This guide covers software that protects the email an organisation sends: gateways over existing mail, secure transfer portals and encrypted mailboxes.
It ranks twelve products on setup effort, the bill once users and modules are counted, how mail leaves again, whether you can buy without a partner, and the organisation each assumes. Smaller independent vendors come first.
Vendors can pay for more visibility on this website, for example a higher place in a ranking or more room on a page. Commercial relationships can also affect which products we feature and how prominently. Every vendor link is marked the same, whatever the arrangement behind it. How that works.
In short
What email encryption software does
Email encryption software scrambles outgoing messages and attachments so only the intended recipient can read them, through gateways, keys or authenticated web delivery, with administrator policies over what is protected.
To rank email encryption tools we asked, in turn, how much work setup takes, what it truly costs, whether data can be taken back out, whether leaving is possible, and who the product suits. One rule sits on top of those tests: places 1 to 3 go to challengers, vendors outside the best-known brands in a category, wherever the category has them; the established names follow from place 4 in their ranked order. Reasons for the choice of tests, and for skipping a score out of ten, can be read on the how we work page.
Organisations already inside a KnowBe4 relationship wanting certified encryption in a wider suite
Buyers wanting a standalone vendor with published prices
The country column shows the vendor's headquarters or contracting entity. Data hosting is a separate matter, and an entry flags it when the two diverge.
Open source encryption gateway that works with any SMTP mail service
Ranked #1 of 12 in Best Email Encryption Software in 2026.
Open sourcePricing on requestEurope
CipherMail positions its Email Encryption Gateway as compatible with all SMTP-based email services and runnable on any infrastructure, which makes it the option that does not ask you to move mail. Standards covered are S/MIME, PGP, TLS and PDF encryption.
Solution pages cover archiving and eDiscovery, Office 365 and Google Workspace. The company is a Dutch B.V. whose contact page lists an Amsterdam address and a KvK number. Expect to do the integration work yourself.
What stands out
Gateway
S/MIME and PGP
Open source edition
Where it costs you
The site publishes no prices, so budgeting starts with a sales conversation.
The recipient experience of the web fallback is described in a single line, which leaves it to a pilot to judge.
Right for
Teams that run their own mail flow and want encryption added at the gateway
Wrong for
Organisations wanting a hosted mailbox with encryption built in
NetherlandsSales-led; commercial licence or community edition
Automatic outbound encryption for Google Workspace and Outlook, built for healthcare
Ranked #2 of 12 in Best Email Encryption Software in 2026.
Pricing on requestElsewhere
Paubox sells a suite where encryption is one product beside inbound threat protection, data loss prevention, archiving and forms. The Standard plan works with Google Workspace and Microsoft Outlook, and each plan includes five senders.
Billing is monthly or annual, with a stated saving for annual payment. Infrastructure is described as cloud-based and redundant with 99.99% uptime. The footer names Paubox, Inc. but gives no headquarters, so ask where the company is established before signing a data processing agreement.
What stands out
Outbound by default
14-day trial
Healthcare focus
Where it costs you
Mail data stays in American facilities only, which may rule it out for some buyers.
Attachments are capped at 150MB per message, so large transfers need another route.
Right for
Healthcare organisations wanting every outbound message encrypted without staff doing anything
Wrong for
Companies needing storage of mail data outside the United States
Not stated by the vendorThree plans by sender count; 14-day trial on each plan
Policy-driven outbound encryption with automated S/MIME and PGP key handling
Ranked #3 of 12 in Best Email Encryption Software in 2026.
Self-hostablePricing on requestElsewhere
The home page promises automated lifecycle management for S/MIME and PGP, removing manual key handling from daily operations, and policy-driven controls on outbound communications at scale. Its regulatory framing names DORA, NIS 2 and PCI DSS.
Architecture is described as cloud-native. The page names only Echoworx with a copyright notice, so ownership is not stated. Contact Enterprise Sales or book a demo, and ask for a written price before comparing against published offers.
