tuta Archives | HIPAA Compliant Email

June 12, 2026July 7, 2026

Free Encrypted Email Options for Personal and Business Use

free encrypted email guide featured image

[mh_key_takeaways]

Free encrypted email accounts fill a real gap for personal privacy. Proton Mail, Tuta, and Mailfence all offer no cost tiers with strong end to end encryption between users on the same platform.

The catch shows up when the mailbox needs to serve professional or regulated workflows. Storage caps, missing custom domain support, provider domain addresses, and no business associate agreement rule out most business use. For teams that need HIPAA coverage, a dedicated secure email service with a BAA in the base plan is the practical path.

This guide walks the credible free encrypted email options, the exact limits on each free tier, and where paid coverage becomes necessary.

The Landscape of Free Encrypted Email Accounts

The credible free encrypted email accounts in 2026 are Proton Mail Free, Tuta Free, and Mailfence Free. StartMail and Fastmail are paid only. Skiff shut down after the Notion acquisition.

All three free tiers offer end to end encryption between users on the same platform, storage between 500 megabytes and 1 gigabyte, and provider domain addresses. Custom domains and BAA support sit on paid plans.

The providers differ on jurisdiction, storage split, and side features. Proton is based in Switzerland. Tuta is based in Germany. Mailfence is based in Belgium. Each jurisdiction has different rules for law enforcement access.

Related sibling reading on the paid landscape sits at encrypted email service switzerland for jurisdictional detail. The best free encrypted email guide covers the ranking side of the same question in more depth.

Proton Mail Free Tier Explained

Proton Mail Free ships with 1 gigabyte of combined mail and drive storage, one email address, and 150 messages per day outbound.

Messages between Proton Mail users are encrypted end to end automatically. Messages to non Proton recipients travel over TLS in plain form or through a password protected portal link at the sender option.

The free tier does not include custom domain support, catch all addresses, additional aliases beyond the primary, or Proton Bridge for desktop client integration. Users access mail through the web app or the mobile apps only.

Sibling coverage on the Proton side sits at the piece on which free encrypted email has the most storage, which compares storage tiers across providers.

free encrypted email in article illustration one

Tuta Free Tier Explained

Tuta, formerly Tutanota, offers a free tier with 1 gigabyte of storage, one email address, one calendar, and encryption on subject lines in addition to the message body.

Tuta encrypts the entire message payload, including headers that most competitors leave in plain form. The encryption uses AES-128 for the message and RSA-2048 for key exchange. Newer versions add post quantum key exchange.

Free Tuta accounts do not support IMAP, POP3, or SMTP access. All mail flows through the Tuta web and mobile apps. That closes off desktop client use, which is a hard block for professionals who work in Outlook or Apple Mail.

Custom domain support and additional aliases sit on the paid Tuta Revolutionary or Tuta Legend plans. Free accounts use tuta.io, tutanota.com, or the older tutanota.de domains.

Mailfence Free Tier Explained

Mailfence Free offers 500 megabytes of mail storage and 500 megabytes of document storage, one address, and a calendar with 500 megabytes of storage.

The service supports OpenPGP end to end encryption between users. Mailfence users can import PGP keys and exchange encrypted mail with any recipient that also uses PGP, including Gmail and Outlook users on Mailvelope or Thunderbird.

The free tier includes IMAP, POP3, and SMTP support, which is unusual among free encrypted email providers. That opens desktop client use on Thunderbird, Outlook, or Apple Mail for the free account.

Mailfence does not offer a BAA on any tier. That rules out HIPAA use even on the paid plans, so healthcare organizations should look elsewhere. The sibling piece on free hipaa compliant email service covers that side of the question.

[mh_example]

What Free Encrypted Email Cannot Do

Free tiers cover personal privacy well. They fall short on several common business needs.

No BAA support. Healthcare organizations need a signed business associate agreement. Free tiers do not include one.
No custom domain. Business credibility drops when outbound mail comes from a provider domain like protonmail.com or tuta.io.
Storage caps. 500 megabytes to 1 gigabyte fills fast with attachments. Long term retention is not viable.
Daily send limits. Proton caps free accounts at 150 outbound messages per day. Sales and clinical workflows hit that limit fast.
No IMAP or SMTP on Proton and Tuta free. Desktop client use requires paid plans on those services.
Recipient friction. Sending encrypted to non platform recipients requires portal password sharing on a separate channel.

