Chaos and Order

💡 왼쪽 원문을 읽으면서 오른쪽에 따라 써보세요. Tab 키로 힌트를 받을 수 있습니다.

원문 렌더가 준비되기 전까지 텍스트 가이드로 표시합니다.

Prologue — We still cannot leave email in 2026

It is 2026, and we still cannot leave email. As good as Signal, Telegram, and iMessage are, signing up for any company service, bank notifications, invoices, recruiter outreach, government letters, SaaS receipts — almost anything official starts and ends with one email address. Email has been the internet's identity layer for 30 years.

And that identity layer is held by Gmail. As of 2025, Gmail has more than 1.8 billion active users, and every word we write in an email, every PDF we attach, every contact we exchange is potentially fed into Google's model training and ad targeting (Google has said since 2017 that "Gmail content is not used to personalize ads directly," but metadata, Workspace integration, search, and Calendar are a different story).

This article maps the alternatives. It catalogs which providers in 2026 take privacy seriously, what model they operate on, and who each one is right for. SaaS providers like ProtonMail, Tuta, Mailbox.org, Fastmail, Posteo, Mailfence, StartMail, Hey, Migadu, Runbox, MXroute; self-hosting options like Stalwart, Mail-in-a-box, Maddy, Postal; failed attempts like Skiff; and Korean/Japanese local providers all show up.

Three core shifts.

- **Tuta's post-quantum migration is complete.** TutaCrypt was announced in August 2024, and by Q1 2026 it had been rolled out to all existing users. The first commercial email provider to take post-quantum email seriously.

- **Skiff is gone.** On February 9, 2024, Notion acquired Skiff and shut down mail / docs / calendar / drive six months later. The privacy crowd lost a degree of trust.

- **Stalwart shifted the open-source mail-server landscape.** A modern IMAP/JMAP/SMTP server written in Rust grew explosively from 2024 to 2026. Self-hosting is once again a realistic option.

This piece walks through it all in 12–14 chapters. Aimed at anyone asking "should I leave Gmail."

1. The 2026 privacy email map — three camps

A flat list of tools is impossible to compare. Split them into three camps first.

| Camp | Core model | Representative tools |

| --- | --- | --- |

| **E2EE-first** | Server cannot read bodies / attachments | ProtonMail, Tuta, Mailfence, StartMail |

| **Paid, privacy-friendly** | No ads, no data sale, but E2EE optional | Fastmail, Mailbox.org, Posteo, Hey, Migadu, Runbox, MXroute |

| **Self-hosting / OSS server** | You run the server | Stalwart, Mail-in-a-box, Maddy, Postal, mailcow, Postfix+Dovecot |

It is not a perfect split. Mailbox.org has PGP integration that puts it close to E2EE workflows, and Posteo can encrypt the mailbox itself. But the three camps are the big picture.

**E2EE-first camp** centers on the promise "the server cannot read my mail." The key lives client-side, the server sees only ciphertext. The downside is poor fit with IMAP/POP standard protocols, which usually forces a custom client or a bridge.

**Paid privacy-friendly camp** centers on "we don't run on ads and we don't sell data." E2EE is optional (PGP integration) or absent. In exchange, IMAP/SMTP standards just work, and search / filters / calendar are powerful. Fastmail is the canonical example.

**Self-hosting camp** is a different conversation altogether. "I run my own mail server." Up to the mid-2010s the standard line was "self-hosting email is effectively impossible" (spam filters, large-provider reputation, IP reputation). Mail-in-a-box and Stalwart lowered the bar.

The 2026 trend is **the E2EE camp making peace with standard protocols**. ProtonMail keeps improving IMAP/SMTP bridges, and Tuta polishes the UX of its own mobile and desktop apps. Both are trying to lower the user-resistance to "encryption is great but I can't change my client."

2. ProtonMail — the biggest E2EE, and a super-app ambition

ProtonMail launched in 2014 in Switzerland. Founders came out of CERN, and from day one the two pillars were "Swiss jurisdiction + E2EE." As of 2026 it has over 100 million registered users, runs as a nonprofit (Proton AG foundation structure), and is effectively the category-defining player.