What stands out
S/MIME and PGP
Key lifecycle
Cloud-native
Where it costs you
Plans and amounts are absent from the site, and no trial is mentioned.
The pages read describe a cloud-native service and do not mention an on-premises or private cloud option.
Right for
Regulated firms wanting policy-based encryption with key management handled for them
Wrong for
Small teams wanting a price list and a self-service start
Not stated by the vendorSales-led; the home page lists no plans or amounts
Encrypted email with intake forms and e-signatures for small regulated practices
Ranked #4 of 12 in Best Email Encryption Software in 2026.
Published pricingNorth America
In a list of email encryption products, Hushmail sits at the small-practice end. One subscription covers encrypted messages, intake forms that reach you encrypted and e-signatures, and the HIPAA-oriented plans are listed separately from the general ones.
Its home is Canada, where it has sold this since 1999. A buyer comparing gateways for large enterprises will find it narrow. A buyer who needs to collect private documents from clients will find the bundle practical, provided those clients accept reading replies in a browser.
What stands out
Intake forms
E-signatures
HIPAA plans
Where it costs you
Clients without a Hushmail account must open each message on a web page.
Sector-based plans and basic administration suit a handful of staff, not a whole firm.
Pricing is per user each month, so cost rises with every extra practitioner.
Right for
A clinic or law office replacing separate forms, signing and mail tools for client paperwork
Wrong for
Companies beyond a few dozen employees that need wider administrative reach
CanadaPublished per-user monthly plans, split by sector
Data-centric encryption with attribute-based access control and flexible hosting
Ranked #5 of 12 in Best Email Encryption Software in 2026.
Published pricingNorth America
Packages are priced per month but billed annually, and the Compliance package includes 450 GB of platform-wide storage plus 75 GB per seat beyond the first five. Encryption is AES-256 in transit and at rest.
Deployment ranges from the managed commercial cloud to a VPC or air-gapped installation run by you. Attribute-based access control sets who reaches data and when. The site lists a Washington, DC address without calling it headquarters, so confirm the contracting entity.
What stands out
Access control
Flexible hosting
Annual packages
Where it costs you
The packages page offers a demo and sign-in but names no trial.
Extra users are priced at a lower rate whose figure the page does not state.
Right for
Contractors and agencies needing encryption tied to CMMC, ITAR or CJIS requirements
Wrong for
Buyers wanting a monthly, cancel-anytime plan with a trial
United StatesPublished annual packages with five users included; Enterprise by custom price
OpenPGP mailboxes with keys you hold, hosted in Belgium
Ranked #6 of 12 in Best Email Encryption Software in 2026.
Published pricingEurope
Among encrypted mailbox providers, Mailfence takes the open-standards route. OpenPGP keys stay with you, and people using other clients can verify what you sign, so the encryption does not depend on one vendor's application.
The company is Belgian, giving buyers a third option beside Swiss and American providers. Prices are published per user each month. The compromise is size: the interface looks dated and the admin side runs thin beyond about twenty users, which places it for small groups, not for rollouts.
What stands out
OpenPGP
Belgian hosting
Portable keys
Where it costs you
It is a hosted mailbox, so it cannot sit over mail you already run.
Quotas are modest, which matters for teams that keep large attachments.
Group administration thins out past twenty users, limiting growth inside one plan.
Right for
A small team that wants to keep its own signing keys and a Belgian provider
Wrong for
Departments of more than twenty people needing central control over many mailboxes
End-to-end encrypted mail and files with a free Basic plan
Ranked #7 of 12 in Best Email Encryption Software in 2026.
Free tierPublished pricingElsewhere
The pricing page lists a free Basic plan, an Individual plan with annual payment, Business per user per month, quote-based Gov Community, and PreVeil Pass for small and medium enterprises, which bundles three Gov Community licences with compliance support.
The pitch is no passwords to compromise, plus FIPS 140-3 validated modules. Third-party accounts are free on Individual. No trial is named. Because it replaces how staff read and send mail, expect a migration rather than an add-on.
