In this piece, we will outline the differences between 

 - two end-to-end encrypted, privacy-first email providers. At the most basic level, both email providers focus on privacy above all, including end-to-end encrypting all email content. However, if you are investigating private email providers, considering leaving your existing email provider, or 

 (Gmail or Outlook) to an email service which provides end-to-end encryption, this piece is critical for you to read.

 was founded in Hanover, Germany in 2011 with the express goal of fighting against surveillance and for email privacy. Since then, Tutanota has expanded beyond email and delivered a privacy-first email and calendar combination.

 was founded in 2020 in New York, USA. Skiff’s goal is to bring privacy-first, end-to-end encrypted communication and collaboration to world by delivering best in class security with usability and intuitive user experiences.

 as their main form of email encryption and security. End-to-end encryption is a method of communication where only the communicating parties can read the messages. This is done by each party encrypting their messages using recipients’ public keys before sending them, and wherein the other party decrypts users’ messages. This means that even if a malicious actor were to intercept the messages in transit, or recover encrypted data from the email provider, the hacker or malicious actor would not be able to read them.

For more detail on how Tutanota and Skiff use end-to-end encryption and public key cryptography, check out 

. Generally, both products use similar encryption schemes wherein each user has encryption and signing keypairs for sending secure messages to other users, as well as for communicating externally.

Skiff Mail and Tutanota share many similarities in terms of this security functionality, but there are also key differences that could make the difference in helping you choose your next email account, particularly depending on your use cases and preferences. Let’s go through some of the key features of each email service.

In recent years, Tutanota has run into legal troubles as German courts have ordered a "

" to be installed for monitoring certain users. This has raised significant privacy concerns for users, as it is now unclear whether the provider yields significant privacy benefits. Skiff has had no such concerns.

Both Skiff Mail and Tutanota offer a free email tier to their users, and both service providers also offer paid plans for their respective secure email services. Tutanota has a Personal private and teams plan as well as a several business email plans. Skiff on the other hand only offers 

Free tiers are particularly helpful for email services as new users can test different features, from email signatures and auto replies to folders and undo send, 

. So, you can always experiment by creating accounts on both platforms and seeing which workflows and products best suit your needs.

Skiff Mail is dedicated to being as transparent as possible to its users and thus have made the Skiff Mail client code open-source, encryption protocols open source, and most of the company’s user interface and design components open source as well.

. There email does not use any closed third party sources and are available on Android using F-Droid.

Both Skiff Mail and Tutanota are also Google Free meaning they use no external service belonging to Google, including Google’s Captcha products. This ensures your personal information is never shared with, sold to, or monetized by big tech.

Skiff Mail offers free users 10GB of storage and Pro users 100GB of storage. This additional storage is a great benefit for users who use their email messages as a way to store their personal data and use email for file sharing and archiving.

Tutanota offers its free and premium users 1GB of storage. Team users on Tutanota receive 10GB of storage. As a result, Skiff’s more generous free plan may help you leverage additional products and features, such as drive storage, real-time collaboration, personal notes, or other professional use cases.

Both Skiff Mail and Tutanota make use of cloud-based storage; however, Skiff Mail also lets users use the 

 (IPFS) to store their emails. IPFS is one of the best alternatives to centralized cloud-based server storage, as it makes use of a decentralized network of nodes and storage providers to store files across the internet.

Skiff Mail currently does not support IMAP or SMTP support but offers its own email clients for users across multiple devices (see section below). Tutanota also does not support IMAP or SMTP support, instead opting to use their own mobile apps for security and protection.

 as well as a macOS desktop app. Skiff Mail is also available on all web browsers.

 on Android and iOS as well as apps for Linux, Windows, and macOS. Tutanota is also available on all browsers.

Multiple device support is important for any new email account; in particular, mobile or desktop devices allow users to receive email notifications, which may be especially important for professional email users who are expected to respond in a certain time window.

. To read more about Skiff’s encryption check out Skiff’s 

 here. To read more about Tutanota’s email encryption see their website 

PGP has largely fallen out of mainstream use and adoption; furthermore, it has some larger 

 that have pushed most secure emails to employe methods that are simpler and more reliable.

Skiff provides 1 free custom domain, and Tutanota requires payment

A custom email domain is an email address that includes your company or organization's name, rather than a generic provider such as Gmail or Yahoo (such as @yourname.com). This can make you appear more professional and credible to customers and clients. It can also make it easier for people to remember your email address. Adding a custom domain generally involves modifying DNS records; once complete, you will be able to use your custom email domain for all of your email accounts.

