Glossary

Encrypted email terms, defined plainly — the cryptography and privacy vocabulary behind every provider comparison and setup guide we publish.

D

DKIM authentication

DomainKeys Identified Mail — a cryptographic signature added by the sending server proving a message wasn't altered and genuinely came from the domain.

E

Email alias privacy

A disposable forwarding address that hides your real mailbox. Limits cross-site tracking and contains spam/breach fallout; services include SimpleLogin and Addy.io.

Encryption at rest architecture

Stored mail kept encrypted on the provider's disks. Meaningful only if the provider also lacks the keys (zero-access); otherwise the provider can still read it.

F

Forward secrecy cryptography

A property where compromising a long-term key does not expose past sessions. Common in messaging; largely absent from traditional PGP email, a known limitation.

G

GPG (GnuPG) cryptography

The most common free, open-source implementation of OpenPGP, used by Thunderbird and command-line tooling to encrypt, decrypt, and sign mail.

K

Key verification (fingerprint) cryptography

Confirming a public key really belongs to its claimed owner by comparing its fingerprint over a trusted channel. The step that prevents a man-in-the-middle on encrypted mail.

M

Metadata privacy

The data around a message — sender, recipient, subject (often), timestamps, IP. E2EE protects content but usually not metadata, which can be as revealing as the body.

MTA-STS authentication

A policy that forces TLS for inbound mail to a domain, preventing downgrade attacks that strip transport encryption between servers.

O

Open source / audited trust

Client code published for inspection and ideally independently audited. Not proof of security, but it lets E2EE and zero-access claims be verified rather than trusted.

P

PGP / OpenPGP cryptography

The standard for end-to-end encrypting and signing email using public/private key pairs. Strong, but key management and recipient support are the practical hurdles.

Plus addressing privacy

Appending +tag to your address (you+shop@domain). Useful for filtering and breach attribution, but trivially stripped by spammers — weaker than true aliases.

S

S/MIME cryptography

An email encryption standard using certificates issued by a certificate authority rather than user-managed keys. Common in enterprises; less so in privacy-focused consumer email.

SimpleLogin / Addy.io privacy

Alias services that generate unlimited forwarding addresses you can disable individually. SimpleLogin is part of the Proton ecosystem; Addy.io is open-source and self-hostable.

T

Threat model privacy

An explicit statement of who you're protecting against and what they can do. Secure-email choices only make sense relative to a threat model — there is no universally 'secure' setup.

Transport encryption (TLS / STARTTLS) fundamentals

Encryption of email only while in transit between servers. It protects against passive interception but every server along the path still sees plaintext — not the same as E2EE.

W

Web of trust cryptography

PGP's decentralized trust model where users sign each other's keys to vouch for authenticity, instead of relying on a central authority. Powerful in theory, cumbersome in practice.

Z

Zero-access encryption architecture

A provider design where stored messages are encrypted with keys the provider cannot access, so it can't read your mailbox at rest. Used by ProtonMail and Tuta for incoming mail.