton comments that it encrypts this data, but not end-to-end. But what about Tuta?
Tuta Mail encrypts not just the body and attachments of emails, like Proton, they go further. They encrypt the subject of the email which may also be confidential. Instead of using an implementation of PGP itself, Tuta uses algorithms that it also uses to encrypt not only emails, but also other information that Proton Mail does not encrypt, such as contacts, metadata and calendar notifications.
Today, Tuta is the only email service on the market that automatically encrypts all this data and already uses post-quantum encryption. But there is a problem with Tuta, because it brings a single standard, that is, because it encrypts too much, it loses in interoperability. In other words, it does not support PGP so you cannot send emails with content encrypted in this protocol to other providers.
It also doesn't support IMAP, you can't connect with software like Thunderbird to manage your emails. But Tuta doesn't leave you hanging, it has created several open source clients for different platforms and encourages developers to create their own clients compatible with this new, more secure standard. So far, we know that both Tuta and Proton Mail prioritize user security and privacy over profits.
And people generally migrate to these two private services to have more security but mainly to get rid of tracking by Big Techs and ads. And Tuta stands out here once again for paying attention to the little details and continuing to choose solutions that prioritize privacy as the company grows. For example, Proton Mail uses some integrations with closed-source third-party services, including push notifications from Google.
You know that notification that appears when you receive an email? So, she goes through Google. In fact, for all apps on the Play Store, all notifications go through Google.
So for those who want to avoid Google and Apple at any cost and are not part of my mentoring program to know this information, all emails you receive in the Proton Mail app, whether on Android or iPhone, are sent by the service of notifications from these Big Techs. This way, Apple and Google know that you have Proton Mail and what time you received a new email. And there is information that governments already monitor these Big Techs through these notification services, but that's for another video.
Tuta, on the other hand, decided to follow a path to completely disentangle itself from Big Techs. They developed their own open source alternative to reCAPTCHA and a free notification sending service freeing users from Google Play Services. Its Tuta Calendar and Tuta Mail applications that are available on F-Drid do not have any link with Google or Google Analytics services.
Still talking about technology, let's talk about Proton Mail's usability and interface, starting with the web version. . .
Proton Mail's latest interface is quite beautiful in my opinion. There, you can switch between viewing in rows or columns, as we see here. You can also adjust the display density between "comfortable" and "compact", in addition to maximizing or not maximizing the email composer.
There are 8 theme options, with variations between dark and light tones. And on the left side we have access to conventional email folders. If you have a paid account, you can add as many custom folders as you want.
The overall email experience is very fluid. Just like other services Privacy-oriented, Proton Mail blocks remote content such as images by default, giving the option to upload them directly to the top of the window. The web client works smoothly, although there may be a slight delay in opening messages as they need to be decrypted before they can be read.
Because the client is browser-based rather than a stand-alone application, it may run a little slower as the number of messages in your folders increases, but I didn't notice any significant issues during testing. To write emails in Proton Mail you need to open the composer. It comes with a good set of HTML formatting options, including inline images.
And by default it appears in the bottom right corner. In it, you can easily add recipients, enter the subject, write the message body and attach files. There are buttons to turn on encryption, schedule sending, and even send messages that will self-destruct after a specified period of time.
Additionally, Composer offers basic formatting options such as bold, italics, underlining, lists, and text alignment. You can also insert images directly into the message body, which is very convenient. Overall, the email composing experience in Proton Mail is fluid and efficient, with the tools you need to create well-formatted messages.
Coming to Tuta, its layout follows the 3-panel pattern, common for emails. It comes with 4 themes Dark, Light, Light Blue and Dark Blue, and if you like darker themes due to the low screen brightness like me, we recommend it. Folders are on the left, messages in the center, and the content of the selected message on the right.
A basic set of folders comes pre-defined in the left pane, and you can create more at any time. To write emails, just click the "New email" button. At first, some people complained that Tuta didn't have many message formatting options.
Today, it already has all the main options. To see the formatting options menu, just click on the "T" icon near the email subject. You have the option to minimize the email composer by clicking close to continue writing later.
You can attach, select which email you want to send from and much more. To send the email, just click "Send" (in the top right corner of the message window) to transmit the message. Like Proton, Tuta also blocks the display of images by default as they are generally used for tracking.