**Why ProtonMail won.** Three decisions mattered.

1. **E2EE as the default.** Bodies and attachments encrypted with the user's key, stored that way on the server. Between Proton users it is automatic; for external mail there is the optional password-protected message.

2. **Swiss jurisdiction.** One step removed from EU/US legal pressure. Swiss courts can still order disclosure — but only of metadata (IP, login times); bodies remain encrypted and unreadable.

3. **Super-app expansion.** Between 2020 and 2026, Proton Drive, Proton Calendar, Proton VPN, Proton Pass (password manager), and Proton Wallet (Bitcoin) all shipped. A "privacy super-app" positioning.

**2026 pricing.** Mail Plus is $4.99/month (about $3.99 with annual discount), Proton Unlimited is $12.99/month (Mail + Drive + VPN + Pass bundle), Business starts at $7.99 per user per month, Visionary is $29.99/month (family). Free plan now has 1GB storage and 1 mail address (up from 0.5GB in 2023).

**Audits.** Proton runs regular security audits. Securitum in 2023 (Mail/Calendar/Drive integration), Cure53 in 2024 (Pass), Securitum again in 2025 across the full infrastructure. Reports are published as public PDFs. Among E2EE providers, ProtonMail is the most transparent in this regard.

**Weaknesses.** First, search is weak. Bodies are encrypted, so the server cannot search; client-side indexing (Encrypted Search) is heavy on mobile. Second, using standard IMAP/SMTP clients requires Proton Bridge, a desktop app available only on macOS / Windows / Linux — there is no mobile bridge. Third, the price is higher than EU alternatives like Mailbox.org or Posteo.

**When ProtonMail.**

- Seriously want Swiss jurisdiction + E2EE → ProtonMail.

- Want VPN, Drive, Pass bundled → Proton Unlimited.

- Must use standard IMAP clients (Apple Mail, Thunderbird) including mobile → Fastmail or Mailbox.org may fit better.

- Company domain + multiple users → Proton Business or Mailbox.org Business.

3. Tuta (formerly Tutanota) — post-quantum pioneer

Tuta is based in Hanover, Germany. Started in 2011 as Tutanota, rebranded to Tuta in November 2023. As of 2026 it has over 10 million users globally.

**Core differentiator.** Tuta's biggest decision was "we do not use PGP." Instead they built their own standard — subject, body, attachments, contacts, and calendar are all encrypted. PGP cannot hide mail headers and subjects; Tuta can. The downside is incompatibility with PGP users (e.g., ProtonMail users).

**TutaCrypt — the post-quantum migration.** In August 2024, Tuta announced TutaCrypt, a hybrid scheme combining Kyber-1024 (the base for NIST's standardized ML-KEM) with X25519, plus AES-256 and Argon2id. New users got it by default in 2025; existing users were fully migrated by Q1 2026. **The first commercial email provider to actually deploy post-quantum encryption** at scale.

Why this matters: the "harvest now, decrypt later" attack — store ciphertext today and decrypt it once quantum computers are strong enough — is a real threat model. NIST standardized ML-KEM and ML-DSA in August 2024, and Tuta pushed its implementation ahead of that.

**2026 pricing.** Free plan: 1GB, 1 alias. Revolutionary is €3/month (20GB storage, 15 aliases, 1 custom domain). Legend is €8/month. Business starts at €6.5/user/month. Slightly cheaper than ProtonMail.

**Open source.** Tuta clients are GPLv3 and the server is AGPLv3 (since 2014). Self-hosting is not officially supported but the code is on GitHub. ProtonMail open-sources only the clients while the server is closed — Tuta is a step more transparent.

**Weaknesses.** First, no IMAP/SMTP. Only the proprietary clients (web, iOS, Android, desktop). No Thunderbird or Apple Mail integration. Second, migration is hard — the tooling for importing existing Gmail is weaker than ProtonMail's. Third, calendar and contacts exist but Drive and password manager do not — ProtonMail has the bigger super-app ambition.

**When Tuta.**

- Take post-quantum seriously → Tuta.

- Strongly trust German jurisdiction + GDPR → Tuta, Mailbox.org, or Posteo.

- Must have IMAP client → ProtonMail Bridge or Fastmail.