For personal use, none of these blocks matter much. For business or healthcare use, most of them are hard stops.

free encrypted email in article illustration two

Free Tiers Versus a Paid Encrypted Email Service

The upgrade from a free tier usually costs between 4 and 10 dollars per user per month. That unlocks custom domain support, higher storage, no send limits, and a BAA on the providers that offer one.

Proton for Business starts at about 7 dollars per user per month for the Mail Essentials tier. Tuta Revolutionary starts at 3 euros per month for personal use and moves to per user pricing for Tuta for Business. Mailfence Entry starts at 2.50 euros per month.

For teams that need a HIPAA compliant email path, a dedicated service like Mailhippo works alongside the existing Gmail or Outlook mailbox rather than replacing it. The secure email service plan includes a BAA and does not require changing email providers.

Sibling reading on the encryption concept side sits at encrypted email and on the account setup at free encrypted email account. For healthcare specific coverage, the Redefine Web healthcare marketing hub covers the wider operational context.

Sending From a Free Encrypted Email Account to Gmail

The workflow to send from Proton Mail Free to a Gmail address is the model example. Tuta and Mailfence behave similarly.

Compose the message in Proton Mail. Click the padlock icon on the compose window. Enter a password and an optional hint. Set an expiration date on the message. Send it.

The Gmail recipient sees a wrapper email with a link. Clicking the link opens the Proton encrypted viewer. The recipient enters the password to read the message. Attachments download separately.

The friction is sharing the password. Sending the password by email defeats the purpose. Deliver it by phone, SMS, or a prior secure channel. That handoff blocks casual use and slows down high volume outbound.

[mh_protip]

Free Encrypted Email Clients as an Alternative

Free encrypted email clients let a user layer encryption on top of an existing mailbox rather than switching providers. The two main options are Thunderbird with OpenPGP and Mailvelope for browsers.

Thunderbird ships with built in OpenPGP support since version 78. Users generate a key pair inside Thunderbird, export the public key, and share it with recipients. Encrypted messages send and receive through any IMAP or POP account, including Gmail and Outlook.

Mailvelope is a browser extension for Chrome, Firefox, and Edge that layers PGP on top of Gmail, Outlook on the web, and other webmail providers. Users generate a key pair in the extension and encrypt or decrypt messages directly inside the webmail interface.

Both approaches require public key exchange with each recipient. That works for a small stable set of counterparties. It does not fit ad hoc sends to unknown recipients or one time patient communications.

Privacy Versus Compliance in Free Encrypted Email

Privacy and compliance are related but distinct goals. Free encrypted email delivers strong privacy for personal use. It does not deliver compliance for regulated business use.

Privacy means the provider cannot read the message and the message is encrypted in transit and at rest. Free tiers from Proton, Tuta, and Mailfence meet that bar for user to user mail on the same platform.

Compliance under HIPAA, GDPR for healthcare, or other regulated frameworks requires documented safeguards, audit logs, retention controls, and a signed contract with the vendor. The free tiers do not offer these controls. Even the encryption strength does not fix that gap.

See the HHS HIPAA Security Rule reference for the full compliance backdrop. Healthcare users need a signed BAA before sending PHI over any email service, encrypted or not.

Deciding When to Upgrade From Free

A free encrypted email account is a good starting point. Certain triggers signal the moment to move to a paid plan or a dedicated service.

The mailbox stores protected health information or other regulated data.
Outbound volume exceeds the free tier daily cap.
Storage utilization crosses 80 percent of the free allowance.
Business credibility requires a custom domain address.
The team needs desktop client access through Outlook, Apple Mail, or Thunderbird via IMAP or SMTP.
Multiple team members need access to the same set of encrypted addresses.

Paid Proton, Tuta, or Mailfence plans lift most of the caps. A dedicated encrypted email service adds a BAA and one click delivery for regulated workflows without changing the existing mailbox provider.

Sibling coverage on the practice building side sits at healthcare website security features for the wider control set that pairs with encrypted email in a healthcare deployment.

