In short. Short definitions of the terms that come up in our guides. Each one links to the guide that explains it in full, or to the standard it comes from.
Encryption
End-to-end encryption
The content of a message is encrypted on the sender’s device, and only the sender and the recipients can decrypt it. Servers still see the addresses, the date and usually the subject. More in What is end-to-end encryption?.
Zero-access encryption
The provider stores the content of your email encrypted with a key it cannot use itself. It still sees addresses, times and, with some providers, the subject, as well as messages without end-to-end encryption: from other services as they arrive, and to other services as they leave. More in What is zero-access encryption?.
Encryption in transit (TLS)
Protects a message on its way between your device and the server and, if both servers support it, between servers. Each server on the way decrypts the message and can read it. More in How email encryption works.
Encryption at rest
The provider encrypts its disks with its own keys. It protects against a stolen disk, not against the provider itself or against someone who has broken into a running server. More in How email encryption works.
Post-quantum encryption
Encryption with algorithms that even a future quantum computer is not expected to break, such as ML-KEM. More in What is post-quantum encryption?.
Hybrid encryption
The name of two techniques. The classic one (PGP, S/MIME): the message is encrypted with a symmetric key, and that key with the recipient’s public key. The post-quantum one: a classical and a post-quantum algorithm agree on the key together, so an attacker has to break both. More in What is post-quantum encryption?.
Harvest now, decrypt later
Collecting encrypted data today in order to decrypt it once a quantum computer can. More in What is post-quantum encryption?.
ML-KEM
A post-quantum algorithm for agreeing on keys, standardized by NIST as FIPS 203 in 2024 [1].
Keys and standards
Public and private keys
A key pair. You share the public key so that others can encrypt to you; the private key stays with you and decrypts. More in What is PGP?.
Key fingerprint
A short string that identifies a key. Comparing it with the key’s owner over another channel shows that you have the right key. More in What is PGP?.
PGP and OpenPGP
A way to encrypt and sign email with a key pair. OpenPGP is the open standard behind it [2]. More in What is PGP?.
S/MIME
The second standard for encrypting and signing email. It uses certificates issued by a certificate authority [3]. More in How to send an encrypted email.
Header protection
A 2025 standard that protects email headers with a signature and hides some of them, above all the subject. Addresses stay visible. Classic OpenPGP and S/MIME do not protect headers [4].
Delivery
Email metadata
Information about a message rather than its text: who, to whom, when and from where. It stays visible even with encryption. More in Email metadata.
STARTTLS
How mail servers switch a connection to TLS. It is opportunistic: if the offer is missing or stripped on the way, mail can travel unencrypted [5]. The server’s certificate is usually not checked, so it can be spoofed. More in How email encryption works.
MTA-STS and DANE
Two ways for a receiving domain to ask sending servers to deliver mail only over TLS with a checked certificate. They work if the sending server supports them; DANE requires DNSSEC [6] [7].
SPF, DKIM and DMARC
Checks that help show whether a message really comes from the domain in its From line. SPF lists the servers allowed to send mail for a domain, but it checks the return address, not the From line [8]; DKIM signs messages on behalf of a domain [9]; DMARC matches these domains against the From line and says what to do with messages that fail the checks [10]. More in How to spot a phishing email.
Sign-in
Two-factor authentication (2FA)
Signing in with a second proof on top of the password: a code from an app or a security key. A passkey usually replaces the password altogether. More in How to protect your email from hacking.
TOTP
Short codes from an authenticator app that change over time, usually every 30 seconds [11].
Passkey
A sign-in credential built on a key pair. The private key stays on your device or in your password manager, and the site keeps only the public key [12, 13].
FIDO2 and WebAuthn
The standards behind passkeys and hardware security keys [12] [13].
Recovery phrase
A set of words for recovering an account. In services with end-to-end encryption and zero access it also restores the keys: without it, or another copy of the keys, old emails can’t be read after a password reset, and the provider can’t decrypt them. Whoever has the phrase can use it, so keep it somewhere safe, apart from your devices. More in What is zero-access encryption?.
SIM swap
Moving someone’s phone number to another SIM card, so that codes sent by text go to the attacker [14]. NIST classes codes over the phone network as a restricted method [15].
Threats and privacy
Phishing
A message that pretends to come from a bank, a service or a friend to get your password, money or data. More in How to spot a phishing email.
Lookalike domain
An address or link that differs from the real one by a letter, a letter from another alphabet, a word or the domain ending. More in How to spot a phishing email.