4. Mailbox.org — German business-friendly, the Workspace alternative

Mailbox.org is run by Heinlein Support, based in Berlin. Heinlein has been doing Postfix and Linux mail consulting in Germany since 1992 — the founder (Peer Heinlein) wrote *The Postfix Book*. Mailbox.org launched in 2014.

**Core differentiator.** Mailbox.org bundles "privacy + business workspace." On an OX (Open-Xchange) base, it puts mail, calendar, contacts, tasks, drive, and Office-compatible documents in one place. Positioned as the EU privacy alternative to Google Workspace.

**Encryption.** Mailbox.org offers **mailbox-level encryption with the user's password** (not OpenPGP-level but mailbox-level). Turn it on and incoming mail is encrypted with PGP at rest. PGP key management for outbound mail is also handled inside the webmail.

**2026 pricing.** Mail is €1/month (2GB, 3 aliases). Standard is €3/month (10GB, 25 aliases, Office, Drive). Premium is €9/month (25GB, 50 aliases). Team Business starts at €2.5/user/month. **One of the cheapest business-grade email options in Europe.**

**XMPP.** A lesser-known strength: Mailbox.org accounts include XMPP/Jabber chat. Usable as an internal messenger.

**Weaknesses.** First, the OX-based UI is not as polished as ProtonMail or Fastmail. Second, to take E2EE seriously you handle PGP keys yourself (Mailbox.org helps but it is still demanding for non-technical users). Third, the mobile app is weak — better to use standard IMAP apps (K-9 Mail, Apple Mail).

**When Mailbox.org.**

- Company domain + calendar / docs together → Mailbox.org Business.

- Trust German / EU GDPR → great fit.

- Need E2EE by default → ProtonMail or Tuta better.

5. Fastmail — not E2EE, but the most beloved privacy-friendly option

Fastmail is based in Melbourne, Australia. Founded in 1999, it is one of the longest-surviving independent email providers as of 2026. Australian jurisdiction, but all data centers are in New Jersey, USA.

**Core differentiator.** Fastmail does not do E2EE. Bodies are stored in plaintext (or just disk-level encrypted) on the server. In exchange, Fastmail implements IMAP, CalDAV, CardDAV, and JMAP standards with deep seriousness — in fact, the JMAP (JSON Meta Application Protocol) specs (RFC 8620 / 8621) were authored largely by Fastmail.

What this means in practice: Fastmail is "the fastest, most compatible mail service." Every standard client (Apple Mail, Thunderbird, Outlook, K-9 Mail) just works, server-side search is fast, and calendar / contact sync is smooth across every OS.

**Privacy promises.** Fastmail does not show ads, does not scan mail for model training, and does not sell data. It is funded by subscriptions only. Australian jurisdiction plus US data centers is "not 100% safe from legal coercion," but actual operating policy and transparency reports are far better than Gmail.

**2026 pricing.** Basic is $3/month (2GB, no custom domain). Standard is $5/month (30GB, 1 domain). Professional is $9/month (100GB, multi-domain). Family plans start at $8/month for 4 users. **Annual billing gives a 15% discount.**

**Masked Email.** Fastmail's hidden gem is Masked Email, integrated with 1Password. Generate a unique disposable address per signup, then disable it from the inbox once it starts being abused. Very effective against spam and breach tracking.

**Weaknesses.** First, no E2EE. You cannot manage PGP keys directly either. You have to accept "the server sees the mail." Second, the Australian + US + Five Eyes jurisdiction combination is uncomfortable for some users. Third, the mobile app exists but is not gorgeous (webmail and standard IMAP apps are better).

**When Fastmail.**

- Do not need E2EE, but want "no ads and fast mail" → Fastmail.

- Standard IMAP / CalDAV / CardDAV clients are non-negotiable → Fastmail.

- Five Eyes jurisdictions are a concern → ProtonMail, Tuta, or Mailbox.org.

6. Posteo — €1/month, German open-source feminist mail

Posteo is based in Berlin. Founded in 2009, around 800k users as of 2026, run by a very small team (under 20 people).

**Core differentiator.** Posteo's message is unambiguous. "**€1 per month**, 100% green electricity, mailbox encryption, metadata minimization, anonymous payment (cash accepted)." While other privacy providers chase super-app status, Posteo holds the line on "just mail, calendar, contacts — simple, cheap."

