Most guides to using email over Tor only get as far as the address. You get the onion address, log in, and that’s that. However, email is different from reading the news or running a search, because an email account is an identity. It has a name, a history and a list of the people you’ve written to. Logging in to it over Tor conceals some of that and leaves the rest just as it was.
It’s helpful to think of three separate things, each with its own protection.
- Where you log in from. Your IP address, your location, the fact that you use this provider at all. This is what the onion protects, and it protects it well.
- Who the account belongs to. The name, phone number, recovery email or payment card that connects the account to you. Once that link exists, Tor can’t help. Only the way you set up the account can.
- What happens to a message after you press send. Whether the content is encrypted, who can see the subject line, and what the other person’s provider does with it. That is decided by the providers at both ends, not by Tor.
Proton Mail and Riseup are the two email providers in our directory, and both run official onion sites. They are very different organisations, and each handles those three layers in its own way. Looking at both through that lens shows you what the onion actually offers and what you have to look after yourself.
The two official email onions#
Both addresses below passed at least 13 of the last 14 daily reachability checks as of October 11, 2026, and both are listed in our Official Onion Mirrors Directory.
| Provider | Address | Proof |
|---|---|---|
| Proton Mail | protonmailrmez3lotccipshtkleegetolb73fuirgj7r4o4vfu7ozyd.onionListed in our directory as Proton Mail (Email).protonmailrmez3lotccipshtkleegetolb73fuirgj7r4o4vfu7ozyd |
TLS certificate |
| Riseup | vww6ybal4bd7szmgncyruucpgfkqahzddi37ktceo3ah7ngmcopnpyyd.onionListed in our directory as Riseup (Email).vww6ybal4bd7szmgncyruucpgfkqahzddi37ktceo3ah7ngmcopnpyyd |
riseup.net |
Proton serves its onion over HTTPS with a certificate issued to the onion name. Riseup uses plain http://, which is still encrypted end to end, as every onion connection is, and Riseup lists the address on its own website. Proton also lists its onion on its own Tor page at proton.me/tor.
Two very different providers#
It’s worth knowing what kind of organisation you’re trusting before you trust it.
| Proton Mail | Riseup | |
|---|---|---|
| Who runs it | Proton AG, a company based in Geneva | The Riseup collective, a volunteer-run activist organisation |
| How you get an account | Open sign-up, with free and paid plans | Invite code from an existing Riseup user |
| What the onion covers | Proton Mail and other Proton services such as Drive and Calendar | Every Riseup service has its own onion |
| Stored mail | Encrypted so that Proton says it can’t read it | Encrypted as it arrives, and only decrypted when you log in |
| Your IP address | Not visible to Proton when you use Tor | Riseup says it doesn’t log the IP address of anyone using its services |
| If you lose your password | Recovery methods you set up in advance | Only your recovery code. Riseup says it can’t help otherwise |
| Mail clients | Web, apps, and Proton Bridge for desktop clients | Webmail, and Riseup recommends Thunderbird |
Proton is the better known of the two. Its Tor page says the onion gives you access to all Proton services, and sets out the advantages Tor provides. Your network can’t easily see that you’re using Proton, it’s harder for an attacker to sit in the middle of your connection, Proton itself can’t see your real IP address, and you may still reach it even if Proton is blocked in your country. Proton is also open that most people won’t need it, and that it’s mainly intended for people in sensitive situations, such as activists.
Proton is also a company operating within a legal framework, and that framework has been under debate. In 2025, Proton said it was moving part of its physical infrastructure out of Switzerland because of a proposed Swiss surveillance law, beginning with its Lumo AI service, and later made clear that a wider move would depend on how the proposal was resolved. Proton has maintained that the security of its services rests on encryption, not on Swiss law alone. For up-to-date information, check its blog.
Riseup is a completely different kind of provider. It is a collective that has served activists for many years, funded by donations rather than subscriptions. That shows in its design. Every service has an onion address, it doesn’t record users’ IP addresses, and when you send mail to another activist provider, Riseup says it is delivered over Tor onion services. The trade-off is access. Email accounts need an invite code from an existing user, and because of spam, Riseup currently only lets accounts that are several years old create invites. Riseup support won’t hand out codes.
Layer one: where you log in from#
This is the layer the onion was designed for, and it does the job well.
If you use Proton or Riseup through its onion in Tor Browser, your network provider sees only that you’re using Tor. It won’t know that you have an email account at all, let alone which one. The email provider sees a connection coming from inside the Tor network, with no IP address that leads back to you. And because the connection never leaves the Tor network, there’s no exit relay in the middle that could interfere with your login page. For a service where you type a password every day, that last point matters more than it does when you’re just reading the news.
The onion also keeps working where the normal websites are blocked. Proton says this directly on its Tor page. If a government blocks a provider’s domain, the onion can’t be blocked by name, only by blocking Tor itself, and our guide to bridges, Snowflake and WebTunnel explains how to deal with that.
