Tuta, formerly Tutanota, is an end-to-end encrypted email app and a

freemium Freemium, a portmanteau of the words "free" and "premium", is a pricing strategy by which a basic product or service is provided free of charge, but money (a premium) is charged for additional features, services, or virtual (online) or physical ( ...

secure email service. The service is advertisement-free; it relies on donations and premium subscriptions. As of June 2023, Tutanota's owners claimed to have over 10 million users of the product. The company announced a transition to 100% renewable electricity in March 2019. This decision coincided with employee participation in

Fridays for Future Fridays for Future (FFF), also known as the School Strike for Climate ( ), is an international movement of school students who skip Friday classes to participate in demonstrations to demand climate change mitigation, action from political le ...

protests. On 1st October 2024, Tuta launched its standalone encrypted calendar app. Tuta Mail has recently integrated post-quantum cryptography features through its new protocol - ''TutaCrypt'' replacing standard encryption methods like

RSA-2048 In mathematics, the RSA numbers are a set of large semiprimes (numbers with exactly two prime factors) that were part of the RSA Factoring Challenge. The challenge was to find the prime factors of each number. It was created by RSA Laboratories i ...

and

AES-256 The Advanced Encryption Standard (AES), also known by its original name Rijndael (), is a specification for the encryption of electronic data established by the U.S. National Institute of Standards and Technology (NIST) in 2001. AES is a variant ...

for its newly created accounts after March 2024.

History

Tutanota is derived from Latin and contains the words "

tuta Tuta may refer to: Geography * Tuta, Boyacá, a municipality in Boyacá Department, Colombia *Tuta, a village in Târgu Trotuș Commune, Bacău County, Romania People *Frederick Tuta (1269–1291), Margrave of Landsberg * Mladen Naletilić Tuta (1 ...

" and " nota" which means "secure message". Tutao GmbH was founded in 2011 in Hanover, Germany. The goal of the developers for Tuta is to fight for email privacy. Their vision gained even more importance, when

Edward Snowden Edward Joseph Snowden (born June 21, 1983) is a former National Security Agency (NSA) intelligence contractor and whistleblower who leaked classified documents revealing the existence of global surveillance programs. Born in 1983 in Elizabeth ...

revealed

NSA The National Security Agency (NSA) is an intelligence agency of the United States Department of Defense, under the authority of the director of national intelligence (DNI). The NSA is responsible for global monitoring, collection, and proces ...

's mass surveillance programs like

XKeyscore XKeyscore (XKEYSCORE or XKS) is a secret computer system used by the United States National Security Agency (NSA) for searching and analyzing global Internet data, which it collects in real time. The NSA has shared XKeyscore with other intelligen ...

in July 2013. Since 2014, the software has been open-sourced and can be reviewed by outsiders on

GitHub GitHub () is a Proprietary software, proprietary developer platform that allows developers to create, store, manage, and share their code. It uses Git to provide distributed version control and GitHub itself provides access control, bug trackin ...

. In August 2018, Tuta became the first email service provider to release their app on

F-Droid F-Droid is a free and open source app store and software repository for Android (operating system), Android, serving a similar function to the Google Play store. The main repository, hosted by the project, contains only free software, free and o ...

, removing all dependence on proprietary code. This was part of a full remake of the app, which removed dependence on GCM for notifications by replacing it with SSE. The new app also enabled search,

2FA Multi-factor authentication (MFA; two-factor authentication, or 2FA) is an electronic authentication method in which a user is granted access to a website or application only after successfully presenting two or more distinct types of evidence ...

and got a new reworked user interface. In November 2020, the Cologne court ordered monitoring of a single Tuta account that had been used for an

extortion Extortion is the practice of obtaining benefit (e.g., money or goods) through coercion. In most jurisdictions it is likely to constitute a criminal offence. Robbery is the simplest and most common form of extortion, although making unfounded ...

attempt. The monitoring function should only apply to future unencrypted emails this account receives and it will not affect emails previously received. On 7 November 2023, Tutanota announced it was rebranded to simply 'Tuta'. The former domain name tutanota.com now redirects to the shorter tuta.com. On 11 November 2023, it was alleged that Tuta was being used as a honeypot for criminals with a

backdoor A back door is a door in the rear of a building. Back door may also refer to: Arts and media * Back Door (jazz trio), a British group * Porta dos Fundos (literally “Back Door” in Portuguese) Brazilian comedy YouTube channel. * Works so tit ...

from authorities. An ex-

RCMP The Royal Canadian Mounted Police (RCMP; , GRC) is the Law enforcement in Canada, national police service of Canada. The RCMP is an agency of the Government of Canada; it also provides police services under contract to 11 Provinces and terri ...

officer, Cameron Ortis, testified that the service was used as a storefront to lure criminals in and gain information on those who fell for it. He stated authorities were monitoring the whole service, feeding it to

Five Eyes The Five Eyes (FVEY) is an Anglosphere intelligence alliance comprising Australia, Canada, New Zealand, the United Kingdom, and the United States. These countries are party to the multilateral UKUSA Agreement, a treaty for joint cooperat ...