**Mailbox encryption.** Posteo offers PGP-on-receipt encryption (similar to Mailbox.org). Turn it on and incoming mail is encrypted to your mailbox password / PGP key at rest — lose the password and the mail is unrecoverable. There is an additional option to auto-encrypt outgoing mail with PGP if the recipient has published a key.

**Green.** Posteo states explicitly that it runs on 100% renewable energy (Greenpeace Energy). This is a stated company value, not marketing. Over half of users are in Germany; the rest are EU plus other.

**2026 pricing.** **€1/month** — 2GB mailbox, €0.10/month per additional GB, 2 aliases free. A single, very simple plan. Additional aliases at €0.10/month each. Custom domain at €0.10/month. The price has been essentially unchanged since 2009 — still flat in 2026.

**Weaknesses.** First, very few additional tools. No Drive, no super-app, no proprietary mobile app — you use a standard IMAP client (K-9 Mail, Apple Mail). Second, the UI is somewhat dated. Third, business features are weak — not a team fit, more like personal or family use.

**When Posteo.**

- "Mail should be simple, €1/month is enough" → Posteo.

- Care strongly about green / climate values → Posteo.

- Team / company use → Mailbox.org or ProtonMail Business better.

7. Mailfence / StartMail — other European E2EE

These two are not mainstream but have committed user bases.

**Mailfence** — a Belgian provider run by ContactOffice Group. Started in 2013. Key trait: **smooth OpenPGP integration**. Key management, signing, encryption, and decryption all happen inside the webmail (Posteo and Mailbox.org can do this too, but Mailfence is more polished). Belgian jurisdiction. Pricing: Entry €2.5/month, Pro €7.5/month, Ultra €25/month. Weaker on corporate features like SSO, but a strong pick for solo PGP users.

**StartMail** — a Dutch provider. Built by the same team as the Startpage search engine (one of the two privacy meta-search engines, alongside DuckDuckGo). Launched in 2014. Key traits: **unlimited custom aliases** and **PGP integration**. Each new alias is a unique mail address you can use for signups (similar to Fastmail's Masked Email). Pricing: Personal $59.95/year (about $5/month), Custom Domain $89.90/year. Dutch jurisdiction. A small company, but very stable.

**Mailfence vs StartMail.**

| Item | Mailfence | StartMail |

| --- | --- | --- |

| Jurisdiction | Belgium | Netherlands |

| PGP | Polished integration | Polished integration |

| Aliases | Limited | **Unlimited** |

| Pricing (personal) | from €2.5/mo | from $5/mo |

| Drive / Calendar | Drive, calendar, docs | No calendar |

| Strength | Business collaboration tools | Aliases + trust in search team |

For users who find ProtonMail too big or who prefer OpenPGP standards over Tuta's proprietary scheme, these two are solid alternatives.

8. Hey (37signals) — bold pricing, bold UX

Hey was launched by the Basecamp (37signals) team in 2020. David Heinemeier Hansson and Jason Fried built it themselves. It is a different kind of product from the other privacy providers.

**Core differentiator.** Every decision in Hey is centered on "redesigning the email UX." First-time mail goes through a **Screener** that puts senders on a whitelist or blacklist. Mail is auto-classified into **Imbox** (Important + Inbox), **Feed** (newsletters), and **Paper Trail** (receipts). Mails that need a response go in the **Reply Later** stack; mails to revisit go in the **Set Aside** stack. It forces the model "the inbox is not everything."

This is enormously polarizing. Half the users say "email became fun for the first time," the other half say "I can't use my standard client and that's infuriating."

**Privacy.** Hey blocks tracking pixels (open trackers) by default. No ads. Bodies are not used for model training. But no E2EE — the server sees the content. US jurisdiction. Positioned more as "refusing the ad model + blocking trackers" rather than "privacy-first."

**2026 pricing.** **$99/year (about $8.25/month)** — 100GB mailbox. At launch this was provocative. In an era of free mail being the default, Hey nailed down the price tag. Hey for Work is $99/user/year, plus $12/domain. Custom-domain mail splits into **For You ($99/year)** and **For Work (per-domain + per-user)**.

**Weaknesses.** First, no IMAP/SMTP. Only the Hey clients (web, iOS, Android, Mac, Windows). Second, expensive — 2x to 3x other privacy providers. Third, no E2EE. Fourth, frustrating if the "Hey model" doesn't fit you.

