MAmaxloh·Apr 25, 2026Submission
Tuta: email service with privacy, encrypt emails, contacts and calendar
3 points · Open discussiontutao
tutanota
TypeScript2014–2026
tutao / tutanota
tutanota
Tuta is an email service with a strong focus on security and privacy that lets you encrypt emails, contacts and calendar entries on all your devices.
22Distinct people
22Mentions
0Explicit recommenders
8.2KGitHub stars
What to know before exploring
What it is
Tuta is an email service with a strong focus on security and privacy that lets you encrypt emails, contacts and calendar entries on all your devices.
GitHub
Where it is used
No documented product use was verified in the last source check.
What people are saying
No recommendation phrase was found in the indexed comments.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
No other repository is repeatedly linked in the same discussions.
This week on Hacker News
Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 5:04:57 PM UTC.
No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.
Mentions over time
HN mentions by year22 dated mentions
Observed mentions: 2014-10-29 08:43:47 UTC to 2026-04-25 15:22:49 UTC.
* An incomplete calendar period is marked with an outlined bar. Its count is not directly comparable with a full period.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| 2014 | 2014-01-01 00:00:00 UTC | 2015-01-01 00:00:00 UTC | 2 | 1 | 1 |
| 2015 | 2015-01-01 00:00:00 UTC | 2016-01-01 00:00:00 UTC | 2 | 0 | 2 |
| 2016 | 2016-01-01 00:00:00 UTC | 2017-01-01 00:00:00 UTC | 1 | 1 | 0 |
| 2017 | 2017-01-01 00:00:00 UTC | 2018-01-01 00:00:00 UTC | 1 | 0 | 1 |
| 2018 | 2018-01-01 00:00:00 UTC | 2019-01-01 00:00:00 UTC | 3 | 1 | 2 |
| 2019 | 2019-01-01 00:00:00 UTC | 2020-01-01 00:00:00 UTC | 1 | 0 | 1 |
| 2020 | 2020-01-01 00:00:00 UTC | 2021-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2021 | 2021-01-01 00:00:00 UTC | 2022-01-01 00:00:00 UTC | 3 | 0 | 3 |
| 2022 | 2022-01-01 00:00:00 UTC | 2023-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2023 | 2023-01-01 00:00:00 UTC | 2024-01-01 00:00:00 UTC | 3 | 0 | 3 |
| 2024 | 2024-01-01 00:00:00 UTC | 2025-01-01 00:00:00 UTC | 3 | 1 | 2 |
| 2025 | 2025-01-01 00:00:00 UTC | 2026-01-01 00:00:00 UTC | 2 | 0 | 2 |
| 2026 (partial) | 2026-01-01 00:00:00 UTC | 2027-01-01 00:00:00 UTC | 1 | 1 | 0 |
What Hacker News says
22 sourcesProof? There is no backdoor in Tuta, the code is here: https://github.com/tutao/tutanota
In Europe needs digital sovereignty – and Microsoft has just proven whyLast time I checked, while tutanota's emails are ostensibly E2E encrypted, all public keys are provided by their server and there's no way to pin keys or verify them over a side channel, so a compromised server could trivially send its own public keys and MITM attack all encrypted emails.
This completely defeats the purpose and guarantees of E2E encryption, but for some reason, it hasn't seemed to be a priority for them. The article passingly mentions key verification, so hopefully that's changed.
https://github.com/tutao/tutanota/issues/768
In Tuta Launches Post Quantum Cryptography for Email (2024)Tangent: Been looking to switch email providers for a while, and hadn’t heard of Tuta. Looked good enough I just went ahead and signed up… only to find out apparently they provide no real data portability whatsoever.
The only option for getting your email _out_ of their systems is to select small batches of them one-by-one in their app and export them.
There have been many requests for something similar to Proton’s bridge functionality that haven’t gone anywhere. A more useful export function has been near the top of their public roadmap[0] for half a decade now it looks like.[1]
Guess I’ll go find out what their refund process is like.
Don’t mind me. Just yelling into the void.
[0] https://tuta.com/roadmap/
[1] https://github.com/tutao/tutanota/issues/1292
In Proton Mail discloses user data leading to arrest in SpainThat’s a great point, but not the point that GP was making. I’d like to learn more about the inherent domain sharing security problem they ranted about.
Edit: This public issue seems to imply they have a way to mark system/admin emails: https://github.com/tutao/tutanota/issues/6708
In Google rival Tuta complains to EU tech regulators about de-rankingShow HN: TutaCrypt, post-quantum encryption protocols for securing emails [pdf]
Hi HN, we are the developers from Tuta (formerly Tutanota), the German end-to-end encrypted email provider, and we recently released the world's first post-quantum encryption for email.
We have included a full technical write-up of the cryptography involved in these changes and we have released it for open public review.
This document specifies TutaCrypt, a protocol designed for hybrid email encryption in Tuta Mail. The protocol combines a classical Elliptic-Curve-Diffie-Hellman key exchange with a post-quantum KEM. The goal is to replace the usage of RSA in Tuta Mail.
In the remainder of this document we describe some preliminaries such as the cryptographic primitives used. We define the core algorithms of the protocol and describe the flow of messages between the communicating parties. Finally, we discuss the security properties and som
Read the rest
e limitations of the protocol in its current form.
We are eager for your constructive feedback. All cryptography related source code is available for review and experimenting here: https://github.com/tutao/tutanota/blob/master/src/api/worker...
