With Tutanota encryption is done locally, on the client device, secured with a user’s own password (so that also needs to be strong, and their own devices need to defended from malware to ensure email security), before being uploaded and sent to the recipient via Tutanota’s servers, and then decrypted on the recipient’s device.
Tutanota is not privy to users’ passwords (there’s no password reset option) so it says there is no way for it, as the email service provider, to be able to decrypt the data it’s sending. Which means it can’t be strong-armed by governments to hand over data. Nor is it data-mining your emails to sell intel to advertisers.
“We use end-to-end encryption. That means if you encrypt some data it’s always encrypted on the client, so in the browser, in the app, and it cannot be decrypted except by the person this data was encrypted for,” says Möhle. “This decryption again happens on the client. So if you send an email this email is encrypted on your client, sent through the Tutanota service and is then decrypted on the receiving client again.
To further user trust, it open sourced its software last year to allow for community review. And notes it has also subjected its system to cryptographic peer review by German penetration testing firm SySS.
