No threats detected
All checks passed. This site appears legitimate — but always stay alert for phishing even on trusted domains.
Is app.tuta.com legit or a scam?
Official Tuta Mail login portal — legitimate encrypted email service operated by registered German company Tutao GmbH since 2011.
Analysis Summary
MT Intelligence
Tuta Mail is a well-established, open-source encrypted email service run by Tutao GmbH, a German company registered since 2011 with verifiable business registration (HRB 208014, Hannover). The app.tuta.com subdomain is the official web login interface, directly linked from the main tuta.com domain and confirmed across Wikipedia and official documentation. Our scan shows a valid SSL certificate, clean browser blocklists, and zero abuse reports on the hosting IP. While the evidence package includes a small number of negative reviews on independent aggregators (including one suspicious May 2026-dated complaint claiming account compromise), these are vastly outweighed by positive user feedback praising the service's security, privacy, and open-source model. The company actively documents phishing threats targeting its users and advises customers to use only official domains — a sign of legitimate security awareness, not deception.
Website Preview
Automated page render — captured in a safe sandbox. What an ordinary visitor would see when loading the site.
Web Research Findings
Our live research agent queries scam-report databases, consumer-review sites, news coverage, and general web search for app.tuta.com, then cross-checks business-registration records and look-alike domain patterns. Everything below is pulled from what it actually found.
- app.tuta.com is the official web app for Tuta Mail, a German end-to-end encrypted email service launched in 2011, with over 10 million users.
- Operated by Tutao GmbH, registered in Hannover, Germany (HRB 208014) since 2011/2012; company address Deisterstr. 17a, 30449 Hannover.
- Service is open-source (github.com/tutao/tutanota), available on Google Play, Apple App Store, and emphasizes quantum-safe encryption and no tracking.
- Trustpilot page for tuta.com shows mixed reviews (around 3.9-4.0/5 from ~360 reviews); includes one May 2026 complaint claiming account compromise labeled as "TUTA EMAIL SCAM".
- Reddit contains both criticism (spam marking, support issues, "scum" post) and discussions of phishing attempts impersonating Tuta.
- Tuta's own blog and support pages actively document and warn about phishing scams targeting their users, advising use of correct domains like tuta.com or app.tuta.com.
- No evidence of app.tuta.com being a malicious clone or typosquat; it is directly linked from tuta.com and described as the login portal.
- Trustpilotopen
"HORRIFIC TUTA EMAIL SCAM TUTA EMAIL SCAM: HORRIBLE BUSINESS After I signed with Tuta email service on May 21/2026, the scammers hacked my computer and the email itself."
- Redditopen
"tutanota.com (tuta.com) security and privacy is a scum. Don't consider this service if you need an email."
- Trustpilotopen
"I am surprised about the bad reviews here. From my point of view Tuta does exactly what promised: secure, private and easy emailing. I like the apps and ui ..."
- Tuta.com pricing pageopen
"Thanks for being a solid company, I'm very happy to have switched from proton since Tuta handles several things (green energy, fdroid app, linux app) way better."
- Wikipediaopen
"Tuta, formerly Tutanota, is an end-to-end encrypted email and calendar app and a freemium secure email service run by Tutao GmbH, a German company established in 2011. ... Over 10 million users."
Tutao GmbH, registered HRB 208014 at District Court of Hanover since 2011/2012, located at Deisterstr. 17a, 30449 Hannover. Open source on GitHub, apps on Google Play and Apple App Store.
Our research confirmed app.tuta.com as the official login portal for Tuta Mail, a legitimate encrypted email service. Tutao GmbH, the operating company, is registered in Hannover, Germany (HRB 208014) since 2011 and maintains active business status. The service is open-source, available on major app stores, and emphasizes quantum-safe encryption. Independent review aggregators show mixed ratings (~3.9–4.0/5 from ~360 reviews), with the majority of feedback positive. Negative mentions include general service complaints and one suspicious May 2026-dated claim of account compromise on independent review aggregator, but these are vastly outweighed by positive user testimonials. The company actively documents phishing threats targeting its users and advises customers to use only official domains, demonstrating legitimate security awareness.
Security Scans
Checked against the major public blocklists used by browsers and security tools — no hits.
Contact Verification
We fetched the page and looked for real-world contact details. Legitimate businesses almost always publish an email on their own domain, a phone number, and a postal address. Scam shops usually don't.
- No contact email found anywhere on the page.
- No phone number listed on the page.
- No postal address visible on the page.
Domain & Encryption
Redirect Chain
- 1301http://app.tuta.com/
- 2200https://app.tuta.com/
Server Reputation
Still, stay alert
No major threat indicators — but a clean scan does not guarantee every page is safe, and phishing emails routinely spoof real domains.
- Double-check the exact URL in your address bar
Confirm you are actually on app.tuta.com and not a lookalike like a-pp.tuta.com.com or an IDN homoglyph.
- Use a password manager
Password managers only auto-fill on the exact domain they were saved for — they refuse to fill lookalike domains, which is the single best phishing defence.
- OpenDiscuss this site on the forum
If you have first-hand experience with this site — good or bad — share it with the MalwareTips community.
Reputation Sources
How this domain rates across independent threat-intelligence and blocklist providers.
Safety FAQ
Common questions about this site, answered directly from the scan data above — so the answers always reflect the latest verdict on this page.
- Our automated security review found no threat indicators on app.tuta.com. The site appears legitimate based on the signals we checked, but always stay alert for phishing emails that spoof real domains.
- app.tuta.com passed our automated security checks with a trust score of 84/100. No antivirus engines or major blacklists flagged the site at the time of the last scan.
- Yes. app.tuta.com presents a valid TLSv1.3 certificate issued by Let's Encrypt · E8, expiring in 21 days. Note that SSL only encrypts the connection — it does not guarantee that the site itself is trustworthy.
- app.tuta.com is 29.0 years old, registered on 6/14/1997 through INWX GmbH. Scam domains are often freshly registered — a site under 6 months old warrants extra caution.
- No. app.tuta.com is not currently listed on the major browser blocklist feeds that modern browsers use.
- app.tuta.com resolves to an IP operated by Tutao GmbH in DE (usage type: Data Center/Web Hosting/Transit). Hosting location alone doesn't make a site good or bad, but unusual geography for a brand's claimed country is one of many signals we weigh.
- We cache results for 24 hours. Signed-in MalwareTips members can trigger a manual rescan at any time using the "Rescan" button on the report page, which re-runs every check from scratch and refreshes this page.
User reviews & comments(0)
Share your experience — "Lost $200 on a fake checkout" is more useful than "Scam". Your review helps others avoid traps.