When email first evolved out of simple network messaging tools, it was about as secure as tacking your message to the community notice board. Anybody could read it—or even change the message! Likewise, any server transmitting those early emails could intercept them. Modern email is a bit better, but the email providers themselves can still dig into your data. It’s ostensibly for your benefit. “Oh, this email is about a plane flight. Should I put it on your calendar?” But the providers of free email see you as more of a product than a customer. If you really want privacy in your communications, you need an email encryption tool. SecureMyEmail lets you communicate privately both with other users of the product and with outsiders, and it can even be free.
With Private-Mail, ProtonMail, StartMail, and Tutanota, you must create a new, secure email address for your encrypted conversations. That’s a deal-breaker for some. Like PreVeil, SecureMyEmail lets you keep using any existing email address. The only qualifier is that your email account must support IMAP, which most do. Virtru Email Protection for Gmail also doesn’t make you change your address, but it only works with Gmail, and only if you log in using Chrome.
How Much Does SecureMyEmail Cost?
There’s no charge to sign up for SecureMyEmail. You don’t have to supply a credit card, or any personal information beyond your email address. If the email address you want to protect is a Gmail, Yahoo, or Microsoft account, you can go right on using SecureMyEmail indefinitely, at no cost.
Protecting any other type of account with SecureMyEmail requires a paid subscription, as does using it to protect more than one account. In that case, your signup starts a 30-day free trial. After the trial, a subscription costs $3.99 per month or $29.99 per year. That subscription covers up to eight email addresses, which should be enough for most users.
The free edition is feature-complete, as is the 30-day trial (until it expires). PreVeil and Virtru are totally free, so they’re likewise feature-complete at the free level.
Private-Mail, ProtonMail, and Tutanota all offer free tiers, but with significant limitations. For free users, ProtonMail limits the number of messages per day, the size of the inbox, and the number of folders and tags. Private-Mail also limits storage and puts certain features out of reach. With Tutanota, there’s no limit on messages send and received, but you can only search the latest 30 days of messages. Paying for Tutanota also unlocks several premium features.
A Tutanota Premium account costs €12 per year, about $14.50 at the time of this writing. All the other paid subscriptions mentioned above cost you more than SecureMyEmail does. At $59.95 per year, StartMail’s price is almost twice that of SecureMyEmail.
Getting Started With SecureMyEmail
As a first step, you install the SecureMyEmail app on any Windows, macOS, Android, or iOS device. When I installed on a Windows virtual machine, the Windows firewall blocked it and popped up a notification. It’s uncommon for Windows Firewall to block legitimate programs, but it happens. I chose to allow the app to communicate on both public and private networks.
Next, you create your account, entering the email address you want to secure and a strong password. If it’s a Google, Yahoo, or Microsoft address, the program gives you a choice of creating a free account or starting a 30-day free trial. You can upgrade a free account to paid if you change your mind, but you can’t switch to the 30-day trial afterward. If there’s any chance that you’ll want to experiment with securing multiple email addresses, choose the 30-day trial.
SecureMyEmail uses PGP (Pretty Good Privacy) for encrypted communication, but it hides most of the aggravating features of PGP. You do need to add a passphrase, distinct from your account password, to secure the public and private keys that the program generates. Your password manager should have captured the account login data, so you should probably record this passphrase in the Notes field of that entry. One way or another, you need to retain the passphrase. Without it, you lose access to your encrypted conversations.
If you’re a true security geek, you may already have a PGP key in play. No problem! SecureMyEmail can import and use your existing key. You also get an option to upload your key to SecureMyEmail’s servers, which eases the process of installing this app on other devices. True security geeks can choose to keep the keys local, managing them manually. Do note that uploading the key to the server doesn’t give the company any access to your data. And if you decide not to upload initially, you can always transfer the key later.
To wrap things up, you create a profile of information that’s only shown to your invited contacts. You can add a photo if you wish. More interestingly, you can add a social media account, which according to the app, “helps verify your identity to others, eliminate impostors, and greatly enhances your security.” I found that trying to connect with Facebook or LinkedIn just got me a “coming soon” message, but I did link to my Twitter account successfully.
