CiberProteção

    Privacy

    Moving to a secure email provider, step by step

    Email is the master key to every other account, which is why people move it to providers that encrypt stored messages and do not profile them for advertising. The migration is straightforward if you do it in the right order, and the benefits are real as long as you understand their limits.

    By Rui Matos · Cybersecurity Editor · Updated 18 September 2026

    What encrypted email actually protects

    Providers such as Proton Mail, Tuta and Mailfence encrypt your mailbox so that the provider cannot read stored messages. Between users of the same provider, messages are end-to-end encrypted automatically. That protects you against provider-side data mining and limits what a server breach can expose.

    It does not encrypt messages you send to an ordinary Gmail or Outlook address unless you use a password-protected message feature or the recipient supports the same standard. Subject lines and delivery metadata are also generally visible. Encrypted email is a meaningful improvement, not a cloak.

    Choosing a provider

    Proton Mail is the most complete option, with a mature ecosystem covering calendar, storage, VPN and a password manager, Swiss jurisdiction and a usable free tier. Tuta encrypts more of the mailbox including subject lines and is cheaper, with the trade-off of no standard IMAP support on lower tiers. Mailfence suits people who want OpenPGP key control and standard protocol access.

    Decide on three points: whether you need a custom domain, whether you require IMAP for a desktop client, and how much storage your archive needs.

    • Custom domain support if you want a lasting address
    • IMAP or bridge access if you use a desktop client
    • Storage large enough for your existing archive
    • Jurisdiction and published transparency reports

    Migrating without losing mail

    Start by importing your existing mailbox using the provider's import tool, which copies messages and folders from Gmail or Outlook over a few hours. Import contacts and calendar separately. Do not delete the old account: keep it active as a forwarding address and a recovery route.

    Set forwarding from the old address to the new one and an autoreply announcing the change for a month or two. That catches the correspondents you forget.

    Changing the address on your accounts

    Work through accounts in order of importance rather than alphabetically. Banking, government services, your password manager, cloud storage and social accounts first; newsletters and shops last, or never.

    For each one, change the address, verify it, and confirm that two-factor recovery still points somewhere you control. This is the step people skip, and it is the reason an otherwise clean migration ends in a locked account months later.

    • Banking and government services first
    • Password manager and cloud storage next
    • Verify each change before moving on
    • Recheck recovery phone and backup email on every account

    Securing the new mailbox

    Your email account is now the most valuable credential you own. Give it a long unique password from your password manager, enable the strongest second factor the provider supports, ideally a passkey or hardware key, and save the recovery codes offline.

    Consider a custom domain. It costs little and means that if you ever change provider again, your address stays the same and none of this work has to be repeated.

    Frequently asked questions

    Will encrypted email protect messages I send to Gmail users?

    Not automatically. Those messages are protected in transit but readable at the recipient's provider unless you use a password-protected message or shared encryption keys.

    Should I delete my old Gmail account?

    No, or at least not for a year. Keep it as a forwarding address and recovery route until you are certain every important account has been updated.

    Is a free encrypted mailbox good enough?

    For a personal address, often yes. Paid tiers add storage, custom domains, more addresses and desktop client access.

    Can I keep using Outlook or Thunderbird?

    Depending on the provider and plan, through IMAP or a bridge application. Check this before choosing, because it is a common surprise.

    Does a secure provider stop spam and phishing?

    They filter both, but no provider stops all of it. Encryption protects stored content; it does not judge whether a message is honest.