What stands out
Free Basic plan
Defence compliance
End-to-end encrypted
Where it costs you
The compliance pitch centres on US defence rules, which is narrow for other buyers.
Gov Community and Business sit behind a quote, so the full bill is only known after contact.
Right for
Suppliers to US defence customers needing CMMC Level 2 encrypted email
Wrong for
Companies outside US defence wanting a gateway on existing mail
Not stated by the vendorFree Basic plan; Individual and PreVeil Pass priced publicly; Business and Gov Community by quote
Ad-hoc secure transfer of mail and large files, now part of Pointsharp
Ranked #8 of 12 in Best Email Encryption Software in 2026.
Pricing on requestElsewhere
Cryptshare is sold as Business and Enterprise editions. Enterprise adds the Java API, .NET API, REST API and Cryptshare Robot for automating transfers between systems, applications and people.
Recipients do not need accounts for ad-hoc exchanges. The brand now sits inside Pointsharp, so check which entity contracts with you. No open-source licence is mentioned, and a live demo is the only listed way in.
What stands out
File transfer
No recipient accounts
Pointsharp
Where it costs you
The page read shows no prices, user limits or file-size limits.
Cryptshare Server hosts the web app, but the page does not say whether that runs on-premises or in a cloud.
Right for
Organisations that need to send large confidential files from Outlook to outsiders
Wrong for
Teams wanting every ordinary mail message encrypted without staff action
Not stated by the vendorBusiness and Enterprise editions; no prices on the page read; live demo offered
Encrypted mailboxes covering subject lines and calendar, own clients only
Ranked #9 of 12 in Best Email Encryption Software in 2026.
Published pricingEurope
Tuta stands out in this category for how much of the mailbox it covers: subject lines and calendar are encrypted together with the body. Hosting is German and prices are published per user each month. The same design closes every door that other products leave open.
IMAP, application sending and third-party apps are all absent, and the export format is understood properly only by Tuta itself. Choose it for a small group with delicate correspondence, and keep another route for any system that must send.
What stands out
Subject lines encrypted
German hosting
No IMAP
Where it costs you
Only its own clients work, so a standard mail app cannot be pointed at it.
Invoicing or alert software needs another sender because outbound mail is not offered.
Exported data is read cleanly only by Tuta, which makes a later switch costly.
Right for
A German-hosted team whose correspondence and diary entries are sensitive
Wrong for
Businesses with automated mail flows from accounting or monitoring tools
Mailboxes the provider cannot read, with limited archiving for regulated teams
Ranked #10 of 12 in Best Email Encryption Software in 2026.
Published pricingEurope
Proton is the pick here when the priority is a provider that cannot read your mailbox. That one decision shapes the rest of the product. Search is done on the device, desktop clients go through Bridge, and the compliance side is thin: archiving, legal hold and journaling are very limited, while retention policies are tied to Workspace Premium, the highest tier.
Pricing is published per user each month and the company is Swiss. Read the retention question first if your sector requires keeping everything.
What stands out
Provider cannot read
Bridge for IMAP
Swiss establishment
Where it costs you
Mail programs on a desktop depend on the extra Bridge application.
Search runs on the device, so results depend on what that machine holds.
Legal hold and journaling are very limited, and retention rules sit on the highest tier.
Right for
A team whose threat model matters more than archiving features
Wrong for
Regulated sectors that have to retain and produce every message
One-click secure email with revocation, now under the Kiteworks banner
Ranked #11 of 12 in Best Email Encryption Software in 2026.
Pricing on requestElsewhere
Plans run on one-year or three-year terms, with a stated saving of 20% for the longer one, and no setup costs are charged up to 50 users. Enterprise is demo-only.
The company says it was born in Amsterdam, but no headquarters address or registration appears on the pages read, and the data-centre location is not stated either. Since the Kiteworks announcement, ask who issues the contract and whether the roadmap stays separate.
What stands out
One-click encryption
Revoke sent mail
Kiteworks banner
Where it costs you
No trial is named, and amounts were not shown in the text read.
