Send encrypted emails easily and securely

OpenPGP (short for “Pretty Good Privacy”) is the open-source gold standard for fast and secure end-to-end email encryption, which is why GMX relies on it. OpenPGP has never been cracked, making it extremely secure. When emails are encrypted using OpenPGP, the sender, recipient, subject, metadata, and the contents are made completely inaccessible to unauthorised parties.

PGP email encryption is done by using two complementary keys: one public key for encryption and a private key for decryption. The public key “locks” the message of the person you’re communicating with so that only the person with the private key can decrypt and read it. That’s why it’s so important for the private key to be kept secret. The use of these interdependent keys guarantees the highest level of security.

PGP email is an encryption procedure that is recognised all over the world, making it an ideal method for carrying out encrypted communication across countries and systems. Other methods of encrypting emails only make it possible with one-way communication inside the encryption program and fail to make their process transparent. In contrast, OpenPGP has made sure to make its procedure and functionality completely transparent.

GMX makes its encryption procedure transparent by disclosing how the process works as well as the source code behind it. Plus, it’s audited by independent external security experts. You can therefore rest assured that the security of GMX encryption can be counted on, even with its more user-friendly procedure.

GMX has deliberately chosen browser-based encryption since that’s the only sure way of providing true end-to-end encryption. That’s because encryption using the browser-based method takes place on the user’s computer and not on the provider’s end. By partnering with Mailvelope, GMX’s encryption procedure ensures that the encryption technology is kept separate from users’ data.

Mailvelope’s browser extension provides even more security options. While taking part in encrypted communication, the graphical security background, which can be customised by the user, is displayed during all stages. This means that users can easily check to make sure their window has not been altered. Mailvelope’s security protocol, yet another security feature, can also be viewed in settings. The security protocol logs all actions the user has taken with regard to the browser extension. When the user accesses the extension via the secured window, the browser extension displays an ‘OK’.

Yes, the attachments you include in your encrypted email, like photos, documents and other files, are also encrypted using OpenPGP.

Your keys are created and managed by Mailvelope but stored locally in your device’s browser extension. This means that they cannot be accessed from outside your device.

No. All important data is stored by the user thanks to the browser-based method. No government agency, nor GMX or Mailvelope can access the content of your encrypted emails. This makes even court decisions demanding data delivery ineffective.

No. Content that has been decrypted is only temporarily and locally visible on a device. The email must be decrypted every time it is opened.

With email encryption in Europe, the email is protected even if it leaves the secure European email network. That is, encrypted communication complements transport encryption. This ensures complete data protection, even when emails are sent abroad to regions with weaker regulations and without encrypted connection paths. This is because only the authorised recipient will be able to decrypt the message.

With browser-based encryption, GMX can ensure that the encryption takes place locally on the user’s computer and not in GMX’s infrastructure, unlike with the server-side method. Because of the partnership with Mailvelope, all data relevant to your security like keys or the respective passwords are outside of GMX’s access. The separation of encryption technology and user data is thereby ensured.

OpenPGP is the gold standard for encryption and is used worldwide, making it compatible with a variety of different systems while providing top-notch security. OpenPGP is transparent with regard to its source code and functionality. It is also monitored by external security service providers.

Yes. External and independent security service providers reviewed the encrypted email process.

Yes. You can use the PGP check number, or “fingerprint”, to do this. Once you confirm a new contact to whom you would like to send encrypted emails, an ’i’ will appear next to their email address. Click on the ‘i’ to show their fingerprint. Have them confirm their fingerprint in person or over the phone in order to verify that the key actually belongs to your contact.

Yes. To guarantee their authenticity, GMX uses its public key to sign all the keys stored in the Key Directory. To verify that GMX has signed a certain key, import the GMX key through the options in the Mailvelope browser extension. The corresponding fingerprint is: C394 C011 0A17 0954 47F1 5F0D 1DA4 1713 9553.

By default, all encrypted emails include the digital signature of the sender. This signature states that the email comes from the sender and that the content of the email has not been manipulated or altered during transmission. To verify whether a signature is valid, simply look in the lower left-hand area of the encrypted email.

Yes, as long as the recipient also uses OpenPGP, you can send emails to them in encrypted form.

Those encrypted emails that were sent to you can be found in your Inbox as usual. Those sent by you can be found in your 'Sent' folder. To make it easy for you to tell which emails are encrypted, we’ve marked them with a lock icon.

Emails that you’re reading or writing feature a customisable colourful background when they’re encrypted. Your browser extension will also display an ‘OK’ to indicate when you’re accessing the extension through the security window. For more information, please visit our help page about receiving and reading encrypted email.

Yes. Keep in mind, however, that the copied content is decrypted in the cache, meaning that it can be retrieved even after you have logged out as long as you have not emptied or overwritten the cache.

As long as you set up encrypted communication with the destination mailbox, you should be able to also read the forwarded encrypted emails. However, if the destination mailbox is with a different provider, encrypted communication may not be offered with them or they may have a more complicated setup process.

The GMX Key Directory stores your public key by default after you have set up encrypted communication. This is done to simplify communication. Your public key is made available when you enter a recipient’s address. If you do not wish for your key to be stored in the Key Directory, revoke your consent under ‘Encryption’ > ‘Privacy’ in ‘Settings’.