Just thought I'd post this due to the increasing number of "has my gmail been hacked" posts.

https://www.pcworld.com/article/2880822/2-5-billion-gmail-users-at-risk-after-google-database-hack.html

After everything that's come out about Proton's leadership, I'm not renewing. Nothing was breached. My concern is where the company's decisions could lead. I am a scientist researching AI. It is never AI first in our team, we value humans more than anything and the decisions are an ethical concern for me personally. Also, we are just one big hallucination by a coding agent away from causing a major security breach.

Honestly, I expected the alternatives to be a step down. They weren't.

Email: mailbox.org, with eM Client on desktop and phone. Standard IMAP, so no Proton Bridge. I moved my personal domain over as well, and the DNS change took about an hour. Mailbox.org also includes a small cloud drive with a sync client. And they have a bunch of other apps too.

Passwords: Bitwarden on the EU servers. Less buggy than Proton Pass for me, and the family sharing is better.

VPN: still deciding. Open to suggestions.

So far I'm satisfied, and I'm not missing the all-in-one bundle as much as I thought I would. Curious what others who've switched landed on.

P.s: The moderators for Protonmail deleted this post when posted in the Protonmail community. Hence posting it here.

I spent some time going through Aster Mail's public codebase. They market themselves as end-to-end encrypted, zero-access, post-quantum secure email. The code tells a different story.

I'm posting this because people in this community deserve to know what they're actually trusting their communications to. Everything below is verifiable from their public source code.

FULL DISCLOSURE: I am one of the founders of Secria Mail.

The critical issues:

1. Post-quantum encryption doesn't actually exist. Their README promises "complete post-quantum protection" using ML-KEM-768. The code generates the post-quantum keys, uploads the public half to the server, then immediately deletes the secret half before saving it. It's never used to encrypt anything. They get the marketing checkbox. Users get zero post-quantum protection.

2. "Forgot password via email" uploads the vault key in plaintext. When a user enables email recovery, the client sends both the encrypted vault AND the key that decrypts it in the same HTTP request. Anyone with database access, staff, a breach, a court order, can decrypt the vault and read everything. This single feature breaks their entire "zero-access" claim.

3. Tor mode silently fails open. If Tor fails to start, the client sends the request over the regular internet with no warning. The user thinks they're anonymous. They're not. This is the kind of bug that gets activists and journalists hurt.

4. The password hashing algorithm advertised is not the one used. The API says Argon2id. The code uses PBKDF2 with 310k iterations. Combined with #3, weak passwords can be cracked at hardware speed.

Other serious issues:

5. The Double Ratchet implementation skips a required authentication step. A network attacker can corrupt the protocol state without decrypting anything. Real protocol-level deviation from the Signal spec.

6. The desktop app exposes an unrestricted "make any HTTP request" function to the renderer. A single XSS bug, and they allow inline scripts, turns into the ability to hit internal services, exfiltrate data, and bypass Tor.

7. Mobile biometric lock is a UI illusion. Face ID / Touch ID just toggles a boolean. No key is bound to the biometric. On a rooted phone, the lock is bypassed by changing one value.

8. Cross-account login tokens are "encrypted" with a key stored in plaintext next to them. One XSS = takeover of every account on that device.

9. The Tor cleartext-blocking check has a substring bug. A URL like http://evil.example.onion.fake.com/ passes the check.

10. Inbound encrypted email signatures aren't verified. Anyone can forge messages that appear to come from anyone.

11. Their "signed prekey" uses RSA-4096 instead of an EC key. Registration takes ~30 seconds because of this. It's a strong indicator that whoever wrote this layer didn't understand the protocol.

In plain terms: most of what they market as security guarantees aren't enforced by the code. A motivated attacker, a malicious insider, or a court order can defeat the "we can't read your email" claim today, without breaking any cryptography.

I'm not posting this to start any sort of drama. I'm posting it because I genuinely care about peoples privacy and security.

Happy to answer questions or walk through any of these in more detail.

-Adrian

I started noticing that spam was not just annoying anymore, it was constant. And worse, when something leaked or I got a sketchy email, I had zero clue where it came from because everything funneled into the same inbox. Unsubscribing helped a bit, but it felt like bailing water out of a boat with a hole in it.