Webmail needs JavaScript#
Modern webmail works as a complete application running inside your browser, and it depends on JavaScript. That means you’ll need Tor Browser’s Standard or Safer security level. At Safest, expect your inbox not to load.
It’s a real trade-off, since JavaScript is involved in many browser attacks. The sensible course is to use Safer for webmail, keep Tor Browser up to date, and avoid browsing unfamiliar sites in the same session. Our guide Tor Browser Security Levels: Standard vs Safer vs Safest explains what each level switches off.
One account, one session#
Tor Browser keeps websites separate from each other, but you still shouldn’t mix identities in a single session. If you log in to a personal account and an anonymous one, or read your email and then go on to browse something you’d rather keep separate, use New Identity in between. It closes everything, clears cookies and gives you fresh circuits.
Apps and mail clients#
The onion only protects you in Tor Browser, or in software set up to use Tor. Proton’s mobile and desktop apps connect over the regular internet unless you route them through Tor yourself. On Android, the Tor Project’s Tor VPN can send chosen apps through Tor, as we explain in Using Tor on Android and iPhone. Install email apps only from the official stores and check the developer name, because lookalike apps are common, as we cover in Fake ‘Dark Web’ Apps in 2026. Riseup recommends the Thunderbird email client and publishes onion addresses for its mail servers too, so a client set up for Tor never touches the open internet. If you’d like that set up for you, Tails comes with Thunderbird and routes all traffic through Tor. See Tails 7.14.
Layer two: who the account belongs to#
This is the layer people most often get wrong, because Tor can’t fix it after the fact. If an account is already linked to your name, logging in through an onion hides where you are today. It doesn’t disconnect the account from you.
There are a few ways in which an email account gets connected to a real person.
- The details you give at sign-up. A phone number, a recovery email address, your real name in the profile.
- How you pay. A paid plan bought with your bank card ties the account to your bank.
- Where you’ve logged in from before. One login from your home connection, without Tor, can be enough. Providers generally don’t keep IP logs by default, but they can be ordered to start. In 2021, Proton was compelled under Swiss law to record the IP address used by a French activist’s account. It complied, and the activist had not been using Tor.
- What you do with it. The people you write to, the name in your signature, the newsletters you sign up for. Over time, an account describes its owner.
Proton’s sign-up#
Proton offers open sign-up and lets you create a free account through its onion. To prevent abuse, Proton sometimes asks new users for extra verification, for example a CAPTCHA or a code sent to another email address or phone number. People using Tor are more likely to be asked. If you want an account that isn’t linked to you, think carefully before giving a phone number or a personal email address, because that detail then becomes part of the account’s history.
The same applies to recovery. A recovery email or phone number is convenient, but it’s another link to you. Proton also offers a recovery phrase, which you write down and keep somewhere safe instead. If you choose a paid plan, Proton has accepted payment methods that don’t need a bank card, but check its current options before relying on one.
Riseup’s sign-up#
Riseup asks for far less. Beyond the invite code, there’s no phone number to give, and recovery works only through a recovery code that you save yourself. Riseup is clear about this. If you lose that code and your password, nobody can get you back in. The invite code does link you to whoever gave it to you, at least as far as Riseup can see, so bear that in mind if the person who invited you is known to be connected with you.
Keep an anonymous account anonymous#
If you need an email address that isn’t linked to your real identity, the rules are simple and strict.
- Create it over Tor, and only ever use it over Tor. A single slip from your regular connection undoes everything else.
- Give nothing personal. No real name, no personal phone number, and no recovery address that you use anywhere else.
- Don’t mix it with your real accounts. Don’t forward mail between them, don’t email your own contacts from it, and don’t sign up for services you also use as yourself.
- Keep it separate in your head as well. Use a different writing style, a different signature and different topics, because small habits link accounts just as effectively as IP addresses do.
None of this is unusual or suspicious. Journalists, researchers and people leaving abusive relationships all keep separate email accounts for good reasons. Using Tor and pseudonymous email is legal in most countries, though not all, as we explain in Is Tor Legal? Using Onion Services Responsibly.
Layer three: what happens after you press send#
Here is the part Tor has no say in at all. The onion guards the route between you and your provider. Once you press send, the message travels from your provider to the recipient’s provider over the normal email system, and what happens next depends entirely on the two providers involved.
When both ends use the same kind of provider#
This is where privacy-focused email proves itself.
- Proton to Proton. When Proton users write to each other, the messages are automatically end-to-end encrypted. Proton can’t read the message body, and neither can anyone between the two accounts.
- Riseup to other activist providers. Riseup says that when you send mail to another activist email provider, it’s delivered over Tor onion services. That keeps the journey between the two providers inside the Tor network, encrypted, with the metadata hidden from anyone watching the internet in between.