[mh_faqs]

January 5, 2026July 7, 2026

Encrypted Email Providers Compared for Personal and Healthcare Use

encrypted email providers guide featured image

[mh_key_takeaways]

Encrypted email providers fall into three groups. Consumer end-to-end providers run a full replacement inbox. Business-tier platforms layer encryption on standard business mail. HIPAA-focused services add encryption and compliance controls on top of existing Gmail or Outlook accounts.

This guide covers the main providers in each group, the trade-offs on price and recipient experience, and where a dedicated encrypted email service fits the healthcare use case.

The right choice depends on the existing mail platform, the compliance requirements, and the tech literacy of the recipient population. There is no single best provider across all buyers.

Three Categories of Encrypted Email Providers

Consumer end-to-end providers include ProtonMail and Tuta. Both offer full replacement inboxes with encryption built in between users of the same platform. Both are based in Europe with strong privacy positioning.

Business-tier platforms include Microsoft 365 with Purview Message Encryption and Google Workspace with client-side encryption. Both layer encryption on the existing business mail platform and include a BAA available for HIPAA scenarios.

HIPAA-focused services include Mailhippo and similar tools that work alongside an existing Gmail or Outlook account. They add encryption, the BAA, and compliance controls without replacing the underlying mail platform.

The categories address different buyers. Consumer providers fit personal privacy needs. Business platforms fit organizations with an existing Microsoft or Google investment. HIPAA services fit practices needing compliance without an enterprise upgrade.

Free Encrypted Email Options Are Limited

Free encrypted email is available from ProtonMail Free and Tuta Free. Both offer limited storage and outbound volume that fit personal use but not business use.

ProtonMail Free offers 500 megabytes of storage and 150 outbound messages per day. Tuta Free offers 1 gigabyte of storage and 200 outbound messages per day. Both hit the limits quickly under any professional use.

Free tiers do not include a business associate agreement. Practices needing HIPAA compliance cannot use a free consumer account regardless of the encryption strength. The BAA is a separate contractual matter.

Personal Gmail, personal Outlook, and free Yahoo accounts do not offer true message-level encryption. Gmail’s confidential mode and Outlook’s basic TLS provide partial protection but do not meet HIPAA transmission requirements on their own.

encrypted email providers in article illustration one

Consumer Providers Focus on End-to-End Encryption

ProtonMail runs a full end-to-end encryption model between users of the ProtonMail platform. Messages between two ProtonMail accounts encrypt automatically. Users hold the keys client-side.

Tuta uses a similar end-to-end model between Tuta accounts. The company runs its own encryption stack and cannot decrypt user messages. Both providers publish their code as open source.

External recipients on non-ProtonMail or non-Tuta accounts receive a password-protected link. The sender shares the password through a separate channel. This creates friction for reaching regular Gmail or Outlook users.

Consumer providers fit users who value privacy and who correspond primarily with other users of the same platform. Business users sending to patients on standard email addresses often find the friction too high for daily use.

Microsoft 365 and Google Workspace Cover Business Encryption

Microsoft 365 Business Premium and higher plans include Purview Message Encryption. The sender clicks Options, then Encrypt, in the Outlook compose ribbon. Purview handles the delivery and the recipient portal.

Google Workspace Enterprise Plus and Education Plus include client-side encryption. The sender clicks a lock icon in the Gmail compose window. Content encrypts in the browser before it reaches Google servers. Keys stay outside Google through a customer-controlled key service.

Both platforms sign a BAA for business tenants. The BAA covers the platform’s handling of PHI processed on behalf of the covered entity. Consumer tiers of both platforms do not include the BAA.

Detailed setup for Microsoft Purview is in the Microsoft support guide for encrypted messages. Google client-side encryption setup is in the Google Admin console.

[mh_example]

Provider Comparison at a Glance

The table below summarizes the main providers across price, encryption method, HIPAA support, and recipient experience.