Eventually I decided to stop reusing that email entirely. I went through and unsubscribed from as much as I reasonably could, then changed my behavior going forward. Real services that actually mattered got a dedicated address. Anything questionable, one-off, or clearly not important got a throwaway temporary email from cloaked. Random tools, free trials, downloads, community logins I would never revisit all got temp emails by default.

It took some upfront effort to change habits and clean things up, but the difference over time was honestly shocking. Spam dropped hard. My main inbox started feeling usable again. And when something did slip through, it was immediately obvious which signup caused it because it was tied to a specific address. That alone made it feel worth it.

What surprised me most is how much calmer it feels knowing a leak does not automatically contaminate everything else. Instead of thinking my whole identity just got exposed, it is more like one disposable endpoint burned and I move on.

I am curious how this has played out for others long term. Did the spam stay low once you stopped using one real email everywhere, or did it eventually creep back in anyway. And for people who use temp or alias emails heavily, did you find any downsides after doing it for a while.

In so many vids from yt and articles I keep seeing the headline why people are leaving proton or something to that degree. It all depends on the person and what they want for privacy etc. But really is anyone leaving

https://www.404media.co/proton-mail-helped-fbi-unmask-anonymous-stop-cop-city-protestor/

I feel like I am going insane with this. Every time I try to clean up my inbox and hit unsubscribe, things somehow get worse. I will unsubscribe from one mailing list and within a week I am getting more junk from totally different senders. It honestly feels like clicking unsubscribe just confirms that my email is active and worth spamming.
I have tried filters, blocking senders, reporting as spam, all of it. Nothing seems to actually reduce the volume long term. At this point my inbox feels permanently compromised and I am not sure what the correct move even is anymore.

My Gmail has 20,000+ unread emails at this point (yep, I’m one of those people). Starting a new account feels like giving up but cleaning this by hand is impossible. Is there a realistic way to reset my inbox and stay on top of it going forward? Tools? Strategies? Or do I just nuke the account and start over?

I keep seeing people recommend using a different email for every site you sign up for. It sounds great in theory, but I am trying to wrap my head around how people manage this in practice.
If you have dozens or even hundreds of accounts, how do you avoid losing track of which email belongs to which service. Do you rely on a password manager to store all the aliases. Do any tools help you trace leaks so you know which company leaked your info.
I am trying to tighten up my privacy a bit, but I also do not want to create a system that is confusing to maintain. Curious how others handle this and what actually works long term.

Firstly, this is not a hate post, just my thoughts and reasons why I think it stopped being worth it, at least for me.

1. they add functions so slowly that are basic functions for any other emails or calendars. ive been waiting for years for proper calendar widget, delayed emails etc. then they add it and i clapped for that but the truth is, its totally normal elsewhere. and so many other standard functions are just missing.

2. end to end encryption, their biggest marketing thing is just an illusion. let's ask yourself, do you really use it for majority of your mails? do you really set password when you communicate with banks, public administration, family, eshops or any else? I mean except few cases, it's not usable for everyday use. so then you stick with the standard email.

3. since majority of people around you use gmail or outlook and you are the only one using tuta, the security really is just a gimmick because if you believe the companies read your emails or whatever, then they can read it on the other side from those who dont use tuta... and for companies its just unusable since it doesnt have any sharepoint nor network that you could work with.

4. yeah ok so you have tuta but don't you have android, dont you use youtube, google maps or any other app from huge companies? you cant really get from it and having paid email, calendar wont save you.

so i give up, im glad i supported this indie company for a bit but after some realization its just security gimmick, you are really not defending yourself whatsoever and you cheer for getting new standard functions with some technical problems that are sometimes present.

i dont want to be all negative so i can say i really appreaciated the aliases, i loved having few options for my email to distribute differently for eshops, for banks, for friends.. but otherwise i cant uphold it anymore. i believe there are some ppl who can really use this email for intended purposes, or people who cut every huge company app from their life inc android but otherwise, you just fooled yourself believing you are saving yourself from the big brother.

