Secure email — a practical guide

How to use and write email securely, which mailboxes to use for privacy and anonymity, how to encrypt messages and attachments, and how to share a password safely.

0. Start with your threat model

"Secure" means nothing until you answer: who am I protecting against?

Adversary	Approach
Nosy provider / ads	Proton/Tuta, aliases
Mass surveillance / data breach	E2EE + separate addresses + MFA
Targeted attacker (phishing, SIM-swap)	Hardware key, link hygiene
Law enforcement / court order	Tor, no metadata → consider whether to use email at all

Separate four concepts: privacy (does the provider read your mail), anonymity (can the account be linked to you), confidentiality (is an intercepted message readable), and metadata (who ↔ whom, when, subject, size).

⚠️ Honestly: email was never built for secrecy. Not even PGP hides metadata. For truly confidential/anonymous communication, Signal / SimpleX are better (forward secrecy, less metadata).

1. Good practices

Separate addresses (or aliases)

Main (bank, government, work) · private (family) · shopping · one-off signups. Instead of many accounts, use aliases (SimpleLogin, addy.io, Proton "hide-my-email") — one alias per service, revocable after a leak.

MFA — not all equally strong

Strength order: FIDO2 hardware key (YubiKey) / passkey (phishing-resistant) > TOTP (Aegis, 2FAS — can be phished via AitM) > SMS (last resort, SIM-swap). For important accounts: 2× YubiKey.

Verify the sender and links

Don't trust the display name (it's spoofable) — check the real From domain. Watch for typos and homoglyphs (m1crosoft.com, Cyrillic "а"). Safest: don't click links in unexpected mail — go to the site manually.

Be careful with attachments

Never enable macros; beware .html, .iso, "password-protected zip", and double extensions (invoice.pdf.exe). Never send scans, passwords, keys or financial data in plain text.

2. Mailboxes for privacy

Proton Mail — best compromise. E2EE Proton↔Proton (or PGP), Switzerland, webmail doesn't add your IP. ⚠️ To non-Proton it's TLS-in-transit (not E2EE); subject/metadata not hidden. Switzerland ≠ untouchable — in 2021 Proton handed over IP logs under a court order.
Tuta (Tutanota) — encryption by default, also encrypts the subject. ⚠️ No PGP (E2EE only Tuta↔Tuta or via a password).
Mailbox.org / Posteo / StartMail — cheap, private, with PGP. Riseup — for activists.
Gmail / Outlook — excellent spam protection and account security, but no E2EE by default. Fine for everyday use (with MFA + a password manager).

Self-hosting email is not recommended — deliverability issues and MX blacklists.

3. Anonymous mailboxes

The "Proton + Tor/VPN" model, but with discipline:

› Sign up over Tor (Proton has a .onion), with no real phone/alt-email, paying with crypto/cash or free tier.
› Never mix identities: a separate browser profile / VM / Tails; never log in from the same IP/device as your real one. Writing style, timing and contacts also deanonymize.

⚠️ Disposable inboxes (temp.pm, temp-mail) are public — no password, anyone with the address reads them. Throwaway signups only, never anything important.

Disposable vs alias: temp.pm = public, dies, no replies. An alias (SimpleLogin/addy.io/Proton) = private, yours, revocable, and you can reply. For "hide my address", an alias is usually better.

4. How to encrypt email

PGP (OpenPGP)

A key pair: public (you give to others) + private (only you decrypt). Tools: GPG4Win/Kleopatra, Thunderbird (built-in OpenPGP — Enigmail is gone), Proton (automatic).

⚠️ PGP does not encrypt the subject or metadata, no forward secrecy (a compromised key decrypts all past mail), losing the key = losing access. For conversations use Signal; keep PGP for interop/signatures.

Password-protected message

Proton/Tuta let you send E2EE to a non-user: the message by email, the password over another channel (Signal). Simple and effective.

5. Encrypting attachments (often the best)

7-Zip AES-256 — 7z format (not zip — ZipCrypto is weak), Encryption AES-256, Encrypt file names: YES. (File size still leaks.)
age / gpg -c — modern, simple encryption of single files.
VeraCrypt — a container for larger/sensitive data; hidden volumes = plausible deniability (better for storage than email).
Cryptomator — encrypt before uploading to OneDrive/Google Drive/Dropbox.

⚠️ PDF/Office passwords (older ones) are crackable — use 7z/age. Password: 5-6+ random words (diceware) or a password-manager generator.

6. How to share the password

Rule: a different channel than the file, never the same one. E.g. file → email, password → Signal (or phone / in person). SMS is weak (SIM-swap). Never put the password in the same email or in the file name.

7. Alternatives to email attachments

› OnionShare — files over Tor, E2EE, ephemeral, no account.
› Magic Wormhole — wormhole send file + a one-time code.
› Proton Drive / password-protected share link, Cryptomator + cloud.
› For conversations instead of email: Signal, SimpleX (no identifiers at all).

8. Recommended kits

Everyday: Gmail/Outlook + passkey/key + password manager (Bitwarden / self-hosted Vaultwarden) + aliases (SimpleLogin).
Private communication: Proton/Tuta + Signal.
Confidential files: age or 7-Zip AES-256, password via Signal, delivery via OnionShare/Wormhole.
Anonymity: Tor + Proton (created and used only over Tor) + a separate environment (Tails/VM).
Important accounts: 2× YubiKey.

⚡ TL;DR

Decide who you're protecting against.
Email won't hide metadata — for confidential/anonymous use, consider Signal.
Hardware key > TOTP > SMS.
Aliases instead of your real address; temp.pm for throwaway only (it's public).
Attachments: 7-Zip AES-256 / age, password over a separate channel.
Anonymity: Tor + Proton + a separate environment, never mix identities.

PivLab informational material. The right tools depend on your threat model — if in doubt, get your setup reviewed individually.