**When Hey.**

- You are obsessive about Inbox Zero and email is painful for you → Hey can liberate you.

- You want ad-model refusal and tracker blocking, but don't need E2EE → good pick.

- Cost-sensitive or wedded to IMAP clients → other providers.

9. Skiff (RIP, Notion acquired Feb 2024) — a short reign

Skiff started in 2020. Stanford-rooted founders building a "Notion + ProtonMail" product. E2EE email + documents + calendar + Drive bundled in one workspace. Series A of $10.5M in 2023, fast-growing user base.

**February 9, 2024 — Notion acquisition.** Notion announced the Skiff acquisition. Terms undisclosed. At the same time, Skiff announced the shutdown of all services (mail, docs, calendar, Drive, Pages) within 6 months. Data export tools were provided, along with migration guides to ProtonMail / Tuta / Mailbox.org. By August 2024 every server was offline.

**What was lost.** Skiff Mail had a UX a step above ProtonMail / Tuta. A Notion-like page editor, a lightweight Drive, and very fast search. Gone in six months.

**What survived.** Some functionality merged into Notion. **Skiff Notes → Notion Calendar** (this actually traces back to the separate Cron Calendar acquisition, but the timelines overlapped). Mail did not — Notion did not get into email.

**The lesson, one line.** "E2EE super-app startups" are attractive, but if the company is acquired or fails, users have to migrate everything. The core of a privacy email provider is **trust in long-term operation**, more important than price or features. ProtonMail (nonprofit foundation), Tuta (independent company + open source), Posteo (small but 17 years running), Mailbox.org (Heinlein, 30 years of mail consulting) — they are trusted because **the expectation that they will still be there** is credible.

Most Skiff users migrated to ProtonMail or Tuta. ProtonMail reportedly saw signups grow 20%+ above baseline over 2024 (unofficial, an estimate).

10. Migadu / Runbox / MXroute — other paid options

These three are not mainstream but excel for specific user groups (heavy multi-domain users, the cost-sensitive crowd, international users).

**Migadu** — Swiss company. Founded 2014. Key differentiator: **"unlimited mailboxes, traffic-based billing."** Billing is based on sent mail volume and storage, not on mailbox or alias count. For a small business that wants 5 domains with 10 mailboxes each, Migadu is dramatically cheaper. Micro plan $19/year (5GB personal), Mini $99/year (small team 30GB), Standard $199/year (90GB). No E2EE, but solid IMAP/CalDAV standards, with auto-configured DMARC/DKIM/SPF.

**Runbox** — Norwegian company. Founded 1999 (same year as Fastmail). Norwegian jurisdiction + data centers (Norway is not in the EU but complies with GDPR). Strong green positioning (hydropower). Pricing: Mini $19.95/year, Medium $39.95/year, Max $79.95/year. Unusual structure: **users own 70% of the company** (a user cooperative model).

**MXroute** — US Texas-based, hosting-company origin. Core point: **price**. Lithium $45/year, Helium $75/year, Crypton $90/year — unlimited mailboxes + unlimited custom domains. cPanel-like hosting UI. Not really a privacy provider (US jurisdiction, no ads but no strong policy commitments either). Strong for "I need mail backends for multiple domains."

**Summary of the three.**

| --- | --- | --- | --- |

Migadu is very popular with indie makers and small-business owners who run custom-domain mail seriously without self-hosting. As of May 2026, pricing has barely moved.

11. Stalwart — the modern open-source server (Rust)

Stalwart is an open-source mail server project that started in 2022. **Written in Rust**, it is an integrated IMAP4 + JMAP + SMTP + Sieve + LDAP + WebDAV server. AGPLv3 license. It exploded in 2024–2026, becoming the alternative to the traditional "Postfix + Dovecot + Sieve + OpenDMARC + Rspamd" self-hosting stack.

**Why Stalwart.** A traditional self-hosted mail server requires installing and configuring 5–7 components: Postfix (SMTP) + Dovecot (IMAP/POP) + OpenDKIM (DKIM signing) + OpenDMARC + SpamAssassin / Rspamd (spam) + Sieve (filtering) + LDAP (auth). Each has its own config files, and version compatibility breaks easily.