Skiff Mail currently does not support custom domains but plans to release this feature in October 2022. Tutanota supports custom domains and even lets you use as many custom domains as you like under their business subscription plans.

For business users or professional email accounts, custom domains can be a valuable way to own your own email identity.

Skiff Mail supports email security features such as two factor authentication, end-to-end encryption, priority customer support, client-side search, and spam and phishing detection software. Skiff also proxies remote content, such as all images, which could be used to track users and invade privacy.

Tutanota supports two factor authentication and even comes with its very own encrypted calendar that can be used to plan your schedule and connect with your email.

Skiff Mail supports mail features such as schedule send, 

, and even auto-reply. Skiff Mail also has mobile and desktop notifications as well as folder, label, and archive support for all users. Skiff also has a robust array of keyboard shortcuts that will be quite familiar to Gmail and Microsoft Outlook users.

Tutanota supports custom signatures, auto-reply, mobile and desktop notifications, as well as folder and archive support. As a result, both email products maintain somewhat similar consumer functionality for organizing and managing your inbox, navigating through mail applications, and more.

Email aliases are email addresses that are associated with a single user's account, but are displayed to recipients as if they were coming from a different email address. This can be useful for a variety of reasons, such as creating a more professional-looking email address, or consolidating multiple email accounts into a single inbox. They can also be critical for preserving privacy or anonymity, as a recipient will not know which root email address was used to send email from an alias. For more on email aliases and privacy benefits, check out our blog on 

Skiff Mail currently lets users have 4 aliases per free account. Skiff Mail will soon introduce more aliases for Pro users in updated paid plans. Tutanota currently lets free users have 1 alias and 5 aliases for every Pro account.

If you’re looking for a great free email service that lets you maintain multiple aliases, you may want to try adding multiple to your Skiff account. Otherwise, if you’re set on a particular alias or custom domain, Tutanota’s alias limits should not impede your ability to use the service.

Both Skiff Mail and Tutanota work with VPNs (

), so whether you are using a desktop browser, using your inbox inside an Android app, or composing emails on an iPhone, you will be able to access all your emails with a private network connection. By routing your internet traffic through a VPN server, your IP address and other personal information is hidden from view. This can help to keep your online activity private, and can also help to avoid online censorship.

this blog on securely navigating web services

 and communicating online, we outline more good practices for using VPNs, particularly when accessing sensitive accounts (bank accounts, medical providers, insurance information, or any corporate work). Regardless of the email provider you choose, we recommend also setting up a VPN to keep your IP address and other personal information private.

We cannot recommend Tutanota as its privacy and encryption guarantees remain in a concerning legal state. 

On Skiff, all emails - including those arriving from other providers - are encrypted with a user's public key immediately upon receipt, ensuring that only a user has access to their emails. 

Skiff also provides far more value on the free plan, from more email aliases and custom domains to entire products for note-taking and file storage.

As a result, we recommend you try out Skiff.

Sign up for Skiff

To sign up for Skiff, you can visit the signup page at 

Skiff's paid plans, including their Pro and Business tiers, have many additional features across the Drive, Calendar, and Pages products than Tutanota offers today. Beyond 1 TB of storage and the ability to purchase domains in-app (Skiff Domains), Skiff is well suited to teams and business use, such as sharing a custom domain across multiple users, sharing docs/drive files, and creating public wikis. 

For the full feature set, check out the table below.

 user gets full access to the following products:

 (private domains integrated with Skiff Mail)

Skiff Mail also has accompanying encrypted cloud-based file storage (

) and encrypted document collaboration on its platform (

). This means you can use your Skiff Mail account not only as your email service provider, but also as a full workspace productivity suite. This includes everything from real time document collaboration, to end-to-end encrypted backup storage for all your important personal or professional information.

Tutanota offers an encrypted calendar and contacts app which pairs nicely with its main encrypted email application. These capabilities are 

, which provides useful resources and notifications to keep you up to date on your events and schedule. So, when selecting a provider, consider the additional accounts that are integrated into their offerings.

