Free Software Webmail Systems

Whether the server itself runs nonfree software is a different issue. Nonfree software running on the server infringes the freedom of the server operator, but not yours; therefore, it is a secondary issue. We note here that some server operators say they run exclusively free software; you might choose one of them to reward their support for the community.

We don't know of any surefire way to evaluate a mail service for privacy, since any such service could be handing mail data massively to some government, and there is no way to detect this from outside.

We do know that specific companies providing webmail services were named as part of the PRISM NSA spying revelations: Google, Yahoo, Microsoft, Apple, and AOL.

We also know that some smaller companies, like Lavabit, were pressured to turn over information.

Establishing good practices, such as using GNU Privacy Guard (GPG) to encrypt your messages, is essential to keeping your communications private and secure. It only takes 30 minutes to follow our Email Self-Defense guide for help in how to get started with GPG, and we recommend it to everyone concerned with their security online.

As the privacy and freedom of these webmail services are evaluated periodically based on community feedback, please email us at [email protected] with any suggestions or if you notice any issues that may have escaped our attention.

With these caveats, here are some recommendations:

• Pick a mail service located in a country that won't cooperate with governments that you're particularly concerned about privacy from.
• Avoid using LinkedIn, which fishes for people's email contact lists.
• If your mail service and your search engine are run by companies that don't cooperate, neither of them can correlate your searches with your mail contents. (A spy agency could still do so, if the two companies are in the same country or in countries that cooperate in massive surveillance.) Thus, don't use both Gmail and other Google services such as web search.

Recommended

Some of these services are gratis, but that's a separate issue. Recall that "free software" refers to freedom, not price.

• Riseup: New accounts need an invite code from someone already on the system. Signup works, even when Javascript disabled. POP/IMAP clients can be used.
• Autistici/Inventati (A/I): Gratis; "All of our services are provided for free, without any form of control or commoditization of the personal user data." See more details at https://www.autistici.org/services/mail. Confirmation that they are now LibreJS compliant at https://www.autistici.org/static/javascript.html.
• Posteo: Aims to be fully compliant with LibreJS's standards, but some scripts cause warnings. Does not work without JS. Credit card payments do not work without nonfree JS. We've also been told it doesn't allow users to bring their own domain to the service, which may be a dealbreaker for some.
• Runbox: Starting with version 7, Runbox's webmail client is free software licensed under GPLv3. Although their source code repository is hosted on Microsoft GitHub, they do accept patches to their webmail client from the community.
• Some services will let you sign up and sign in without non-free JavaScript, and use IMAP/POP3 from a desktop program, but have broken webmail:
  • Mailnesia.
  • Safe-mail.net. Signup and Login possible with LibreJS enabled. Select "Traditional" interface for webmail use. Mail server details also available for mail clients.
  • VFEmail (uses google syndication, and captcha - both non-free). After registering, you can use mailserver configuration details and use a mail client.

For privacy purposes, you may sometimes want to use a disposable email address for one or a small number of messages. These disposable email services have been verified to work without proprietary JavaScript:

• 10 Minute Email
• Guerrilla Mail
• Spam Gourmet

Under Review

• Mailo.com: Formerly French only, now available in English. Site is no longer explicit about running on free software.
• Tutanota: Looks promising - they're working on becoming LibreJS Compliant.

Not Recommended

• Google Gmail: Gmail is run by Google and was specifically named as part of the PRISM spying program. There is no way to use the web client without running nonfree JavaScript.
• Mail.Ru: Impossible to use without consenting to nonfree JavaScript. It is also almost certainly under governmental surveillance, and likely does not respect privacy. It also requires a phone number to register, which is unacceptable from the perspective of privacy.
• Yahoo! Mail: works without JS apparently, but you need JS enabled to create a yahoo account
• Yandex Mail: You can register and sign in with LibreJS enabled, but not send mail in the no-js interface. Also: looks to be Russian based, so almost certainly under surveillance.
• Microsoft Outlook.com (@outlook.com, @live.com. Old emails: @hotmail.com, @msn.com): Requires nonfree Javascript.
• Apple iCloud (@icloud.com. Old emails: @me.com, @mac.com). Apple requires people to own an Apple device (either an iOS device or a Mac) to create an iCloud account.
• Hushmail: Site doesn't load without JS.
• mailbox.org JS needed to register or use system.
• ProtonMail: JS needed to register or use system.
• Disroot: Requires nonfree JS to sign up, though sending messages with traditional email clients is possible after registration. Uses Rainloop as its webmail client, but whether it's the free version of this program is currently unclear.

Other

• Mail-in-a-Box is an easy-to-deploy GNU/Linux mail server so you can run your own webmail
• mailcow is a docker based GNU/Linux mail server