Stalwart consolidates all of this into **a single binary**. One TOML config file. Its own full-text search; S3 / MinIO / PostgreSQL pluggable as backends. JMAP is a first-class citizen. A modern architecture.

**Features.** Automatic OpenPGP / S/MIME, MTA-STS, DANE, DKIM/SPF/DMARC/ARC, Bayesian / LLM spam filters, Sieve scripts, OAuth 2.0 + OpenID, LDAP/AD integration. WebDAV (CardDAV / CalDAV) was added in 2025.

**2026 operating status.** About 9,000 GitHub stars, the parent Stalwart Labs Ltd monetizes via consulting and Enterprise licensing. Community Edition is fully free. Enterprise adds clustering, HA, and advanced monitoring. Docker images, Helm charts, and systemd units are all available.

**Weaknesses.** First, operational know-how is thin. Postfix has 30 years of accumulated answers; Stalwart has 3. When things go wrong, finding help is harder. Second, the intrinsic difficulties of self-hosting (IP reputation, large-provider reputation, DNS setup) are not solved by Stalwart. Third, AGPLv3 can be a problem for some corporate use cases (Stalwart Labs sells a separate commercial license).

**When Stalwart.**

- Seriously starting mail-server self-hosting → Stalwart or Mail-in-a-box.

- Want a modern single binary with JMAP → Stalwart.

- Battle-tested 25-year stack is safer → Postfix + Dovecot.

12. Mail-in-a-box / Maddy / Postal — different shapes of self-hosting

**Mail-in-a-box** — Started in 2014 by Joshua Tauberer. A one-line install script on Ubuntu 22.04 sets up mail + calendar + contacts + webmail + DNS + SSL automatically. "DigitalOcean droplet + a domain + 5 minutes." The components are battle-tested open source (Postfix, Dovecot, Roundcube, Nextcloud Calendar, etc.) bundled together, so it is stable. Version 68 dropped in May 2026 (Ubuntu 24.04 LTS support). Weaknesses: ARM64 support arrived late (2025), and the design assumes a single host.

**Maddy** — Mail server written in Go, started in 2019. Single binary + single config file. SMTP + IMAP4 + DKIM + DMARC + Sieve. A simpler design than Stalwart (no JMAP, no WebDAV, "mail only"). Light footprint, good for small VPS. As of 2026, still a one-developer (foxcpp) project. About 5,000 GitHub stars.

**Postal** — A transactional mail server built in 2017 by a subsidiary of UK's Krystal Hosting. The alternative to SendGrid / Mailgun / Postmark — **not personal mail but the sending infrastructure for SaaS**. API + queue + tracking (open / click) + webhooks. You use it when you want to host signup mail, password reset mail, and receipts on your own infrastructure. MIT license. Docker Compose one-shot deploy. Traffic grew through 2024–2026 as SendGrid pricing rose.

**Self-hosting comparison.**

| --- | --- | --- | --- |

**One truth.** Self-hosted email is harder than running the mail server itself — **IP reputation and DNS setup are the real difficulty.** Mail sent from your server may land in the Gmail / Outlook spam folder with high probability. You need SPF / DKIM / DMARC / MTA-STS / BIMI all enabled, a static IP (residential IPs are nearly always blocked), and a clean-reputation host (some Hetzner / OVH / Vultr IPs are blocked). Even Mail-in-a-box or Stalwart making install easy does not fix this.

13. Korea — Daum Mail, Naver Mail, Kakao Mail

The Korean market moves differently from the global privacy providers. Most users use Gmail, Naver, Daum, or Kakao mail; companies use Outlook / Exchange or Google Workspace.

**Naver Mail.** The most-used. Naver's unified account ties together other Naver services (NaverPay, Cafe, Blog). Ads are nearly absent, but the policy does not explicitly state that mail bodies are not used for ad-targeting algorithms (terms change regularly). Korean-language UX is the smoothest. POP3 / IMAP, two-factor, mail aliases, custom-domain mail (bundled with Naver Workplace / Naver Cloud) — all available.

**Daum Mail.** Daum has been part of Kakao since 2014. Smaller than Naver but still substantial. Integrated with Kakao account, IMAP / SMTP supported. Some feature reorganizations in 2020–2022 (Daum Cafe / Mail changes), but the mail service itself continues.