Other Skiff Mail and Tutanota alternatives include ProtonMail (based out of Switzerland), Mailfence (OpenPGP email service based out of Belgium), and Posteo (based out of Germany.) Others also include Apple Mail, Fastmail, Virtru, and Mailbox.org, which are discussed and compared in additional blog posts.

 for more information on privacy-first email, the benefits of encrypted email, and 

Comparing Tutanota and Skiff Mail

How to compute and use different hashes in JavaScript

Hashing is a key function in any programming language. Hash functions mathematically convert any data - a string, an array of bytes, or even an object - into a number. Hash functions must conform to three critical properties:

 - meaning that if you hash two different values 

 must be very low (to be more precise, it must be less than 1 divided by the number of possible outputs).

 - meaning that if you have a hash value 

 is less than 1 divided by the number of possible hash outputs.

Choosing a hash function must be done depending particular needs and constraints. For example, for simple message transfers or verifying data integrity, using a fast hash function - like MD5 - can be a good option. In other cases, like computing salted password hashes for user authentication, a fast hash function can lead to major security risks, like an increased risk of brute force attacks.

Vulnerable to collisions + brute force attacks.

Slower than MD5 but has demonstrated cryptographic attacks.

Not recommended for use due to known collisions.

Outputs 256-bit hash, which adds additional security compared to SHA-1.

Widely used in cryptographic contexts - certificates, protocols, verifying authenticity.

SHA-3 is a part of the broader cryptographic primitive family Keccak.

Similar performance to SHA-2, including SHA-256.

Generally quite widely recommended by cryptographers.

More than just hash functions: These are adaptive hash functions that can adjust the computational complexity depending on the context.

As a result, these functions are often used for password hashing because of this property, as it helps prevent brute-force and rainbow table attacks.

We won’t cover these two functions as they are 

. However, if you are looking to convert a password into a cryptographic key, these two functions are widely used, with 

Using skiff-crypto for simple, reliable hashes

 to simplify good cryptography practices. Skiff-crypto has powerful functionality for:

Asymmetric encryption - Creating keypairs for signing and encryption, then encrypting data using public keys.

Symmetric encryption - Encrypting objects, text, and more.

Datagrams - Managing object versions, fields, and metadata.

Hashing - Generating cryptographically secure hashes.

Skiff-crypto uses the SHA-512 hash function exported from 

 - for more information on how SHA-512 works, check out the comparison of hash functions above.

 in an example React project, check out the Code Sandbox linked inside the README file. The library is written in TypeScript with full type definitions available.

Using the built-in JavaScript crypto library

 library offers a more flexible and customizable hash function. For example, to generate a SHA-1 hash, you could run 

crypto.createHash('sha1').update(input).digest('hex');

 is a string or buffer object. This function will output a hex digest of the given hash. Similarly, to create a SHA-256 hash (as opposed to SHA-1), you could run 

crypto.createHash('sha256').update(input).digest('hex');

JavaScript’s built-in crypto library is also quite reliable, widely used, and extensible.

Hashing is frequently used to authenticate users without storing plaintext passwords (an incredibly insecure practice that is never recommended). Instead of storing passwords directly as plaintext, a secure hash of each password is stored. In this case, choosing a hash that is resistant to brute force attacks is quite important. When a user inputs their password, the password is hashed and compared to the stored hash, verifying the user without exposing the actual password. Note that secure authentication practices also recommend salting passwords, which is not covered in this guide.

Hashing is widely used in map-based data structures, like hash tables, to quickly retrieve stored data. Hashing can convert keys into array indexes, allowing for near-instantaneous lookup, insertion, and deletion operations. Hash functions can even convert objects to array indices, making them powerful options for storing data. Many programming languages include HashMap support for this reason.

We hope this guide was helpful. If you have any questions, reach out to support@skiff.org, open an issue on the 

Hashing in JavaScript and TypeScript

From any Skiff Page, click “Publish” to generate an end-to-end encrypted public link that can be shared with anyone on the web - including people without Skiff accounts.

Public Pages also publish all subpages, making it easy to share newsletters, wikis, job boards, or any other documentation for your team.

You can create a public Skiff page by clicking “Publish” from the top right corner on any web platform. Once published, the URL in your web browser will be changed to your Page’s public URL. This can be shared across the web and will make a Page (and all subpages) accessible to anyone, even those without Skiff accounts.

To learn more about how end-to-end encrypted public links work, check out our 

. All links contain unique encryption keys that keep your data private.

What paid features are available on Skiff Pages?

If you are onboarding your team onto Skiff Pages, Drive, Mail, and Calendar, paid plans offer a way to bring your entire team, company, or family to privacy. See below for more paid features, which include unlimited version history, extra storage space, and much more:

Are published pages end-to-end encrypted?