Connect Your Email
Even though you used an email address to create your SecureMyEmail account, you still must set up the app’s connection to your email. If it’s a Google, Yahoo, or Microsoft address, setup is a snap. The app takes care of everything. I did find Google’s permissions message alarming. It stated I would grant permission for SecureMyEmail to “Read, compose, send, and permanently delete all your email from Gmail.” Delete all my email? All Google really means is that, like any app that connects to your account using IMAP, SecureMyEmail can manipulate messages at the server level, including the ability to delete any message from the server. Yahoo manages a similar warning without sounding quite so dire.
At this point you’re ready to roll. The app points out that the initial sync process may take a while if you have a lot of messages, but it also notes that you can immediately start sending and receiving new messages.
If you selected a paid subscription or 30-day trial, you can configure additional email addresses, either now or later. When you choose an address other than the three main supported types, SecureMyEmail offers some advice. It points out that you might have to enable IMAP for the account if it’s not already active. It notes that two-factor authentication could interfere with the syncing process. And it links to an explanation of the app-specific password required for linking Apple accounts.
I did hit one snag early on. Initially, I tried to connect SecureMyEmail to my work email address, which is based on Google’s corporate G Suite. The process seemed to work, but ground to a halt because my IT department strictly controls what third-party services can access email. There was no way to back out of the process in SecureMyEmail, and when I tried to use another Gmail address it always went straight to that error. In the end I had to get my company contact to wipe out my account so I could start over. The lesson is clear—check with IT before you consider using this product for your work email.
Encrypting and Signing Messages
If you’ve ever used any web-based email service, SecureMyEmail will look familiar. A list of message folders and personal folders runs down the left side. Most of the window is taken up by the list of messages in the selected folder. And there’s a big button at top left to compose a new message. Simple! The list of messages does have a couple columns that you won’t find in other webmail services. A lock icon means that the message is encrypted, and a shield icon means it’s digitally signed.
Preveil installs as an add-in for Gmail or Outlook, and Virtru works within Gmail. SecureMyEmail is a separate webmail app, all its own. That especially makes sense given that you can switch between different secured email accounts within the app.
Sending mail to another SecureMyEmail user is simplicity itself. You simply enter the address or choose from your contacts, make sure the Encrypt and Sign/Verify switches are turned on (as they are by default), and compose your message using the rich text editor. I mention the rich text editor because the encryption system used by Private-Mail strips out all formatting, leaving plain, unadorned text. Drop in any attachments you like, hit Send, and you’re done.
Sending mail to recipients who don’t use the product is almost as simple. I’ll discuss the precise details below. The most important point is that SecureMyEmail doesn’t make you do anything special. You can send mail to fellow users, non-users, or both at once. The app itself checks each address and determines how to handle it.
Messaging Non-Users
A secure messaging system that only works when the recipient is also a user would be too limiting. Encrypting email products take various approaches to messaging non-users. For example, Preveil is free, so messages to a non-user come with instructions for setting up a free account.
With Tutanota Premium you convey a password to the recipient using SMS, a phone call, or any channel other than email. Clicking a link in the encrypted message and entering that password opens a web-based page with the decrypted message. Private-Mail, StartMail, and ProtonMail user a similar system. However, these three also include the option to import PGP keys and thereby communicate directly with those whose encrypted email also supports PGP. To be fair, the process of importing a PGP key can be awkward.
Sending a secure message to someone who doesn’t use SecureMyEmail is effortless. In the background, the app creates keys specific to this conversation. Once the recipient verifies their email address, the decrypted message appears as a web page, with the option for a secure reply. By default, such a message expires in 30 days.
You can dig into a message’s settings to shorten the expiry time, though you can’t configure expiry for longer than 30 days. You can also choose the Encrypted+ option, for more security but less convenience. This mode works like competing products, requiring you to create a password and transmit it to the recipient by some other channel.
Secure Contacts
The point of using email encryption is to protect conversations with your most important contacts. It makes sense to invite those people into your circle of secure contacts. When you try, you see two options, Invite Contacts from Address Book and Invite Contacts via Email. The first option was marked “coming soon” when I began this review, but it came online midway. For the second, you simply enter an email address and direct SecureMyEmail to send an invitation.
Recipients of such an invite have two choices. They can create a free or trial SecureMyEmail account, or they can set up a PGP key exchange to secure your conversation. SecureMyEmail makes the key exchange as simple as possible, but the whole process is only relevant for those recipients who already maintain a PGP key.