**Kakao Mail.** In 2023, Kakao re-launched a "Kakao Mail" brand. The mail.kakao.com / @kakao.com domain. The idea is "use your KakaoTalk account as email too." Integrated with Kakao Work. There is a separate Kakao Work Mail for small business teams.

**Privacy options for Korean users.**

- Korean UI for global privacy providers: ProtonMail has partial Korean support (web, iOS, Android). Tuta has no Korean as of May 2026.

- Payment: ProtonMail accepts card / PayPal / cryptocurrency. Tuta accepts card / PayPal / cryptocurrency + SEPA (EU only).

- Authentication / official mail: Korean banks, government, and tax offices still verify identity via Naver / Kakao / Daum accounts in many places, so "fully migrating to privacy mail" is hard. Realistically, run it as a secondary account.

- Business: Korean companies overwhelmingly use Microsoft 365 or Google Workspace. Mailbox.org Business is attractive, but adoption in Korea is minimal.

**Realistic recommendation.** General users: Naver / Kakao mail + ProtonMail secondary for global signups. Developers / researchers / journalists: ProtonMail primary + Fastmail or Mailbox.org secondary. Companies that cannot leave Microsoft 365 / Google Workspace: add PGP or S/MIME on top.

14. Japan — Yahoo!Mail, Gmail JP, So-net, OCN, ConoHa Mail

Japan looks different again. Gmail is strong like in Korea, but Japanese local providers (Yahoo!Mail, OCN, So-net) hold meaningful share. Japan also has the unique "carrier mail" category.

**Yahoo!Mail.** The second-biggest after Gmail in Japan. Run by Yahoo! JAPAN (under Z Holdings). Integrated with payment services like PayPay. Ads are visible. A strong user base in the 50s–60s demographic in Japan as of 2026.

**Gmail JP.** Same as global Gmail with Japanese UI. Google Workspace Japan operates aggressive sales as well. Splits the corporate space with Microsoft 365.

**So-net Mail / OCN Mail.** Japanese ISPs (internet line providers) gave you a mail address on signup (So-net is a Sony affiliate; OCN is NTT). Through the early 2010s many Japanese users had an ISP email as their primary. As of 2026, users in their 50s and up still often use ISP mail. "Change carrier and lose your mail address" is a classic Japanese digital insight. NTT rebundled OCN Mail into a mobile + fiber package starting 2025, which accelerated user migration.

**ConoHa Mail.** Hosted mail run by GMO Internet, the same company that runs ConoHa VPS. Japanese jurisdiction, mail hosting bundled with ConoHa VPS. Used for company-domain mail hosted in Japanese data centers. Starts at ¥990/month. Some Japanese SMBs use this in place of Microsoft 365.

**Privacy users in Japan.** ProtonMail has Japanese UI; Tuta added Japanese around 2024. Fastmail has a decent Japanese user base (engineering-heavy). Mailbox.org has very few Japanese users.

**Japan's specific issue.** **Mobile carrier mail** (docomo.ne.jp, ezweb.ne.jp/au.com, softbank.ne.jp) was once a Japanese mobile communication standard alongside SMS. From the late 2010s LINE became dominant, but carrier mail is still occasionally used for signup verification. This caused a historical mess with global mail services (Gmail / Outlook were once blocked by some Japanese carriers). Mostly fixed by 2026.

15. Who should pick what — the decision matrix

If you read this far, you have seen enough tools. The closing piece is "so what do I actually use."

| Situation | Primary recommendation | Alternative |

| --- | --- | --- |

| **General user, "just no ads"** | Fastmail | Mailbox.org |

| **E2EE by default** | ProtonMail | Tuta |

| **Care about post-quantum** | Tuta | (none) |

| **EU jurisdiction + simple + cheap** | Posteo | Mailfence |

| **Team (5–50 people)** | Mailbox.org Business | ProtonMail Business |

| **Team (50+, SSO)** | Google Workspace or Microsoft 365 | ProtonMail Business |