No. You can publish an unlimited number of pages, including on the Free plan.

Can you access published pages on mobile?

Yes. You can access published pages from the Skiff Pages or Drive mobile apps, or from any web browser.

Publish notes, wikis, articles, or job boards

Despite the meteoric rise of social media and messaging apps to the forefront of the internet, email’s importance hasn’t faded. The messages we exchange on Instagram, Facebook, or WhatsApp are less official and structured than the ones we send as private emails, which is especially important in more formal settings like the workplace.

Another reason is email's stability and reliability—the foundational internet protocols that most email platforms are based on have changed very little from their inception in the early 1980s.

The Simple Mail Transfer Protocol (SMTP) is chief among them because it governs how messages are transmitted between email servers. 

Unfortunately, SMPT wasn’t designed with built-in security

. We use alternative email security protocols and other methods to send secure documents and email messages.

What are different types of email security?

What is the more secure alternative to the SMTP mail protocol?

 to an Outlook account or vice versa. This is possible thanks to email protocols.

An email protocol is a group of standardized rules defining how email data travels between email clients and servers. 

The result is a universal email sent to and received from any email platform or server. Without SMTP, someone using Gmail couldn’t send a message to a Yahoo mail user—or at least, not as effortlessly.

Besides SMTP, the most widely used email protocols are:

Here’s a quick rundown of their basic functions:

Your device uses the POP3 and IMAP protocols while retrieving email data from a server. 

SMTP is the set of rules that decides how that data will reach your email server in the first place by regulating how it is transferred between servers.

Most people perceive the process of sending an email like this:

The email is transferred to your email server

The message travels from your server to the recipient’s email server via SMTP

The recipient’s email client downloads the message to their device

Thanks to today’s Internet speed, the process is almost instantaneous.

Email communication wouldn’t be possible without SMTP, but that protocol doesn’t come with encryption or other security features.

 Solely relying on SMTP means your email correspondence is unprotected in transit from server to server and while resting on one of the servers. Additional measures have to be taken to safeguard your messages and 

Different types of email security—best SMTP alternatives

 and individuals are secure, email clients provide additional security measures:

We’ll explain how all of them work to help you choose the best SMTP alternative for your emails.

email security protocols are sets of rules that ensure the functionality of global email exchange.

 Specifically, security protocols govern how your ESPs keep your 

Most ESPs, like Gmail, implement both protocols, but only premium G-Suite users have access to 

Free users, who make up the majority, can only rely on 

, who need a Microsoft 365 subscription to use the S/MIME protocol or any 

One of the ways to achieve email security is to set up a private email server. That way, you don’t have to rely on ESP’s 

, and no ESP can access the contents of your emails. In the past, Google has used email data for audience targeting in its digital advertising business, and a private server lets you avoid such misuse.

Still, you only get the benefits of email servers with proper setup and constant maintenance, which rarely outweigh the cost.

 The process involves buying, setting up, and maintaining expensive server hardware and software. Even if you have the immense prerequisite knowledge for the job, it is time-consuming and costly.

Running a private email server also means implementing every security measure yourself. In most cases, you won’t set up a better email security system than Google, Yahoo, or any large ESP. You can use hosting solutions to outsource the hardware management to someone else, but that still leaves you with a lot of work.

Some email clients give you the option of protecting your emails with a password. If you only tell the password to your intended recipient, no one else can access the email. This security method is a step up from relying solely on your ESP’s security protocols, but it comes with its own set of issues.

Not all email clients support password protection—Gmail does, for example, but Outlook doesn’t. 

Gmail’s Confidential Mode also involves the recipient reading the password from a smartphone, and relying on external devices isn’t ideal from a security perspective.

Password protection is not an elegant solution because it requires manual work from the sender and the recipient—unlike 

This security method turns an email into a coded message, ineligible to anyone except the intended recipient. 

ESPs use various encryption methods, each involving a complex algorithm that creates a cipher for your messages. The only way to decipher the message is to apply a decryption key, which (ideally) only the recipient has.

Common email encryption happens on the server level—TLS, S/MIME, and other security protocols encrypt a message before it is sent from one email server to another. The email service providers implementing these protocols store copies of the decryption keys on their servers and can use them to access your data.

This type of encryption can be broken if hackers gain unauthorized access to an email server, so the encryption is only as strong as the server's security.

End-to-end encryption—the best solution

 (E2EE) involves transforming regular messages into cyphers unreadable to anyone but the authorized recipient. E2EE follows the same principle but goes further by ensuring encryption security from both endpoints.