If you have any questions or comments related to post-quantum cryptography please let us know in the comments!
rich coming from tuta who still lack a onion based login. this ticket from 2018 was locked as off-topic. https://github.com/tutao/tutanota/issues/528
as lenin said, the best way to control the opposition is to lead it. for me, unless the company has been raided by the government they simply cannot be trusted.
apple proudly advertises privacy on huge billboards while sharing everything they are asked under shadow laws. absolute hypocrisy and double standards. but then they wouldnt be where they are without government money and favours.
In Apple and Google Monitor Notifications. We Need Push Notification AlternativesTutanota likes to tell everyone that they are literally Signal in the email world in terms of security. But there is a known vulnerability in their "E2EE":
https://github.com/tutao/tutanota/issues/768
There is no way to verify key fingerprint of your recipient right now. So server can just man-in-the-middle you providing third-party key and read all messages silently. It is not e2e encryption if you have to trust the server. Period.
In Tutanota is now TutaMySQL is a successful product that was sold to Sun / Oracle for a BILLION dollars. MariaDB and Percona Server are good examples of competing businesses produced from a commercially successful GPL opensource software (MySQL):
- MariaDB: https://mariadb.com/products/community-server/
- Percona Server for MySQL: https://www.percona.com/software/mysql-database/percona-serv...
Other additional examples of successfully commercialised xGPL products with different business models:
- Red Hat Linux: https://sfconservancy.org/blog/2023/jun/23/rhel-gpl-analysis...
- QT: https://www.qt.io/licensing/
- Ghostscript: https://www.ghostscript.com/licensing/index.html
- WordPress: https://wordpress.com/ (based on https://wordpress.org/ )
- Buskill (hardware): https://www.buskill.in/
- Moodle: https://moodle.com/ (based on https://moodle.org/)
- ProtonMail:
Read the rest
https://proton.me/mail (based on https://github.com/ProtonMail )
- Tutanota: https://tutanota.com/ (based on https://github.com/tutao/tutanota/ )
- Dada Mail: https://www.dadamailproject.com/
- Dietlibc: https://www.fefe.de/dietlibc/
The commercial success of a product totally depends on the business model you come up with, whatever be its opensource (or not) license.
Corporates have a vested interest in promoting the propaganda that only a non-xGPL opensource license can be commercialised successfully simply because they cannot freely steal the source code of a competing xGPL licensed software.
The real value of an FSF license, like the AGPL, is that it is designed to protect the copyright holders, and its users, "right to repair". And thus, it cannot be closed source by anyone (apart from the original copyright holders) once released under the said license (even if future versions are closed source, the old version under xGPL remain opensource perpetually). Other open source license (that are less stringent) are prioritised to increase developer contribution. Source code under such license can thus be closed-source even from the original copyright holder.
But again, commercial success totally depends on the business model you come up with, irrespective of your license. The right license and the right business model will empower each other. Or cripple your business.
Thanks for the link. I am actually not happy they did not mention this court case in the page I posted above. But the thread you linked also does not clarify the details.
Their clients are open source so you should be able to
build them yourself.
https://github.com/tutao/tutanota/blob/master/doc/BUILDING.m...
How would that court requirement work ?
In Gmail is blocking emails with links to TutanotaI'll bite.
First, encryption is not "obscurity" in the same way you think DRM is.
Second, several other email providers don't think they need to rely on some performance-killing DRM to "protect" their web app (oh no, what of all the value!).
Outlook has a part of their files minified, but doesn't use any obfuscation; apps like ProtonMail[0] and Tutanota[1] are even open source.
(I'm actually starting to migrate off of Gmail to Protonmail myself.)
[0]: https://github.com/ProtonMail/proton-mail/ (the new site, on beta.protonmail.com)
[1]: https://github.com/tutao/tutanota
Oh, and there's no need to call people "communists", "attackers", or "criminal scum". Be civil.
In Mighty Makes Google Chrome Faster> [citation needed]
I don't have anything but own anecdotial evidence to provide. Would be cool if there were some good, recent benchmarks between the two, but I wasn't able to find any.
Maybe I've just configured something wrong, but I keep facing this issue where autocomplete stops to think suggestions and might just freeze the whole VSCode for a second. This is in a small project that has some fairly large library definition files (namely, aws-sdk).
If you search for "TypeScript performance", you'll find a bunch of issues and posts discussing the subject, so I don't think I'm totally alone in calling it out.
Granted, Flow gets it's share of similar search results and I have also experienced similar issues where a recheck sometimes takes long and CPU usage jumps very high. This side of Flow has been consistently improving between almost
Read the rest
every release, though. Most recently, a couple months back, their switch to this new "types-first" architecture [1] is supposedly unlocking something like 50%-90% perf improvements compared to what they vere before.
My point with this isn't to question your experience with Flow, I've sometimes faced similar issues. I'm just saying that, depending on the Flow version you were using, things may have changed a lot for the better.
Just so that I'm not talking _completely_ out of my ass here, as a quick very unscientific test I cloned the Tutanota project's repo [2]. SCC says there's 967 JS files, consisting of 205433 lines of code in there. Flow version is 0.136, which is a little behind, but they are using the new types first mode.
time node_modules/.bin/flow check
Found 0 errors
node_modules/.bin/flow check 1,00s user 0,11s system 9% cpu 11,905 total
[1] https://medium.com/flow-type/types-first-a-scalable-new-arch...
[2] https://github.com/tutao/tutanota
Did some digging, and it seems like it's at least on the roadmap, but I'm not sure how high of a priority it is.
https://github.com/tutao/tutanota/issues/544
In ProtonMail takes aim at Google with an encrypted calendarEnd-to-end encrypted email service Tutanota allows MiTM attacks without warning
2 points · Open discussionShowing the 15 most recent of 22 sources. Enable JavaScript to search and browse every indexed mention.