The Kiteworks announcement banner raises a question about who will be your contract partner.
Right for
Organisations wanting recipient authentication and revocable sent mail without a gateway
Wrong for
Buyers who need a vendor with no parent group
Not stated by the vendorStart, Professional and Ultimate per user per month, billed annually; Enterprise by demo
Cloud email security platform with certified end-to-end encryption module
Ranked #12 of 12 in Best Email Encryption Software in 2026.
Pricing on requestElsewhere
The home page describes a cloud email security platform and refers to KnowBe4's acquisition of Egress. Encryption sits in the Protect module, with Workspace and Web Form as neighbouring modules, all on a cloud-native API architecture.
Pricing is demo-only, and neither a free plan nor a trial is named. Headquarters country is not stated on the page read. Because the encryption is one module of a larger platform, check which modules your quote includes.
What stands out
Protect module
KnowBe4 company
Cloud-native
Where it costs you
Neither amounts, plans nor a trial are named.
Ownership by KnowBe4 puts the contract with a larger group.
Right for
Organisations already inside a KnowBe4 relationship wanting certified encryption in a wider suite
Wrong for
Buyers wanting a standalone vendor with published prices
Not stated by the vendorDemo only; amounts and plans are not listed
Email encryption software scrambles outgoing messages and attachments so only the intended recipient can read them, through gateways, keys or authenticated web delivery, with administrator policies over what is protected. These are the questions that actually differ between vendors, in the order we would ask them.
01
Work out how much a sales call is worth to you
Prices are public at 6 products (Hushmail, Virtru, Mailfence, PreVeil, Tuta, Proton Mail) and on request at the remaining 6, so budget time for quotes if your favourite is in that second group.
02
Weigh the vendor's home jurisdiction
Headquarters range over 7 countries and 3 regions: Elsewhere 6, Europe 4, North America 2. Legal exposure follows the vendor, not only the data centre, so read the contracting entity before you sign.
03
Check the open source options
1 of these are open source: CipherMail. Hosting one yourself trades a subscription for maintenance.
Email encryption software: gateway, transfer portal or mailbox
Three different products hide under this label. A gateway such as CipherMail encrypts as messages leave, whichever SMTP service carries them, so staff keep their mail system. A transfer product such as Cryptshare sends large files from an Outlook add-in and needs no account for the recipient. An encrypted mailbox such as Mailfence or Tuta replaces where staff read and send mail altogether, and Tuta's design means no IMAP and no SMTP for your applications.
Echoworx sits nearer the gateway end, with policy-driven control over outbound mail and automated S/MIME and PGP key handling. Decide first whether you want to keep your mail system, because that single choice removes half the list. Then compare vendors inside the chosen type only, since a mailbox price and a gateway quote are not the same purchase.
Decide whether to keep your current mail system or replace it
List the applications that send mail, such as invoicing or alerts
Compare prices only between products of the same type
Recipients without keys: what the other side sees
Most outbound encryption fails at the recipient. Zivver authenticates recipients by SMS, access code or email, and lets the sender revoke a message after sending. Hushmail recipients outside the service read messages through a web page. CipherMail drops to its WebMail Messenger fallback when a message cannot be encrypted. Cryptshare says ad-hoc transfers require no user accounts.
Echoworx lists S/MIME and PGP lifecycle automation, which helps where both sides already hold certificates or keys but says little about everyone else. Ask each vendor to walk through a message to a customer who has never used the product, on a phone, and time how many steps it takes. A secure message that recipients refuse to open gets forwarded in plain text, which defeats the purchase.
Send a test message to a recipient on a phone with no account
Count the steps and the authentication method used
Ask whether the sender can revoke or expire a message
Price signals: five users, a trial or a demo
The pricing pages differ more than the products do. Virtru bills Starter, Business and Compliance packages annually with five users included, Paubox gives each of its plans five senders with a 14-day trial, and Zivver sells seats with annual billing on one-year or three-year terms. PreVeil publishes a free Basic plan with 5 GB.