Provider	Encryption Method	HIPAA BAA	Recipient Experience
ProtonMail	End-to-end (same-platform)	Business tier only	Password portal for external
Tuta	End-to-end (same-platform)	Not standard	Password portal for external
Microsoft 365 Purview	Portal-based (server encrypts)	Yes on business tenant	Portal sign-in or passcode
Google Workspace CSE	Client-side (browser encrypts)	Yes on business tenant	Portal with key service
Mailhippo	Gateway encryption	Yes in base plan	One-click portal, no account

The comparison highlights that recipient experience varies more than encryption strength. All five options provide strong encryption. The difference is what the recipient has to do to read the message.

encrypted email providers in article illustration two

HIPAA Email Providers Bundle Compliance Into the Plan

HIPAA email providers such as Mailhippo bundle encryption, the BAA, access logs, and recipient portal into a single plan. The buyer does not have to piece together the compliance stack from separate components.

The service works alongside an existing Gmail or Outlook account. The sender writes mail in the familiar interface. Outbound mail routes through the encryption gateway. The recipient gets a one-click portal to read the message.

The BAA is signed as part of onboarding. The access logs run automatically. Practices without dedicated IT get the full compliance stack without configuring individual pieces.

The trade-off is a routing dependency on the service. Outbound mail runs through the service infrastructure. Uptime and continuity of the service become part of the practice’s operational picture.

Recipient Experience Drives Adoption for Patient Communication

The recipient experience matters more for patient communication than for internal or business partner mail. Patients have varying tech literacy. A workflow that requires the patient to install a certificate or exchange a password fails at the population level.

The one-click portal experience matches how patients already use online banking, telehealth, and pharmacy portals. The recipient clicks a link, verifies identity with a one-time passcode or sign-in, and reads the message.

Providers that offer this experience include Microsoft 365 Purview and dedicated HIPAA services. ProtonMail and Tuta external delivery requires more steps. S/MIME requires a certificate on the recipient side, which rules it out for patient use in almost all cases.

Practices building patient communication workflows should test the recipient view before selecting a provider. The sender view is not the recipient view. A five-minute test with a patient using a personal Gmail account reveals what the actual experience will be.

[mh_protip]

Cost Differences Between Provider Categories

Pricing varies by category and by tier within each category. The list below shows current price ranges for each option.

ProtonMail personal plans start around $4 per month with additional storage and features.
Tuta personal plans start around $3 per month with similar tiering.
Microsoft 365 Business Premium is $22 per user per month including Purview Message Encryption.
Google Workspace Enterprise Plus starts around $30 per user per month for client-side encryption.
Dedicated HIPAA email services range from $10 to $25 per user per month depending on volume and features.

Practices already on Microsoft 365 or Google Workspace often find the incremental cost of adding encryption is a plan upgrade rather than a new subscription. Practices without an existing platform find a dedicated HIPAA service more cost-effective per seat.

HIPAA Compliance Beyond the Encryption Provider

The encryption provider covers one part of the HIPAA compliance picture. The covered entity is still responsible for the surrounding controls: access logging, workforce training, incident response, and correct configuration.

The HHS Security Rule guidance lays out the framework. Encryption is one required technical safeguard. Administrative and physical safeguards remain separate obligations.

Practices building the full posture around encrypted mail also need to cover the site, patient portal, and intake forms. See the guide on healthcare website security features for the site-side controls.

The email provider handles the mail. The site handles the intake. The portal handles the ongoing care communication. Together they form the compliant digital footprint.

Choosing a Provider Comes Down to Five Factors

The choice among providers comes down to five factors. Existing mail platform in use. Volume of encrypted mail sent. HIPAA or other compliance requirements. Recipient population and tech literacy. Budget for licensing or subscription.

Practices already on Microsoft 365 or Google Workspace often add encryption at the platform level. The incremental cost is an upgrade. The workflow stays inside the existing tools.

Practices without a business mail investment often pick a HIPAA-focused service. The service bundles encryption, BAA, and portal into one plan. No enterprise upgrade required.

Consumer providers fit personal use and cross-provider testing. Business users typically outgrow the free tiers within weeks. Related reading covers specific provider comparisons: best encrypted email providers, secure encrypted email providers, encrypted email, best free encrypted email providers, hipaa encrypted email healthcare providers, and free hipaa compliant email providers.

Practices pairing the encryption provider decision with a wider healthcare digital strategy work with a healthcare marketing agency that coordinates mail, site, and portal into a single compliant footprint.

[mh_faqs]