If an email has images, you will manually allow them. One of Proton Mail's limitations is the ability to search for emails, which ends up being quite restricted and annoying at times. Because messages are encrypted (except when you are viewing them), the customer cannot search the contents of the emails.
This can be frustrating and make it difficult to find specific emails. Despite this limitation, Proton Mail allows you to search by fields such as sender, recipient, subject and date. While it's often not as comprehensive as a full search, you will be able to find your email with some effort.
It is important to keep in mind that this is a direct consequence of the end-to-end encryption applied in Proton. Tuta brings a much better tool even with all emails encrypted. To do this, it creates an encrypted search index, which may take a few minutes to process depending on the size of the inbox.
But this ensures that no one can access your information. It also allows searches for specific periods and fields such as subject, body, sender and attachments. Tuta emerges victorious here, bringing a more mature and detailed implementation.
Tuta offers rules and filters for email, but they are quite basic. In the Spam rules, you can place individual emails as spam, non-spam (leave in Inbox) or discard (send to Trash folder). Email rules are more flexible, but are only available on paid plans.
In Proton, we also have email rules and filters and automatic Spam detection, but I have seen, for example, Phishing and Spam pass through the inbox more frequently than in Tuta. Proton comes out ahead in filters, you can provide greater detail, it also supports a simple programming language called Sieve that allows you to program your own email filters. Proton Mail has apps for iOS and Android only in the Apple and Google stores.
On Android and it looks good and runs smoothly. At the moment, the Android app on the Play Store has more than 5 million downloads and a rating of 4. 7 out of 5.
Tuta Mail has apps for iOS and Android in the Apple, Google and F-Drid stores. I have no complaints about the app. At the moment, the Android app on the Play Store has more than 500 thousand downloads and a rating of 4.
5 out of 5. </span> Let's talk Infrastructure. Proton Mail maintains four data centers in Switzerland, one in Lausanne and one in Attinghausen (in the former K7 military bunker beneath 1,000 meters of granite) as backup.
Each data center has load balancing for web, email and SQL servers, redundant power and power supply, hard drives with full disk encryption and exclusive use of Linux and other open source software. In December 2014, Proton Mail joined RIPE NCC is a non-profit organization founded in 1992 that manages IP addresses in Europe and the Middle East. Thus, they have control over the allocation of IPv4 and IPv6 addresses that they use, in addition to owning and controlling all server hardware.
A year ago they opened a poll on Reddit for the community asking where Proton should open its next data center, in Norway or Sweden. Norway received the most votes. Regarding Tuta's infrastructure, I didn't find many public details available.
However, they claim that they own and control their entire server infrastructure. Furthermore, they deliberately chose to have their operations in Hannover, Germany (even though they could be anywhere in the world), because among the various historical and current legislative reasons, they consider that the country has some of the best privacy and data protection laws. of the world.
Closing the technology part, you can see that both Tuta and Proton have their strengths. Tuta stands out when it comes to being free, private and secure software — they are more detailed, more rooted, keeping everything as independent as possible. Proton, after ensuring a solid foundation in security and privacy, focused on attracting a larger audience.
He invested heavily in improving the interface, did a total rebranding to make everything more beautiful, and even brought several extra features to the email. After that, it expanded to other services such as VPN, Drve and Calendar, creating a complete ecosystem for those who want privacy without giving up convenience. In the end, they are different approaches: Tuta has so far been more purist and focused on fundamentals, while Proton has chosen to grow by offering a more complete and visually attractive package.
I'm not saying that Proton or Tuta are unreliable, far from it — they're just different paths. But the purist path is certainly more difficult. Security Let's talk about security.
When you create an account on Proton Mail, your browser automatically generates a pair of keys: one public and one private, using the RSA encryption method. The public key works like a safe where your emails are stored securely; Anyone who emails you is, in effect, putting your message in this vault. However, only your private key — which acts as the key to open this safe — can read these messages.
And to ensure that this private key is safe, Proton Mail takes one more step: it is encrypted again using the password you chose at the time of registration. This extra encryption uses the AES-256 standard. All of this happens directly in your browser or in the app, without your information being sent to servers in a readable format.
So even though Proton Mail stores your private key on its servers, it is always in an encrypted format that not even the company's own employees can access. This means that even if someone tries to force Proton Mail to hand over your messages via a court order, they simply have no way of decrypting your emails. And there's more: if you forget your password and haven't configured recovery methods, there is no way to recover your account, precisely because not even Proton Mail keeps an accessible copy of your keys.