I did notice that SecureMyEmail didn’t pull in my Gmail or Yahoo address books. I hadn’t realized how much I relied on the webmail service to fill in addresses when I started typing names. But skipping that feature makes sense, in a way. For non-encrypted communication I could just use Gmail or Yahoo directly. And for encrypted communication, as noted, I want the address in my Secure Contacts list.
Other Platforms
As noted, SecureMyEmail has apps for Windows, macOS, Android, and iOS. On the Mac, it supports macOS 10.12 (Sierra) and later. Not surprisingly, the Mac app looks and acts almost precisely like its Windows counterpart. I did run into a problem trying to install a point-update to SecureMyEmail. I had to use Activity Monitor to Force Quit the old app, and even after I ran the updated installer it still warned that a new version was available. My company contact demonstrated that the point-update did happen, showing me a couple features that hadn’t been present before. The messaging about still needing an update was just a cache problem.
On the Mac, I also missed the fact that SecureMyEmail has an icon presence in the menu bar at the top of the screen. That’s what I should have used to quit the app. In my defense, I point out that at the size required by the menu bar, SecureMyEmail’s icon just looks like a notification bell.
SecureMyEmail offers an iOS app, but not one that’s specific to iPadOS. As a result, it appears in a small window in the middle of the iPad screen. You can (and should) double the size of that window, but doing so doesn’t get you any more detail. It works, but I wish it would take advantage of the larger (sometimes much larger) iPad screen.
I also installed SecureMyEmail on a Google Pixel 4. Everything went smoothly, except that after I selected some subfolders of the Inbox, I could not get back to the Inbox itself. When I tapped Inbox, or Sent, or Drafts, it always opened one undistinguished subfolder. By poking around randomly I managed to reach the Inbox a few times, but I couldn’t reliably duplicate the solution. This problem baffled my contacts at the company. I’m willing to believe that it hasn’t happened to other users—any program shows its strangest corner cases and problems when under review. But my experience wasn’t good.
In addition, I repeatedly had trouble getting SecureMyEmail to sync up a new installation. For both Google and Yahoo, the process should be seamless. Just turn on OAuth and you’re connected. When that didn’t happen, I tried a variety of other ways to get the accounts hooked up, with eventual success in every case. My company contacts determined that I had skipped a step, one that wasn’t at all obvious to me. I anticipate that a coming version will include a better built-in explanation for a process that’s truly simple.
What’s Not Here
Like Preveil and Virtru, SecureMyEmail doesn’t require you to log in with a master password (though you do have an account password and a passphrase for your PGP keys). ProtonMail, Private-Mail, StartMail, and Tutanota do require a master password, and all but ProtonMail also support two-factor authentication. With no master password needed, it’s not surprising that SecureMyEmail doesn’t support two-factor.
Encrypting your messages is one essential way to protect your privacy. Concealing your email address is another. Private-Mail and StartMail both include a limited Disposable Email Address (DEA) feature. Online merchants and other recipients get the DEA, not your actual email. If a DEA starts getting spam, you know who to blame, and you can just turn it off. Not surprisingly, the tools that offer this also require you to start fresh with a new email address. If that kind of privacy is your aim, you’re better off with a product like Abine Blur Premium or ManyMe, one that focuses on masking rather than encryption.
Encryption services that replace your existing email address often replace related features as well. ProtonMail, Private-Mail, and Tutanota let you create email filter rules. You can set an out-of-office message in ProtonMail and Private-Mail. Tutanota and Private-Mail come with an encrypted calendar. With SecureMyEmail, you’d just handle all such tasks in the underlying email account.
Still Improving
SecureMyEmail provides a smooth and simple path to encrypting your email communication. Its free tier is fully functional, and it has no trouble handling mail to other users, non-users, or both at once. In testing, we ran into “coming soon” messages a few times. We also ran into a few problems, most of which were solved in discussions with the company. On the bright site, these minor setbacks reveal that the product is still improving. Unlike many competitors, it doesn’t require you to spin up a totally new email address. It’s especially useful for securing Gmail, Yahoo, and Microsoft email addresses, as there’s no charge for these email types.
Even so, the totally free Preveil remains our Editors’ Choice winner for encrypted email. Like SecureMyEmail, it’s very easy to use and doesn’t require switching to a new email address. Underneath its simple exterior, it uses high-end encryption and security techniques including an unusual key recovery method that involves sharing bits and pieces of your key with friends. It even includes secure cloud storage for your most important files.
