I have used both. Both are good. Tuta doesn't support pgp as people said, but I think you'll find that the amount of people you will interact with that can and want to use pgp encrypted email is slim.

The way tuta works is you can send and receive regular email. And when you send it encrypted, the recipient gets a regular email that's says something like"you received a confidential email" (you can edit the text). That person then follows a link in the email and you need to provide them with a password (ideally you provide this password out of band... by text or chat or something... but you can of course just send by regular email).

After they log in, they are basically on a limited web interface to tuta where they can only exchange emails with you (but they can see every email between the two of you in their "inbox).

It's a pretty good system. There is also encrypted calendar and contacts. They have webmail of course and also apps. There's a dedicated calendar app.

Mailbox.org is actually more of a full office suite at this point. The web interface isn't as tight and can be confusing. They can handle your pgp keys or you can do it yourself. You need to decide if you care about trusting someone else with your keys. I actually still have my mailbox.org address because I like the domain. It forwards to my tuta email.

Oh yeah, tuta also allows you to use any of a number of their domains or you can bring your own (pricing may vary). They also have aliasing and catch-all addresses for custom domains.

Both are based in Germany for what it's worth. German privacy laws are pretty strict. For any law enforcement to be granted access to any of your stuff there needs to be a court hearing. They have a warrant canary and transparency report here https://tuta.com/blog/transparency-report .

Also, because tuta is end to end encrypted, all they can release is encrypted data. There's is more of an explanation at the bottom of that transparency report post about what can be requested and what data they even have on users. Mailbox.org might have similar policies but I haven't taken the time to find them.

One thing I will note is that tuta has HSTS enabled I believe so if you're behind a corporate firewall that does certificate snooping by way of MITM when you try to access, it won't connect.

Posteo rocks.

Posteo

Mailbox.org is great, their webmail setup is good and has contacts and calendar and all the things you would expect to have. With Cal/CardDAV and ActiveSync support too.

If you want a compatible, interoperable email service, then Mailbox. Tutanota is a propietary, centralised email system.

Tutanota for max security (no imap/pop3 support). Other services for using IMAP/POP3. But really, you shouldn't be using email anyway if your goal is max security and privacy, simplex.chat is better for that.

Take a look into Posteo if having a custom domain is something you can live without.

People not talking about Startmail or Disroot. Not good options?

~~Mailbox.org offers 2GB of space for their free tier~~, and Tuta is 1GB.

But I would just look at the recommendations on privacyguides.org. They break down what each service does well and what things you should know, like how Mailbox uses PGP and Tuta uses some other (valid) encryption method.

Edit: Could have sworn Privacy Guides said Mailbox had a free tier.

As far as I’m aware, there is a huge difference between these three in that Mailbox.org is not end-to-end encrypted. So if that is an important feature for your use case, that may disqualify them from your options.

I don't know mailbox.org but tuta will try to upsell you, eventually. It's going down the same path as Proton is so maybe stay away from it if you want to get away from Proton.