By its nature, email is pretty public – though it may not seem that way. Emails are visible to your ISP and to every hop along the way.
Enter PGP email encryption.🔐 Despite the tongue in cheek name, “Pretty Good Privacy” has now been in use for over three decades. PGP seals your mail in an envelope that only the recipient can open with their matching key. 🔑
Now that we’ve covered Gmail-alternative email services, what’s next? You can access them all through the web browser of any device, but that experience is just terrible. The problem with dedicated apps, bear in mind, is that Gmail or Outlook still get your data. The apps you use to access your email accounts also need to be secure.
If you’re familiar with S/MIME email encryption, you can think of PGP as the decentralized version of that. S/MIME relies on authenticating the user’s identity against an established authority. Whereas PGP expects you to make your own decisions about whether you trust this person or not. PGP merely helps you establish that you are talking to who you think you’re talking to. That, and that no unwanted third-parties have intercepted the connection.
Cross-platform
Canary
Canary is an email client with a focus on privacy and security. They claim PGP compliance and the use of E2EE. This encrypts emails with zero-knowledge before they even leave your device. The encryption works with any PGP users, regardless of what email client they’re using.
Other features include read notifications, one-click unsubscribe, and even contact and calendar support. 🗓️
Update 2023:
Canary is now also available on Windows and Android. They also seem to have pivoted their focus to AI.
p≡p
The p≡p foundation, true to its name, designed their mobile apps with ease of use in mind. The result is a very polished UI and a seamless on-boarding experience. The downside of making things so easy is the increased centralization. Out of the box, p≡p works seamlessly with other p≡p users, but not so much with those who use other PGP solutions. Possibly due to not using a third-party keystore to import or verify keys. Fret not, as you don’t need to already have one in a seperate keystore. You can create a key during the installation process.
That said, the app is perfectly usable and certainly more secure than most email clients.
In addition to mobile apps, they provide extensions for Thunderbird and Outlook. They even help developers integrate cryptography into their apps using a devkit. Now that’s badass.
Update 2023:
p≡p has been dissolved due to creative differences and a lack of funding.😥Developers can use Sequoia instead.
NextCloud
iOS
Aside from Canary, iOS doesn’t really have a lot of great options for PGP, due to iPhones inherently being terrible for security and privacy. But here are a few honorable mentions in case you’re interested in checking them out. PGPro, iPGMail, InstantPGP.
Android
FairEmail
FairEmail comes from the NetGuard firewall folks. This app has taken almost the exact opposite approach compared to p≡p. They clearly didn’t worry about usability at all. Instead, they focused on cramming as much functionality as they could into the app. All while somehow maintaining a lightweight and snappy package.
This of course means that, unlike p≡p, you’re unable to use the advanced security features natively. You need to install a third-party keystore like OpenKeyChain and allow FairEmail to use it. Oh and you have to create your key within said keystore, or import an existing one.
FairEmail also didn’t waste their time working on the UI, nor do they bother holding your hand. A far cry from the thorough introductory tour that p≡p provides. FairEmail doesn’t even clearly label different options or provide tooltips or hints.
If that all sounds atrocious to you, then feel free to skip ahead. But those who appreciate features and tinkering with configs will feel right at home.
Before hitting send on a composed email, you can choose whether to only sign or also encrypt the message. You can even choose between S/MIME or PGP as your security solution of choice for this particular email.
Options like read receipts, gravatars and favicons are also available. Although, some features come with a warning if they could potentially pose a privacy risk. By default, FairEmail hides images in received emails and automatically blocks tracking images. Showing the images, or clicking on any links, requires a accepting confirmation pop-up.
Inbox Pager
Inbox Pager is a no-frills, lightweight, privacy-focused, open-source email client for Android. It also supports PGP.
K9
K-9 is a free, open-source, privacy-respecting email client. It adopts the design philosophy that made GMail’s long-gone Inbox app so popular. K9 supports multi-accounts in a unified inbox, OpenPGP, and background sync.
Despite being feature-packed, it remains simple and lightweight.
Desktop
Thunderbird
Thunderbird comes to us from the folks at Mozilla Firefox. Thunderbird is open-source with a primary focus on privacy and security. It is available for all desktop platforms.
Now you may not know this, but Mozilla is a non-profit organization. Over the decades, Mozilla has been foundational to the evolution of the internet. They’ve always spear-headed the development of technical standards that protect privacy and security.
By default, Thunderbird does not support PGP. But thanks to a Thunderbird add-on called Enigmail it does. Enigmail has partnered with p≡p to encrypt and decrypt your mail on the fly by allowing you to set a PGP key for each contact.
Update 2023:
RIP p≡p Foundation.💔Also Thunderbird has natively supported PGP for a few years now.
Betterbird
BlueMail
Mailspring
Self-hosted
Mailpile
Mailpile was a direct response to Edward Snowden’s revelations in 2013. It was successfully crowdfunded, despite PayPal freezing their funds. The result is a sleek, modern looking, fast, and highly secure webmail client that you can self-host.
Mail is stored locally and everything is encrypted and signed with PGP. You can even use SMTP over TOR and automatic calendar sync using each contact’s PGP key.
Cypht
Cypht is a powerful free and open-source webmail client and news reader. It’s very simple and lightweight but also extremely powerful with its modular extensions. And of course since it’s open-source, you can always make your own extensions for it. 🧩
The best part is that it’s designed to be self-hosted on your own hardware for ultimate privacy. On top of managing your local mail server, it also aggregates your third-party email accounts. And news. 📰