In other words, the security here is so robust that it puts you in full control of your data, ensuring that only you can access it. This system ensures that Proton Mail never stores your emails in a format that can be read by third parties, not even themselves. Furthermore, it protects you from having your data exposed in cases of legal requests, as it is impossible to decrypt your old messages, even under legal pressure.
In Tuta, roughly speaking, we have a similar operation with changes in hashing and encryption algorithms. It encrypts more metadata than Proton has protection against quantum computing as we have already mentioned. Both Proton and Tuta have in-house security teams for their products.
However, we still know that independent audits are important. At the end of 2021, reports of security audits carried out by an independent company of all Proton applications were published. The flaws found have been fixed and all reports are accessible.
For Tuta, the last audit carried out by an independent company was in November 2013. They comment that during the tests, security experts were unable to access the system or recover any confidential data. No reports on this audit were found.
It's Tuta. . .
despite everything being free and open-source, it's been more than 10 years since the last independent audit. This is a point of attention. Now about account security, Proton Mail supports two- factor authentication for apps and hardware security keys using the FIDO2 or U2F standards.
To use a security key, you must first configure two-factor authentication per application. In Tuta we have the same scenario but only accepting the U2F standard for security keys. Privacy All Proton Mail servers are physically located in Switzerland.
This means your data is protected by Swiss law, which generally offers more privacy than US or EU law. However, Proton Mail makes it clear that if you violate Swiss laws and they receive a court order authorized by a Swiss judge, they will have to hand over any information they have about you to the Swiss authorities. This is where the lack of encryption in email metadata such as subject, sender and recipient addresses, attachment name and others can be a problem.
Furthermore, it is important to highlight that, in certain circumstances, Proton Mail may record your IP address. This may happen if they believe you are carrying out activities that violate their terms and conditions of service. Another situation is if the Swiss government orders them to register your IP address.
Even with all security and privacy measures implemented, Proton Mail cannot guarantee absolute privacy or anonymity in all circumstances. Although they will legally oppose requests whenever possible, know that they will not compromise the entire service because of one person. And is Switzerland really a good jurisdiction?
Yes, it is a good jurisdiction compared to others we have around the world. Is it the best? In my view, no.
Switzerland now has data retention legislation, but Proton Mail argues that it does not apply to its services, but rather to Swiss internet providers. Proton is also very clear about the threat model for the platform: “we cannot guarantee its security against a powerful adversary”. For most circumstances and people, this is a private and secure email service .
Now if you are Edward Snowden, Proton Mail is not for you. Tuta also ends up doing better here by encrypting more metadata and follows the same line as Proton. They are based in Germany, and by default they oppose all requests but may have to give up some data.
They comment that the right to privacy is in the German constitution and according to the legislation itself, it is not possible to have a general retention of data. Just like Switzerland, German companies are not allowed to provide their customer data to foreign authorities. A valid German court order is always required and is only issued upon probable cause during a criminal investigation.
There is also no law that forces them to weaken encryption or implement a backdoor. Furthermore, they comment that due to the oppressive regimes that Germany experienced and which depended heavily on surveillance by the general public, culturally Germans are very reluctant to give the government too much power or too broad surveillance laws, placing a higher value on privacy. .
In fact, this is one of the things I noticed when I was in Europe, while here in Brazil and Latin countries we don't have this concern so much yet. Germany has strong privacy laws, including the Federal Data Protection Act (Bundesdatenschutzgesetz) and the EU GDPR. As in other parts of the West, there is political pressure to reduce personal privacy rights to “fight terrorism.
” So far there has been no progress. However, Germany is a member of the 14 Eyes intelligence alliance. This is not ideal, Tuta provides a detailed explanation of the laws that apply to them and the data they may be required by law to disclose.
Here the analysis is as follows. In recent years we have seen an increasing number of orders received by both. Proton, having more users, has many more orders than Tuta, but we have a super important detail.
Germany is part of the European Union and Switzerland is not. Switzerland is a good jurisdiction but there is a hype about it that we need to be careful about, it is not perfect. Locally, Germany has more lenient privacy laws than Switzerland, but globally Switzerland has more independent and neutral policies than Germany.