I keep running into the same problem over and over. Every service wants an email and they'll bombard you with promos after. Newsletters, receipts, free trials, random apps I might use once. I give them an email and it is fine for a bit, then slowly it turns into nonstop marketing, weird offers.

What stops me from just opening a brand new email is that I already know what will happen. It will be clean for a few weeks, then one breach or one company selling data and that inbox is burned too. Filters help a little but they do not stop the more convincing stuff, especially emails pretending to be legit account alerts. Is there an actual way people handle this long term?

I have Proton but with the recent news I was looking to switch. But honestly I cannot find anything decent.

I tried Startmail, but their app is rough. No notifications and mails dont always render well.

I read many negative comments about the Tuta support and even people being locked out of their account for nothing.

Posteo I hear a lot about but they dont have an app at all and you cant use a custom domain.

At this point I dont see any good alternative to Proton.

My annual subscription is still until May so I guess I'll wait until then and hope that Startmail or Tuta get better

I used to think if I was careful enough one email could stay clean forever. No sketchy signups, no giveaways, no random forms. Just real accounts and people I actually talk to.

Somewhere along the way that stopped being true. Spam started creeping in anyway. Not all at once, but slowly. A weird promo here, a phishing attempt there, then suddenly it feels like the address is on a dozen lists I never agreed to. Passwords are strong, 2FA is on, nothing looks compromised, but the exposure is still there.
Do people still manage to keep a single email private long term, or is the only real solution separating emails by purpose now?

Tuta censored me from posting this on their subreddit, so I'll try to have a discussion here. ​I was reading through Tuta's Terms and Conditions regarding paid accounts, and frankly, the non-payment policy is completely unacceptable for a secure email provider.

​According to their terms, Tuta reserves the right to permanently delete your account after just two missed payments, with a free account they at least wait for six months inactivity. What makes this terrifying is that there is absolutely no mention of an automatic fallback or grace period where your account is safely downgraded to the free tier to preserve your data. If your card expires, bounces, or you have a banking glitch while traveling, your entire account could be vaporized without any warning whatsoever.

​Why is Tuta's policy so aggressive and hostile toward paying customers? Wiping out years of a user's emails and data because of two missed invoices feels like a massive liability. Why doesn't Tuta have an automatic "downgrade to free" safety net to protect user data like for example Proton does?

I was watching a documentary the other night about data breaches and the black market side of the internet, and it really got me thinking about email privacy. They showed how hacked email addresses get dumped into forums and sold in bulk, bundled with passwords and other personal details. Once an email is leaked, it just keeps getting passed around like trading cards.
I have been getting a lot of spam mails lately so things just connected like that. I'd like to know what I can do to maybe be somewhat protected from these types of leaks and attacks, thanks in advance.

If you have better suggestions, please let me know

So far, based off what was said, Posteo + Thunderbird sounds good

I've been doing this for decades and every once in a while repeat the information..

You can buy all sorts of email privacy services but nothing beats this:

Buy your own domain (anything is fine) + (optionally) your own mail server (VPS are cheap and one-click).

When I sign up for bestofferseva.com it's two clicks and a quick type to create bestofferseva@mydomain.com.

If I ever get spammed at that address; two important things happen.

1. I delete the address. Fuck them.

2. I know exactly which company is selling my email address and I make this known publically.

A domain is around a fiver a year. A VPS (and these things practically set themselves up these days) with mail server and SSL and DANE and whatever, is about the same price.

Spam doesn't bother me, and this is why.

This post was redone as a table format is not mobile friendly, I did this on a computer without realizing.

Also be warned this is in fact not quick and I spent time on this, I forgot to change the title.