Echoworx, Egress and Cryptshare show no prices on the pages read, only demo routes, and CipherMail directs buyers to contact sales. Compare the entry package including its user minimum, not the headline, and ask what the sixth user costs, since Virtru does not state its extra-user rate. For demo-only vendors, request a written quote for your headcount and mail volume before comparing it with published offers.
Write down the user or sender minimum in each package
Request written quotes from demo-only vendors
Check whether a three-year term changes the unit price
Hosting, ownership and compliance claims to verify
Compliance wording and hosting differ sharply. Paubox keeps data in American facilities only, PreVeil's Gov Community plan keeps everything in AWS GovCloud, and Virtru ranges from managed cloud to an air-gapped, self-managed install. Echoworx cites DORA among its regulatory positioning, while Zivver does not state its data-centre location on the pages read.
Ownership moved for several names here: Egress presents itself as a KnowBe4 company, Zivver carries a Kiteworks banner and Cryptshare now sits inside Pointsharp. A product page can stay the same after an acquisition, but the contracting entity, support route and roadmap may not. Ask for the legal entity on the order form, the data location in the contract and a statement on who owns the product today.
Ask for the legal entity and the data location in writing
Match each compliance claim to your actual regulation
Ask who owns the product and who issues the invoice
What goes wrong most often when buying email encryption software
Buying an encrypted mailbox when the real need was a gateway over the mail system you already run.
Testing only with recipients who already hold keys, so the experience for an outsider on a phone stays unseen.
Comparing a demo-only quote from Echoworx or Egress with a published package without matching users and volume.
Skipping the question of who owns the product after a name like Zivver or Cryptshare moved under a larger group.
07
Frequently asked questions
8 answers
What is the best email encryption software in 2026?
CipherMail leads our ranking of 12. CipherMail B.V. sells one thing: a gateway placed before whatever SMTP mail service you use, encrypting with S/MIME, PGP, TLS or PDF encryption.
The community edition is open source, the commercial licence is the paid route, and a message that cannot be encrypted drops to a web messenger. Prices are unpublished, and that fallback gets one line, so test what recipients see.
Which email encryption tools publish their pricing?
Published pricing exists for 6 products on this page:
Hushmail: Published per-user monthly plans, split by sector.
Virtru: Published annual packages with five users included; Enterprise by custom price.
Mailfence: Published per-user monthly prices.
PreVeil: Free Basic plan; Individual and PreVeil Pass priced publicly; Business and Gov Community by quote.
Tuta: Published per-user monthly prices.
Proton Mail: Published per-user monthly pricing.
Everything else on the list is priced on request.
Is there a free email encryption tool?
PreVeil have a free plan or free self-hosted edition.
Where are these email encryption software vendors established?
In 7 countries across 3 regions: Elsewhere 6, Europe 4, North America 2.
CipherMail: Netherlands.
Paubox: Not stated by the vendor.
Echoworx: Not stated by the vendor.
Hushmail: Canada.
Virtru: United States.
Mailfence: Belgium.
PreVeil: Not stated by the vendor.
Cryptshare: Not stated by the vendor.
Tuta: Germany.
Proton Mail: Switzerland.
Zivver: Not stated by the vendor.
Egress: Not stated by the vendor.
Which email encryption tools are open source?
CipherMail.
Which email encryption tools can you host yourself?
Echoworx. 11 products offer no self-hosted option.
What should you use instead of CipherMail?
Paubox and Echoworx are the next two on this page. Paubox is for Healthcare organisations wanting every outbound message encrypted without staff doing anything; Echoworx is for Regulated firms wanting policy-based encryption with key management handled for them.
Who should not buy CipherMail?
Organisations wanting a hosted mailbox with encryption built in. The site publishes no prices, so budgeting starts with a sales conversation..
Sell email encryption software and missing from the ranking? Send us a line on what the product does and who buys it. Whether it is added is our decision, though commercial arrangements can also affect it, and the terms of a listing sit on the software advice page.