, which would disperse it back to the RCMP in order to gain more knowledge about the criminal underground. However, no evidence was ever presented to back up this statement, and Tuta refuted the claim.

Services

Tuta Mail

"Tuta Mail" is Tuta’s initial and primary service. Tuta Mail is a fully end-to-end encrypted email service available for download on Android (Google, F-Droid, apk) and iOS. Tuta Mail has email clients for Linux, Windows and macOS. It can also be accessed through web browser. In 2024 Tuta introduced quantum-resistant algorithms in a hybrid protocol similar to

Signal A signal is both the process and the result of transmission of data over some media accomplished by embedding some variation. Signals are important in multiple subject fields including signal processing, information theory and biology. In ...

to protect the data against future attacks from

quantum computers A quantum computer is a computer that exploits quantum mechanical phenomena. On small scales, physical matter exhibits properties of both particles and waves, and quantum computing takes advantage of this behavior using specialized hardware. C ...

Tuta Calendar

The "Tuta Calendar" is encrypted with

post-quantum cryptography Post-quantum cryptography (PQC), sometimes referred to as quantum-proof, quantum-safe, or quantum-resistant, is the development of cryptographic algorithms (usually public-key algorithms) that are currently thought to be secure against a crypt ...

. The Tuta Calendar was first released as an integrated calendar in Tuta Mail. In October 2024, Tuta released it as a stand-alone calendar app available for iOS and Android.

Pricing

Tuta has a free plan that comes with 1GB of storage and one calendar. Paid plans include the most popular 'Revolutionary' plan for 3€/month that comes with 20GB of storage, unlimited calendars, and 15 addresses, and also the 'Legend' plan for 8€/month that includes 500GB of storage and 30 addresses.

Encryption

When a user registers on Tuta, a private and public key is generated locally on their device. The private key is encrypted with the user's password before being sent to Tuta’s servers. User passwords are hashed using

Argon2 Argon2 is a key derivation function that was selected as the winner of the 2015 Password Hashing Competition. It was designed by Alex Biryukov, Daniel Dinu, and Dmitry Khovratovich from the University of Luxembourg. The reference implementation o ...

and

SHA256 SHA-2 (Secure Hash Algorithm 2) is a set of cryptographic hash functions designed by the United States National Security Agency (NSA) and first published in 2001. They are built using the Merkle–Damgård construction, from a one-way compression ...

. Emails between Tuta users are automatically encrypted end-to-end. For emails sent to external recipients, a password must be exchanged for

symmetric encryption Symmetric-key algorithms are algorithms for cryptography that use the same cryptographic keys for both the encryption of plaintext and the decryption of ciphertext. The keys may be identical, or there may be a simple transformation to go between t ...

. Tuta also encrypts subject lines and attachments of emails and calendars with metadata and search indexes. The email addresses of users, as well as those of senders and recipients, are stored in plain text. The

timestamps A timestamp is a sequence of characters or encoded information identifying when a certain event occurred, usually giving date and time of day, sometimes accurate to a small fraction of a second. Timestamps do not have to be based on some absolu ...

indicating when an email was sent or received are also not encrypted. Tuta uses a standardized, hybrid method consisting of a symmetrical and an asymmetrical algorithm - AES with a length of 256 bit and RSA with 2048 bit. To external recipients who do not use Tuta a notification is sent with a link to a temporary Tuta account. After entering a previously exchanged password, the recipient can read the message and reply end-to-end encrypted. Tuta Mail uses

features through its new protocol, ''TutaCrypt'' for its newly created accounts after March 2024. TutaCrypt combines traditional encryption methods with quantum-resistant algorithms to secure communications. It replaces the previous RSA-2048 keys with two new key pairs: Elliptic Curve Key Pair: ''Utilizes the X25519 curve for the

Elliptic Curve Diffie-Hellman In mathematics, an ellipse is a plane curve surrounding two focus (geometry), focal points, such that for all points on the curve, the sum of the two distances to the focal points is a constant. It generalizes a circle, which is the special ty ...

