Email Is a Postcard
Email was never built to keep secrets. Encrypt what you can, hide your real address behind aliases, and move private conversations somewhere better.
Email is a postcard. It passes through your provider, the recipient's provider and often a spam filter or two along the way, and by default any of them can read it. Encryption add-ons help, but they can't fix the design underneath.
So treat email as what it's good at: receiving receipts, notifications, verification codes and password resets. For private conversations with people, use a messenger built for it, like Signal.
When you do need email, here's how to harden it.
Encrypt the contents with PGP
OpenPGP is the open standard for end-to-end encrypting email between any providers. You publish a public key; people encrypt to it; only your private key can open the message. The two main implementations are GnuPG (desktop and command line, on Windows via Gpg4win, on macOS via GPG Suite) and OpenPGP.js (used inside webmail and browser tools).
The basics with GnuPG:
# create your key pair
gpg --full-generate-key
# export your public key to share
gpg --armor --export you@example.com > you.asc
# encrypt a file to someone, decrypt one sent to you
gpg --encrypt --armor -r friend@example.com message.txt
gpg --decrypt message.txt.asc
The easier route is a client that handles this for you. Thunderbird has OpenPGP built in on desktop; its Android app (formerly K-9 Mail) handles it through OpenKeychain. Encrypted providers like Proton Mail, mailbox.org and Tuta encrypt automatically between their own users.
The big limitation: PGP has no forward secrecy. If a private key is ever stolen, every past message encrypted to it can be read. Messengers like Signal rotate keys constantly so one leak doesn't expose your history. That's why they're better for conversations.
Businesses sometimes use S/MIME instead. It's built into Apple Mail, Outlook and Google Workspace, but needs a certificate from a certificate authority (often paid yearly), and it has the same forward-secrecy problem.
Let people find your key: WKD
Web Key Directory lets a mail client look up a recipient's public key from their email domain and encrypt automatically. Proton Mail and mailbox.org publish keys for their users. On your own domain, the simplest setup is keys.openpgp.org's WKD as a Service: upload your key there and add one DNS record:
openpgpkey.example.com. CNAME wkd.keys.openpgp.org.
Shared addresses like @gmail.com can't publish keys this way.
Guard your private key
A private key on an infected laptop is a stolen key waiting to happen. A smart card such as a YubiKey or Nitrokey keeps the key on the device: encrypted mail goes in, plaintext comes out, and the key itself never touches your computer.
Log in safely: OAuth, not plain passwords
Any provider that supports IMAP and SMTP works with a desktop client, but how you sign in matters. A plain app password skips two-factor authentication entirely. Prefer clients and providers that sign in with OAuth, which goes through the provider's normal login, 2FA included. Proton users connect desktop clients through the Proton Mail Bridge instead.
Metadata stays exposed
Even a perfectly encrypted email leaks its headers: who sent it, who received it, when, and usually the subject line, plus hidden headers that can reveal more about your setup. They have to stay readable or the mail can't be delivered. TLS hides them from eavesdroppers on the wire, but every server handling the message, your provider included, sees them. PGP can't fix that.
Hide your real address: aliases and forwarding
The best way to protect an inbox is to stop giving out its address. An alias service creates a unique forwarding address for each site, delivers the mail to your real inbox, and lets you reply without revealing it:
- SimpleLogin — open source, now part of Proton.
- addy.io — open source, generous free tier, custom domains.
- Firefox Relay — from Mozilla, integrates with Firefox.
- Hide My Email — Apple's version, included with iCloud+.
One alias per service means a breach or spam flood points straight at the culprit. Switch that alias off and the problem is gone, while your real address never leaked. Combined with deleting old accounts, it keeps your inbox's footprint small.
Postcards are fine for receipts. For anything private, put it in an envelope, or send it another way.