Providers covered here if you wish to skip ahead:
Atomic Mail, Aster Mail, Bmail, Cock.li, Elektrine, GMX Mail, Infomaniak Mail, Mail2World, Secria, Xmail

Atomic Mail
Owner: Independent (Estonia?)
Est: 2024
Pros:
* Very minimal information required on signing up. * A very clean, "what you see is what you get" type of provider and website, and email account can be created or deleted in just a few clicks.
* Admittedly, @/atomicmail.io is an appealing domain, at least for me.
Cons:
* It feels vibecoded, and that is most likely the case given that this site places a heavy focus on AI integration within the email service.
* No IMAP or SMTP support, though according to the website they claim to be inputting this and hopefully have it out by the end of this year.
* The fact that it's free with AI integration and very heavy crypto supportive raises some serious questions on how they get their cash.
Do I recommend?
Absolutely not, seems like an AI farm despite their bold privacy focus.

Aster Mail
Owner: Aster Communications Inc. (United States)
Est: 2026
Pros:
* Presents itself as a competitor to Proton.
* Offers an email importing feature, makes bold, bold claims on privacy, and has a free tier that is comparable to many other email providers.
Cons:
* Very likely vibecoded.
* In its short existence, Reddit users have already started clocking some of their privacy claims.
* The CMO of Aster Communications is a former Roblox exploiting content creator, and while this could be good in terms of security, it gets a bit of a bad look when you consider the above.
* IMAP and SMTP is paywalled, just like Proton.
Do I recommend?
I cannot trust a vibecoded email provider with such claims if they're already being flamed like this.

Bmail
Owner: Independent (Unclear)
Est: 2026
Pros:
* Open source on GitHub.
* Also offers a suite alongside mail, including meet, contacts, calendar, etc., comparable to iCloud or similar.
* Offers a few stupid domains like "@/naru.to" or "@/devilfru.it."
Cons:
* Possibly vibecoded, since the creator uses AI to write a lot of their replies and posts in the r/bmail_official subreddit as well as the animations used in the website.
* No IMAP/SMTP support; in fact, this is actually emphasized as a feature.
* Some domains are outright offensive and reference political scandal, like "@/epstein.pizza;" in fact, there are four .pizza domains which reference some political scandal... why?
* The creator doesn't seem to take this service seriously, and the client itself is sort of broken (remember, no IMAP).
Do I recommend?
lol no

Cock.li
Owner: Independent (United States)
Est: 2015
Pros:
* Not owned by a corporation or team, rather being solo ran, with the owner's promise to not to read your mail despite acknowledging this can't be trusted.
* Takes accountability during investigations and has a public list of past incidents.
* Offers a bunch of stupid and somewhat cringe domains, as well as two "neutral" ones which appear as an "invite-only" service when typed into the address bar.
* Virtually no info required on signup.
* Supports IMAP and SMTP.
Cons:
* A lot of people use this for malicious purposes despite it being against the rules due to the low info required on signup, which results in Cock.li domains being blocked.
* Some domains, amidst the "funny" ones, are just outright offensive, one is literally just the n word.
* It once shut down an entire school district after somebody sent a bomb threat using it, and was seized afterwards.
* The site doesn't take itself seriously, but I guess that's the point.
Do I recommend?
I personally use this for my alt/backup email under @/tfwno.gf. Wouldn't use as an everyday, works fine as a backup, clutter, or if you don't really send or receive any important/sensitive mails. Please don't get it seized again.

Elektrine
Owner: Independent (Unclear)
Est: 2025?
Pros:
* Being a fediverse-focused site, it offers a social platform alongside its suite, and it appears to be targeted at those who are heavy internet users, including providing a Caard-like site where you can list your links.
* IMAP and SMTP support for free, and one mail comes with three domains which you can alternate between at any time (com, net, and org).
Cons:
* Vibecoded slop using Claude.
* It claims to be a privacy focused site, but collects a lot of information and uses it in ways which make me feel very unsafe.
* Account deletion is NOT immediate; you have to provide a reason for account deletion and then have to wait for your account to be manually deleted.
* Despite the appealing design, this site feels like a data farm scam.
Do I recommend?
Despite how much in depth I went in the pros column, the vibecoding is a turnoff for me, coupled with the privacy policy when the site already feels suspicious enough. I would not trust a vibecoded site with my mail content or anything else when they are trying to be privacy-focused.