Alias
An extra address that forwards mail to your inbox and hides your main address. You can turn it off at any time. An address like name+tag@domain is different: it shows your main address. More in What is an email alias?.
Temporary email
An inbox that lasts minutes or hours, for one-off sign-ups. It is often public, so others may read the mail in it. More in Temporary email, alias or private inbox?.
Anonymity in email
What an “anonymous” address can and cannot hide. The IP address, payment, a recovery address and metadata can still give a person away. More in What actually gives a person away in email.
Tracking pixel
A tiny, usually invisible image in an email. When your email app loads it from the sender’s server, the sender learns that the email was opened, when and roughly where, and that the address is active [18]. Until an email’s images load, the pixel tells the sender nothing: it fires when you choose to show them. More in How email tracking pixels work, and how to block them.
One-click unsubscribe
A way to leave a mailing list without leaving your inbox: the list gives an unsubscribe address in the message, and when you click the button, your email app or provider sends the request there itself, with no confirmation pages. Unsubscribing still tells the sender your address is active [19]. More in How to unsubscribe from emails safely.
Secure email
Email that keeps your messages from being read by anyone but you and the people you write to: fully with end-to-end encryption, and in storage with zero-access encryption. More in What makes email secure and private.
Private email
Email that also keeps little about you: who you write to, when and from where. More in What makes email secure and private.
Email files
MBOX
A file that keeps the emails of a folder or a whole mailbox one after another; a mail app shows it as one folder [16]. The file itself isn’t encrypted.
EML
A file with one email: its header, meaning who it’s from, who it’s to, the subject and the date, and the message itself with its attachments [17]. The file itself isn’t encrypted.
Sources
- NIST FIPS 203: Module-Lattice-Based Key-Encapsulation Mechanism Standard. August 2024. https://csrc.nist.gov/pubs/fips/203/final
- RFC 9580: OpenPGP. IETF, July 2024. https://www.rfc-editor.org/rfc/rfc9580
- RFC 8551: S/MIME Version 4.0 Message Specification. IETF, April 2019. https://www.rfc-editor.org/rfc/rfc8551
- RFC 9788: Header Protection for Cryptographically Protected Email. IETF, August 2025. https://www.rfc-editor.org/rfc/rfc9788
- RFC 3207: SMTP Service Extension for Secure SMTP over Transport Layer Security. IETF, February 2002. https://www.rfc-editor.org/rfc/rfc3207
- RFC 8461: SMTP MTA Strict Transport Security (MTA-STS). IETF, September 2018. https://www.rfc-editor.org/rfc/rfc8461
- RFC 7672: SMTP Security via Opportunistic DNS-Based Authentication of Named Entities (DANE) Transport Layer Security (TLS). IETF, October 2015. https://www.rfc-editor.org/rfc/rfc7672
- RFC 7208: Sender Policy Framework (SPF). IETF, April 2014. https://www.rfc-editor.org/rfc/rfc7208
- RFC 6376: DomainKeys Identified Mail (DKIM) Signatures. IETF, September 2011. https://www.rfc-editor.org/rfc/rfc6376
- RFC 9989: Domain-Based Message Authentication, Reporting, and Conformance (DMARC). IETF, May 2026. https://www.rfc-editor.org/rfc/rfc9989
- RFC 6238: TOTP: Time-Based One-Time Password Algorithm. IETF, May 2011. https://www.rfc-editor.org/rfc/rfc6238
- FIDO Alliance: overview page on passkeys. https://fidoalliance.org/passkeys/
- W3C Recommendation: Web Authentication, Level 3. https://www.w3.org/TR/webauthn-3/
- FBI, IC3: Criminals Increasing SIM Swap Schemes to Steal Millions of Dollars from US Public. February 8, 2022. https://www.ic3.gov/PSA/2022/PSA220208
- NIST SP 800-63B, revision 4 (2025): Authentication and Authenticator Management. https://pages.nist.gov/800-63-4/sp800-63b.html
- RFC 4155: The application/mbox Media Type. IETF, September 2005. https://www.rfc-editor.org/rfc/rfc4155.txt
- RFC 5322: Internet Message Format. IETF, October 2008. https://www.rfc-editor.org/rfc/rfc5322
- Mozilla: Remote Content in Messages, Thunderbird Help, updated August 17, 2025. https://support.mozilla.org/en-US/kb/remote-content-in-messages
- RFC 8058: Signaling One-Click Functionality for List Email Headers. IETF, January 2017. https://www.rfc-editor.org/rfc/rfc8058