Tuta — End-to-End Encrypted Email and Calendar

Introduction

Tuta provides email and calendar services where all content is encrypted end-to-end before leaving the client. Unlike conventional email providers that can read server-stored messages, Tuta ensures that encryption and decryption happen exclusively on the user's device, making it suitable for privacy-conscious individuals and organizations.

What Tuta Does

• Encrypts all emails, attachments, contacts, and calendar entries end-to-end on the client
• Sends encrypted messages to external recipients who decrypt via a shared password and web link
• Provides a full-featured email client with folders, search, labels, and filters
• Includes an encrypted calendar with event sharing and scheduling capabilities
• Offers native apps for iOS, Android, Windows, macOS, and Linux alongside the web client

Architecture Overview

Tuta is built with TypeScript and uses a custom encryption protocol based on AES-256 and RSA-2048 (with post-quantum encryption via Kyber in development). All encryption and decryption happens in the client; the server stores only ciphertext and metadata required for delivery. The web client is a single-page application, and native desktop apps are built with Electron. The backend runs on Tuta's infrastructure, though the client source code is fully open for audit. Search works on encrypted data using a local encrypted index built on the client.

Self-Hosting & Configuration

• The client is fully open source and can be built from the GitHub repository
• Server-side infrastructure is not available for self-hosting; the service runs on Tuta's servers
• Build the web client with Node.js for local inspection or custom deployments of the frontend
• Desktop clients are built using Electron and can be compiled from source
• Configure custom domains, catch-all addresses, and user management through the admin console

Key Features

• Zero-knowledge architecture where the provider cannot access user data
• Encrypted search using a client-side index that never exposes search terms to the server
• Send encrypted emails to any external recipient via password-protected links
• Post-quantum encryption in development to protect against future quantum computing threats
• Ad-free and tracker-free with a sustainable business model based on paid plans

Comparison with Similar Tools

• ProtonMail — also offers E2E encrypted email; Tuta encrypts more metadata and includes an encrypted calendar
• Gmail/Outlook — mainstream providers with server-side access to content; Tuta encrypts everything client-side
• Thunderbird — desktop email client without built-in E2E encryption; Tuta provides encryption by default
• SimpleLogin — email alias service for privacy; Tuta is a full encrypted email provider

FAQ

Q: Can I self-host the Tuta server? A: The client is open source, but the server is not available for self-hosting.

Q: How does encrypted search work? A: Tuta builds an encrypted search index locally on your device, so queries never reach the server in plaintext.

Q: Can I send encrypted emails to non-Tuta users? A: Yes. You set a shared password, and the recipient opens the message via a secure web link.

Q: Is Tuta GDPR compliant? A: Yes. Tuta is based in Germany and fully complies with GDPR and European privacy regulations.

Sources

• https://github.com/tutao/tutanota
• https://tuta.com