When the other person uses an ordinary provider#
Most of the people you email won’t be using Proton or Riseup. When you write to someone at an ordinary provider, the message arrives there as normal email. Their provider can read it, store it, scan it and pass it on if asked. Neither Tor nor your choice of provider can change that. Proton offers password-protected messages for outside recipients, and both providers let you use PGP encryption if the other person can too. Otherwise, assume the far end can see everything.
What’s never fully hidden#
Even between Proton users, some details can’t be hidden from the providers, because they’re needed to deliver the mail.
- Who wrote to whom, and when. The providers carrying the message have to see the sender, the recipient and the time.
- The subject line. Proton says subject lines aren’t end-to-end encrypted. Treat the subject as something your provider could see, and keep anything sensitive out of it.
- Riseup’s storage model. Riseup encrypts incoming mail as it arrives and only decrypts it when you log in. That protects stored mail well, but it isn’t the same as end-to-end encryption between two people.
What’s inside the message#
The content itself can give you away even when nothing else does.
- Attachments carry metadata. Documents and photos can contain author names, edit histories, device details and, for photos, location. Remove or check that metadata before sending anything you don’t want traced.
- Images can report back. Many marketing emails contain tiny images that tell the sender when and where the message was opened. Make sure your provider’s setting for loading remote images is turned off.
- Links can be traps. Asking you to log in through a link is one of the oldest phishing tricks, and onion users are no exception. A fake Proton or Riseup login page on a lookalike onion address will happily take your password. Our guide to onion phishing and fake mirrors shows how convincing those copies can be, and Why Most ‘Hidden Wiki’ Lists Are Full of Scams explains where many of them come from. Always log in from your own bookmark, never from a link in an email.
If you want to pass something sensitive to a journalist, email isn’t the right tool. Many newsrooms run SecureDrop for exactly that purpose, as we explain in News Onion Sites: BBC, DW, The Guardian and SecureDrop.
Account hygiene over Tor#
When you use Tor to reach your email, these are the habits that help keep the account safe. They all take very little time, and most only need doing once.
Bookmark the onion, and only log in from the bookmark. Copy the address from the table above, check all 56 characters against the provider’s own website, and save it. After that, never log in through a link, a search result or an email. A search engine is the most obvious place for a fake login page to appear, which is one reason we cover the official search onions in Search Engines With Official Onion Sites. If you want to check an address yourself, see How to Verify an Onion Address Is Official.
Use a strong, unique password and two-factor authentication. Tor protects your connection, but it does nothing if you reused your password on a website that leaked it. Proton supports two-factor authentication, and an authenticator app is a better second factor than a text message, which ties the account to a phone number.
Keep your recovery details somewhere safe. With Riseup, the recovery code is the only way back in. With Proton, a recovery phrase avoids linking the account to another email address or phone number.
Pick the right security level, then stick with it. Webmail needs Standard or Safer. Choose one, and don’t switch back and forth during a session, since that makes your browser more noticeable than it needs to be.
Don’t open attachments while you’re online. Documents can make your computer fetch content outside Tor when you open them. Download them first, then disconnect and open them, or open them inside Tails.
Log out and use New Identity when you’ve finished. That ends the session, clears the cookies and makes sure the next thing you do in Tor Browser starts fresh.
Keep Tor Browser up to date. Webmail means running a lot of JavaScript, so browser security updates matter more here than in most situations. September 2026 was a good example, as we explain in Tor’s September 2026 security fixes and the Tor Browser 15.0.24 release notes. If you’re not using Tor Browser yet, follow How to Download and Install Tor Browser Safely.
Don’t install anything extra. Add-ons such as mail notifiers and translation tools make your browser stand out and can leak information. Tor Browser is safest exactly as it ships.
Where to go next#
- Want private search to go with private email? See Search Engines With Official Onion Sites: DuckDuckGo and Brave.
- Worried about fake login pages? Read Onion Phishing: How Fake Mirrors Clone Real Addresses.
- Not sure which security level to use for webmail? See Tor Browser Security Levels: Standard vs Safer vs Safest.
- Want every verified onion in one place? Browse the Official Onion Mirrors Directory, including the Tor Project’s own official onion sites.
- New to onion services? Start with What Is an Onion Service? .onion Addresses Explained, or find out how we verify every address in About thehidden.wiki.
Sources#
- Access all Proton services with the Tor anonymity network, Proton, read October 13, 2026
- Riseup Email, Riseup
- How do I get an account?, Riseup support
- How do I generate an invite?, Riseup support
- Proton confirms gradual exit from Switzerland over surveillance law fears, CyberInsider, 2025, including Proton’s later clarification
- Proton refuses to be ‘held hostage’ by controversial Swiss surveillance law, Tom’s Guide, 2025
- Real-World Onion Sites, daily status checks to October 11, 2026