| **Heavy multi-domain personal** | Migadu | MXroute |

| **You hate email UX itself** | Hey | (no substitute) |

| **Self-host, single host** | Mail-in-a-box | Stalwart |

| **Self-host, modern + JMAP** | Stalwart | mailcow |

| **Transactional mail (SaaS)** | Postal or Stalwart SMTP | Amazon SES |

| **Journalist / activist** | ProtonMail + Tuta dual | (depends on threat model) |

| **Korean user, secondary privacy mail** | ProtonMail | Fastmail |

| **Japanese user, company domain** | ConoHa Mail | Mailbox.org |

**One general principle.** "**Do not put everything in one mail provider.**" Whether Gmail or ProtonMail, the moment one account is locked you lose your digital identity. Spread across at least two providers, set the recovery address at a different provider, and take regular backups.

**Another.** "**E2EE is not the only axis of privacy.**" Refusing the ad model, refusing to sell data, minimizing metadata, choosing jurisdiction, publishing transparency reports — all five are privacy axes. ProtonMail has strong E2EE but will hand over metadata (IP logs) to Swiss courts. Fastmail has no E2EE but absolutely refuses the ad model. Choose based on your own threat model.

**Finally.** "**Pick a company that will still be there.**" The Skiff lesson. Nonprofit (Proton AG), long-running (Posteo / Fastmail 25+ years), user cooperative (Runbox), big day-job (Heinlein → Mailbox.org) — these are unlikely to disappear. New flashy startups are appealing, but remember that they can be acquired and shut within a year.

16. References

- ProtonMail official: [https://proton.me/mail](https://proton.me/mail)

- Proton security audits: [https://proton.me/blog/security-audit](https://proton.me/blog/security-audit)

- Tuta official: [https://tuta.com](https://tuta.com)

- Tuta TutaCrypt (post-quantum): [https://tuta.com/blog/post-quantum-cryptography](https://tuta.com/blog/post-quantum-cryptography)

- Tuta GitHub: [https://github.com/tutao/tutanota](https://github.com/tutao/tutanota)

- Mailbox.org official: [https://mailbox.org](https://mailbox.org)

- Heinlein Support: [https://www.heinlein-support.de](https://www.heinlein-support.de)

- Fastmail official: [https://www.fastmail.com](https://www.fastmail.com)

- JMAP specification (RFC 8620): [https://datatracker.ietf.org/doc/html/rfc8620](https://datatracker.ietf.org/doc/html/rfc8620)

- Posteo official: [https://posteo.de](https://posteo.de)

- Mailfence official: [https://mailfence.com](https://mailfence.com)

- StartMail official: [https://www.startmail.com](https://www.startmail.com)

- Hey official: [https://www.hey.com](https://www.hey.com)

- 37signals blog: [https://world.hey.com/dhh](https://world.hey.com/dhh)

- Skiff shutdown notice (Notion acquisition): [https://www.notion.com/blog/welcoming-skiff-to-notion](https://www.notion.com/blog/welcoming-skiff-to-notion)

- Migadu official: [https://www.migadu.com](https://www.migadu.com)

- Runbox official: [https://runbox.com](https://runbox.com)

- MXroute official: [https://mxroute.com](https://mxroute.com)

- Stalwart official: [https://stalw.art](https://stalw.art)

- Stalwart GitHub: [https://github.com/stalwartlabs/mail-server](https://github.com/stalwartlabs/mail-server)

- Mail-in-a-box: [https://mailinabox.email](https://mailinabox.email)

- Maddy: [https://maddy.email](https://maddy.email)

- Postal: [https://postalserver.io](https://postalserver.io)

- mailcow: [https://mailcow.email](https://mailcow.email)

- NIST Post-Quantum Cryptography (ML-KEM): [https://csrc.nist.gov/projects/post-quantum-cryptography](https://csrc.nist.gov/projects/post-quantum-cryptography)

- Privacy Guides (email section): [https://www.privacyguides.org/en/email](https://www.privacyguides.org/en/email)

- Naver Mail: [https://mail.naver.com](https://mail.naver.com)

- Kakao Mail: [https://mail.kakao.com](https://mail.kakao.com)

- Yahoo! JAPAN Mail: [https://mail.yahoo.co.jp](https://mail.yahoo.co.jp)

- ConoHa Mail: [https://www.conoha.jp/mail](https://www.conoha.jp/mail)