While standard encryption used by ESP’s security protocols involves server or network-based encryption, 

E2EE encryption protects the message at the device level.

By the time a message has been uploaded to a server, E2EE has already made it unintelligible to anyone but the recipient—including your ESP or hackers who break through the server's security. Such unauthorized parties would see the same unintelligible message as everyone else without the means to decipher it.

E2EE is the best SMTP security alternative because:

—Your ESP can’t read your messages, so they can’t be used for ad targeting or any other activity without your knowledge

It’s more reliable than standard email encryption

—Standard email encryption relies on your ESP’s servers, putting your data in the control of your email client and the company behind it. With E2EE, you retain complete control of your data

Mainstream email clients, like those operated by Google, Microsoft, and Yahoo, don’t provide E2EE protection. Their encryption methods are server-based, leaving your emails vulnerable to interception by man-in-the-middle (MITM) and other cyberattacks.

 is an excellent choice for E2EE-protected email.

 The platform provides all the web-based productivity tools you need, with optional Android and 

 for accessing your work on the go. Register for a free account and gain access to:

—an encrypted cloud storage solution for private files

—a browser-based workspace with collaboration features

Skiff combines the well-designed interface of popular ESPs with the ultimate encryption-based security across all Skiff tools.

The transition is smooth, so you can easily migrate from your previous email service provider by importing all email data into Skiff Mail. A free account gets you 10 GB of storage, an email search function, four aliases, and signature and auto-reply options, but you can move up to the 

 at any time and get additional features—including up to 1 TB of storage and custom email domains.

Take control of your online data with Skiff

Thanks to device-level encryption, no one can access your emails apart from their recipients—including Skiff. The platform also supports native web3 integration, allowing you to connect with your favorite 

 and ensure any communication related to your online transactions stays private.

Signing up for a free Skiff account is easy. It takes three simple steps:

Start using Skiff Mail and the other Skiff tools

 and protect your online communication from unwanted prying eyes!

What is the more secure alternative to the SMTP mail protocol? Explained by experts 

Migrating mail from Gmail or Google Workspace to Skiff can be done with only one click. From your Skiff Mail 

, click “Import mail.” You’ll be presented with multiple options, including:

Direct import from Gmail/Google Workspace

For the simplest option, we recommend choosing the Gmail/Google Workspace sign in option to sign in to your Google account and automatically import mail into your Skiff inbox. This will also continuously sync future mail, so any new emails received in your Google Workspace account will be imported into Skiff.

Mbox and EML file imports may be useful if you are either permanently closing your Google account, or if you are only looking to import a few emails. 

 - Google’s automated service for exporting data - produces Mbox files containing large numbers of emails. EML files are created when you download a single email from Gmail. So, if you are using Google Takeout or importing a few emails, the file import options could make sense.

Migrating your domain to Skiff Mail can be done in minutes. Once you’re on a Skiff Pro or Skiff Business 

, you will have access to custom domains in your Skiff Mail account. Visit the custom domains 

 and click “Transfer domain.” Then, after entering your domain name, you’ll be provided with DNS records to add to your domain (MX record, TXT records, and CNAME records). Once these records are added, your domain will be verified, and you can use it to send and receive email on Skiff.

Paid plans allow you to transfer multiple domains that can be shared with your team members. All workspace members will have access to a separate Skiff Mail inbox that can be provisioned with custom domain aliases, such as sales@domain.com, or marketing@skiff.com.

If you want to set up your Skiff Workspace with a new domain, you can purchase a domain through 

, which will automatically provision all needed DNS records. You can also set up the needed DNS records on your new domain from any other registrar (GoDaddy, Google Domains, Namecheap, etc.) after buying a new domain name.

Skiff is built for working together with your team, family, or company. To invite other users to your workspace, follow the instructions below:

https://app.skiff.com/mail?settingTab=organization

Type in the email address to send invites for your colleagues to join

Once they receive an invite, your colleagues will have to create an account inside your workspace

You can add a custom domain from the custom domain settings 

https://app.skiff.com/mail?settingTab=custom+domains

Admins can configure custom domains for other users from the settings page here: https://app.skiff.com/dashboard?settingTab=organization

Migrating from Google Drive and Google Docs

Migrating your data from Google Docs or Google Drive can also be done very easily. From the Skiff Drive or Skiff Pages settings page, click import, or visit 