(ECDH) key exchange.'' Kyber-1024 Key Pair: ''Implements post-quantum key encapsulation using the

CRYSTALS-Kyber Kyber is a key encapsulation mechanism (KEM) designed to be resistant to cryptanalytic attacks with future powerful quantum computers. It is used to establish a shared secret between two communicating parties without an ( IND-CCA2) attacker in th ...

algorithm.'' TutaCrypt employs AES-256 in CBC mode alongside

HMAC-SHA-256 In cryptography, an HMAC (sometimes expanded as either keyed-hash message authentication code or hash-based message authentication code) is a specific type of message authentication code (MAC) involving a cryptographic hash function and a secr ...

for authenticated symmetric encryption. And the transition to TutaCrypt for old existing user accounts created before March 2024, will occur in December 2024. Tuta also stated that it does not use

PGP PGP or Pgp may refer to: Science and technology * P-glycoprotein, a type of protein * Pelvic girdle pain, a pregnancy discomfort * Personal Genome Project, to sequence genomes and medical records * Pretty Good Privacy, a computer program for the ...

due to its limitations in encrypting subject lines and lack of flexibility for algorithm updates.

S/MIME S/MIME (Secure/Multipurpose Internet Mail Extensions) is a standard for public-key encryption and signing of MIME data. S/MIME is on an IETF standards track and defined in a number of documents, most importantly . It was originally developed by ...

is also avoided due to critical vulnerabilities identified in 2018.

Reception

Reviews of Tech websites were generally positive for Tuta. In July 2023,

TechRadar ''TechRadar'' is an online technology publication owned by Future plc. It has editorial teams in the United States, United Kingdom, and Australia that provide news and reviews of tech products and gadgets. It was launched in 2008 and expanded t ...

praised Tuta Mail as an "Excellent encrypted email platform" focusing on its broad features and intuitive design. However, it criticized the limitations in customer support and the cost of additional storage. In June 2024,

PCMag ''PC Magazine'' (shortened as ''PCMag'') is an American computer magazine published by Ziff Davis. A print edition was published from 1982 to January 2009. Publication of online editions started in late 1994 and continues . Overview ''PC Magaz ...

highlighted Tuta for its strong encryption and user-friendly interface with a rating of 4 out 5. CyberNews rated 4.6 overall, but criticized Tuta for its lack of

and

IMAP In computing, the Internet Message Access Protocol (IMAP) is an Internet standard protocol used by email clients to retrieve email messages from a mail server over a TCP/IP connection. IMAP is defined by . IMAP was designed with the goal of per ...

support. Also it pointed out Tuta's Headquarters -

Germany Germany, officially the Federal Republic of Germany, is a country in Central Europe. It lies between the Baltic Sea and the North Sea to the north and the Alps to the south. Its sixteen States of Germany, constituent states have a total popu ...

as a drawback for being a part in Fourteen Eyes Alliance.

Future

Tuta is working on a

cloud storage Cloud storage is a model of computer data storage in which data, said to be on "the cloud", is stored remotely in logical pools and is accessible to users over a network, typically the Internet. The physical storage spans multiple servers (so ...

platform named "TutaDrive" with a focus on

. The project, officially named "PQDrive - Development of a Post-Quantum Encrypted Online Storage," is funded by the German government's KMU-innovativ program (€1.5 million), which supports

Small and medium-sized enterprises Small and medium-sized enterprises (SMEs) or small and medium-sized businesses (SMBs) are businesses whose personnel and revenue numbers fall below certain limits. The abbreviation "SME" is used by many national agencies and international organiza ...

(SMEs) like Tuta. The project receives further support through a €600,000 collaboration with the

University of Wuppertal The University of Wuppertal (''Universität Wuppertal'') is a German scientific institution located in Wuppertal in the state of North Rhine-Westphalia, Germany. The university's official name in German is ''Bergische Universität Wuppertal'' ...

, which will play a key role in

research and development Research and development (R&D or R+D), known in some countries as OKB, experiment and design, is the set of innovative activities undertaken by corporations or governments in developing new services or products. R&D constitutes the first stage ...

Account deletion

Tuta deletes free accounts that have not been logged into for 6 months. According to Tuta, this happens because of security reasons and for keeping the service free. Tuta has also been

GDPR The General Data Protection Regulation (Regulation (EU) 2016/679), abbreviated GDPR, is a European Union regulation on information privacy in the European Union (EU) and the European Economic Area (EEA). The GDPR is an important component of ...

compliant since 2018.

Censorship

Tuta has been blocked in Egypt since October 2019, and blocked in Russia since February 2020 for unknown reasons (although believed to be tied to actions against services operating outside of the country, especially those that involve encrypted communications).

References

External links

* {{Official website, https://tuta.com Cross-platform software Free security software Free software webmail Internet properties established in 2011 Secure communication Software using the GNU General Public License Free software programmed in TypeScript Free software programmed in JavaScript