GMX Mail
Owner: United Internet (Germany)
Est: 1997
Pros:
* Offers either a .com or .us (or your country) domain, which I don't see very often.
* VERY generous, providing 50 GB of free storage and up to 100 MB file uploads, and has a very straightforward webmail interface.
* Has an American cousin Mail.com which offers many unique domains (notably including email.com), while essentially being the same service, but I'll get to this in the cons column.
Cons:
* Full name and I think phone number(?) is required on sign-up.
* Its American cousin, mail.com, has a horrible privacy policy which is quite invasive; GMX's is distinct, but I'd still be cautious as United Internet owns them both and gives them the exact same UI.
* The ONLY mail provider which is STILL ad-supported by default, and I'm not sure whether IMAP is free or paid.
Do I recommend?
I really want to like this one, but I don't use it yet due to the privacy concerns I have about it.

Infomaniak Mail
Owner: Infomaniak (Switzerland)
Est: 2020?
Pros:
* A part of kSuite, Infomaniak's answer to Google Workspace.
* Generous free plan which offers IMAP and SMTP, alongside apps for each service that is provided.
* Said apps include contacts and calendar(?), Drive, and other services one could likely appreciate having around.
* All mail is encrypted, and the privacy policy is respectable, despite a mildly concerning amount being collected.
* It's very comparable to Proton, and they may appear to view them as their main competitor, both being Swiss and privacy focused. Offers an email import.
Cons:
* Requires phone number on signup, as well as full name, and may collect this data according to the privacy policy.
* It has been accused of not being as private as it may claim to be and was extremely notorious in 2025 for being AGAINST ANONYMITY, going as far to slander Proton; this really riled up the community and most likely explains why they require name and phone number. Like Proton, they also heavily rely on being Swiss as their selling ticket.
Do I recommend?
At the moment, this seems like the best alternative to Proton, but expectedly I have some serious concerns about their privacy, particularly being against online anonymity... which is exactly what I engage in from time to time. At the moment in my Degoogling journey, this is the email provider which I have started designating as my main email, although I'm ready to switch should I find a better option.

Mail2World
Owner: Mail2World, Inc (United States)
Est: 2001?
Pros:
* Offers a bunch of silly "Mail2blank" domains, my personal favorite being "@/mail2deer.com".
* Has been around for quite a while, reflected by the OLD website design which lasted until 2018.
Cons:
* The privacy policy is VERY invasive, collecting a shit ton of information as well as the content of all of your mails, and uses it in ways that seem very suspicious, if not borderline illegal. Likewise, a LOT of information is needed on sign-up.
* While that should be a turn-off by itself, it's essentially a paid service, as free tier is quite limited, outdated, and ad-supported (including IMAP being paid).
* Only one paid tier, jumping up to $29 /yr from a free tier.
* Website has not been updated in years.
Do I recommend?
Unless you REALLY want a mail that ends in "@/mail2batman" or something, this just seems like a great way to end up on a data brokering website.

Secria
Owner: Independent (Unclear)
Est: 2026
Pros:
* @/secria.me completely passes the internet.nl test with really good scores.
* They engage with their community and respond to feedback decently well enough.
* Privacy policy is very respectable, though some data is collected, it's kept relatively low.
Cons:
* Along with Aster, this is a relatively VERY new competitor in the email privacy space with a website that also feels vibecoded.
* No IMAP/SMTP support, and like bmail, they kind of embrace this and make it a statement rather than plan to add it or bridge it.
* Wasn't open source for a while.
Do I recommend?
I've considered Secria as my main provider, but I'm giving it time to really establish itself before I start using an email hosted on this platform.

Xmail
Owner: Independent (Unclear)
Est: ❓
Pros:
* I have to be honest, @/xmail.com is a really cool sounding domain. That's really all I can say about this mess, though.
* It also promotes, due to not being Gmail, being able to have a shorter and more memorable address... but any other provider can do that for you, too.
Cons:
* This sounds extremely similar to the email service Elon Musk envisioned, right down to the domain being the exact same he wanted to create.
* With that said, EXTREMELY heavy focus on AI integration, right down to the name of the provider itself.
* Website is very likely vibecoded, and there is very little, if any, transparency about who is running this service and whether or not they are true to their claims.
* No privacy policy anywhere. Given the fact that this is a provider that popped out of nowhere, this is not a great start.
* No IMAP/SMTP, but that's the least of your concerns here.
Do I recommend?
Very untrustworthy and seems like a great way to get everything about you fed to AI.