As Tuta collects less data even though Germany is part of an alliance, here in my view Tuta wins. Trust Let's start with the most obvious point: people are failures. Regardless of the technology or security involved, human beings are susceptible to errors, pressure and, unfortunately, can be corruptible.
No matter how good intentions a company may have, it is made by people, and these people are subject to temptation, threats and external influences. This is an important point when we talk about trust in services that promise to protect our privacy. We need to remember that, at the end of the day, we are still placing our trust in human-run companies and that we need to be realistic.
That is why it is important that there are reports and transparency mechanisms, it is important that leaders and owners are public and that there are safeguards that prevent the company or organization from deviating from its fundamental principles. Proton takes a unique and transparent approach, led by its CEO Andy Yen and a publicly known team. The company has invested a lot in transparency reports, which are excellent.
They recently went a step further by creating the Proton Foundation, a foundation that is now the majority shareholder of Proton AG, the company responsible for developing and marketing Proton products. This model is interesting because, unlike other organizations, the foundation does not aim for profit. It can generate income, but its main focus is impact, without the pressure of meeting the interests of shareholders or the financial market.
This ensures that Proton can remain committed to its privacy mission without shifting focus to pleasing investors or seeking profit at any cost. The philosophy behind this structure is that to drive real change on a large scale, Proton needs a sustainable business model. They don't want to depend on donations from billionaires (like Signal), sponsorships from large corporations like Google (in the case of Mozilla), government support (like Tor) or voluntary donations (like Wikipedia).
Much less want to fall into the trap of speculation from the various foundations in the world of cryptocurrencies. By maintaining a profitable business at the center of its operations, but under the supervision of a non-profit foundation, Proton guarantees greater autonomy and continuity in its purpose. This brings additional security that, even as time passes, your values and goals will not be compromised by financial pressures or market changes.
In other words, it is a structure that reinforces confidence that Proton will not change direction overnight. Tuta is a company that makes a point of making its values and mission clear. With a fully public team of employees, they value transparency and ethics in all their operations.
The commitment to privacy is evident too. Tutanota is still at an earlier stage of maturity compared to Proton. Proton has already expanded its operations by creating a foundation and Tutanota is still consolidating its presence in the market without deviating from its original mission.
Here Proton clearly wins. Documentation and Support Proton Mail offers different levels of customer support depending on the subscription plan you have. Not surprisingly, free users receive a basic level of support, with access to a knowledge base and some step-by-step guides.
As you progress through the paid plans, you get email support and eventually priority support. Proton's documentation is excellent, you can find everything you need. However, at the time this video was recorded, few guides were in Portuguese, which is a negative point.
But for now, you can use a translator to read the guides. Tuta's documentation is less complete than Proton's, but at least it is in Portuguese. It's a bit of a strange Portuguese sometimes, yes.
But you can understand. Their support usually takes one business day to respond. If you are on a paid plan, you will have priority.
I've heard from people who had some situations with support but in the end everything was resolved. Proton's documentation is better, so it's here even though it's not in Portuguese. Plans and Prices The plans and prices of these services may change, but one thing that will be fixed from this year onwards is our Privacy Friday, the Digital Security and Privacy Black Friday promoted by PrivacyMap.
During this event, both Proton and Tutanota will be offering exclusive discounts that you can only find here. Typically, if you're looking for a more integrated solution, Proton's plans end up being more worthwhile. They offer a complete package that includes VPN, Drve, Email and other services, all in a single centralized ecosystem.
Furthermore, an interesting difference is that Proton charges in reais, which eliminates the need to transfer money abroad, pay IOF and other additional costs. On the other hand, Tuta stands out for its aggressive storage plans and advanced features within the email service itself. With it, you can create unlimited addresses with custom domains and calendars without restrictions.
Payment, however, can only be made in Euros, but they do offer the option of anonymous payment with Monero, reinforcing their commitment to total privacy. Ultimately, the choice will depend on your priorities. For most people looking for ease and a complete package, Proton tends to be the best option.
For those who value a more independent approach and anonymity, Tuta may be the ideal path. And that was the complete review of Proton and Tuta! If you liked the content, leave a like, subscribe to the channel and activate the bell so you don't miss any news.
And of course, share with anyone you think needs to know more about digital privacy! Want more analyzes like this? Comment below what you want to see in the next videos.
Until next time!