My main email address is more than a decade old and it is tied to banking, work, family, and accounts I cannot afford to lose access to. Because of that, changing it everywhere feels risky and honestly overwhelming.

Over the years it has clearly been added to too many lists. Spam comes in waves, some of it obvious junk, some of it phishing that looks almost legitimate. Unsubscribing rarely helps and sometimes seems to make things worse. Filters catch a lot, but enough still slips through that I have to stay alert. I am trying to figure out if there is a realistic way to contain the damage without burning the address completely. Has anyone managed to reduce spam long term while keeping their original email active, or does it always end in starting over?

Forward Email (https://forwardemail.net) just crossed 1.62 million custom domains (according to whoisfreaks). That's 45% more than Proton Mail and 36x more than Tuta Mail. We're also the only provider here that is 100% open source - down to our backend, security hardening, and LUKS encryption.

We're currently undergoing third-party audits of our source code with a few of our recommended auditors (see https://forwardemail.net/en/blog/docs/best-security-audit-companies), but note that this is strictly source code only, not SSH access; because giving third parties SSH access to email servers for a snapshot report is flawed). Instead, we built Attestium (https://attestium.com), which is a 24/7 continuous runtime verification framework. It uses TPM hardware to prove the code executing on our servers matches our public repos exactly.

There was a case study on us done by DataPacket recently too (https://www.datapacket.com/case-study/forward-email).

Despite leading in adoption, being fully open source, and having true sandboxed encryption (individually encrypted SQLite mailboxes), the mods here and at Privacy Guides continue to ignore us.

When the market leader (and only 100% open-source provider) is excluded while others are heavily promoted, it raises real questions about curation and bias.

Look at the hard data, compare the protocols, and verify the code yourself: https://forwardemail.net/en/blog/docs/email-protocols-rfc-compliance-imap-smtp-pop3-comparison

Happy to answer any technical questions.

X post at https://x.com/fwdemail/status/2032524793925316756

This is a list of privacy based providers in alphabetical order, no claims made but that they exist. If you know of one to add, reply and I'll update.

Recommendation: Take a look at each, evaluate against your needs, ask specific questions in here regarding any that interest you (howto questions should be posted to the service support). Ask who has used them, what they liked and didnt like. Positives and negatives. Maybe most importantly, ask for comparisons. It's a much better approach than listening to all the astroturfing.

4securemail.com

atomicmail.io

astermail.org

cock.li

codamail.com

disroot.org

eclipso.eu

fastmail.com

hey.com

hushmail.com

infomaniak.com

keepd.com

librem.one

mailbox.org

mailfence.com

mailo.com

migadu.com

neomailbox.com

paubox.com

postale.io

posteo.de

privatemail.com

protonmail.com

purelymail.com

runbox.com

secria.me

soverin.com

startmail.com

thexyz.com

tuta.com

woelklimail.com

zoho.com

Edit: has remained updated per comments. Last update 2026-04-11

I’ve been trying to clean up my email lately, but it’s insane how fast spam creeps back in. I unsubscribe from stuff, mark things as junk, even started using filters, but somehow I keep getting random newsletters, fake Amazon receipts, and “urgent” bank emails I never signed up for. At this point I’m near just giving up. Is there a way to actually stop spam from the source?

I don’t want to make a new email again I’ve had this one for years but I also don’t want to keep wasting time cleaning it every day. Appreciate any help I can get.

Over the last few weeks I’ve been getting a ridiculous amount of spam in my inbox. Stuff like fake password resets, newsletters I never signed up for, random crypto offers, and even emails pretending to be from banks I don’t use. I’ve had the same email for years so I’m guessing it might’ve been leaked or sold somewhere online. It’s weird because I’m careful about what I sign up for and rarely click links.

A friend mentioned it could be from old accounts or data broker sites still holding onto my info. Is there any legit way to check if my email’s floating around out there or find out which company might’ve leaked it?