Runbox Review

Runbox is an email service based in Norway that has been operating for about 20 years (since August 2000).

In this in-depth Runbox review, we’ll examine how the service stacks up against other secure email providers.

Let’s start by covering the Pros and Cons.

https://runbox.com

Note: This Runbox review covers the current version of Runbox. Version 7, which is in beta now, is expected to add several needed features, such as a Calendar and PGP support.

Runbox features overview

Runbox is somewhat behind the curve when it comes to the features it offers. The sections include:

• Webmail
• Contacts
• Files

Interesting features of Runbox include:

• Use of “green” hydroelectric energy wherever possible
• Easy integration with many email services and clients
• SMTP, POP, IMAP, CardDAV support

Runbox company information

The Runbox email service is a product of Runbase Solutions AS, which is based in Oslo, Norway. The email service began as a free service in 2000, and offered 100MB email storage.

The Snowden leaks turned out to be a boon for Runbox. Being based in a privacy-friendly country, with no servers located in the United States (unlike Fastmail). Runbox reported a 34% annual rise in customers in the months after the privacy scandal broke.

While being located outside the Five Eyes countries is a definite plus, Norway is a member of the larger Nine Eyes alliance. Combining this with Norway’s reasonably strong privacy laws tells you that Norway is a better location for an email service than, say, Great Britain or the United States, but not as good as, say Switzerland (home of ProtonMail).

Runbox technical specifications

Runbox uses industry-standard protocols and encryption in its service. These include:

• TLS/SSL with STARTTLS
• SMTPS, POPS, IMAPS
• CardDAV

Runbox hands-on testing

I used the free version of Runbox for this review. The differences between this version and the paid versions turn out to be irrelevant when the goal is to determine if Runbox has the potential to be the secure email service in your future. Ready? Let’s find out.

Signing up for Runbox

Signing up for Runbox was easy and quick. However, there are a couple of things you should be aware of. First, you need to have an alternate email address you can share with Runbox. They will send you a confirmation email as part of the registration process. This is better than services which require a phone number, but makes it hard to sign up anonymously.

Runbox presents itself as a secure and private email service, but makes no pretensions of anonymity.

The second thing to know is that once you create your account, it may take a little while before you can send and receive messages with it. I didn’t put a stopwatch on this, but I would say it took 10-15 minutes before messages would flow to and from my new Runbox account. This isn’t a problem, just something to be aware of before you start worrying that there was a problem with the startup.

The look and feel of Runbox

Runbox has a somewhat old-fashioned interface. This is one of the things that should be addressed when version 7 comes out of beta. As to when that might be, Dave, the co-owner of Runbox, told me:

We don’t have a specific date for a full launch yet. We want to get the features in Runbox 6 that are missing in Runbox 7 done before we have a launch, and that will be done incrementally…

In the meantime, the interface is functional and certainly not a hindrance to getting things done. A menu at the top left of the Runbox window lets you navigate between the sections. As usual, we’ll look at the mail interface (called Webmail in Runbox) first.

Webmail

The Webmail interface uses a two-column view as shown below. If you’ve used any browser-based email program before, you will have no problem figuring out the Runbox interface.

As you can see, you can use the left column to manage your email and resource usage. It supports tagging of messages, and makes it easy for you to create a folder structure that suits your needs.

Composing and sending messages

Composing and sending is straightforward, since Runbox doesn’t offer end-to-end message encryption. Messages passing to and from the Runbox servers are encrypted using TLS/SSL, so any snoop who intercepts them won’t be able to do anything with them. But messages are not encrypted on Runbox servers. This means you must rely on Runbox to protect your messages while they are on their servers. Their servers are located in a secure facility, but as Runbox says:

The only way to ensure that your messages are completely private is to encrypt the content of each message before you even send or receive it through Runbox. This means you are not relying on any technologies Runbox or other services employ, and your message will remain private and secure between you and the people you correspond with.

If true privacy is a priority for you, you’ll want to use third-party apps and PGP to encrypt your messages before they enter the Runbox system.

Note: Runbox may be including PGP encryption in an upcoming version of the service, but until then you are on your own. If using OpenPGP with Runbox is of interest to you, they have a guide here.

Okay, back to the composing and sending… Here’s what the New Message window looks like:

As you can see, the Runbox message editor has some useful features, including an HTML Editor and support for Templates and Signatures.

Runbox Manager

The last major link in the Runbox top of window menu is Manager. Let’s talk about this now, since it is all about email-related capabilities.

1. Retrieve

Although it isn’t obvious at first, Runbox does support importing emails from external accounts such as Gmail or Outlook.com (the mail service formerly known as Hotmail). Click the Retrieve link in Manager to import messages using either the IMAP or POP protocols.

2. Filter

Hitting the Filter link gives you a good collection of options for dealing with incoming messages, including virus scanning, junk mail filtering, Autoreplies, and rules for sending messages into folders or the trash.

3. Access

The Access link takes you to a page where you can configure email forwarding and get instructions on how to access your messages from other devices.

Contacts

Runbox offers a basic Contacts system, which you can see here.

It is nothing fancy, but covers the basics, including importing and exporting your contacts.

Calendar

As you may have noticed earlier, Runbox doesn’t have a built-in Calendar right now.

However, this is one feature that looks definite for Version 7, so if you can wait a bit for this feature, Runbox will be providing it in a while.

Files

As the name implies, this is an area to store any files you want access to through the Runbox interface.

With 100 MB of File storage in the trial version and Gigabytes available in paid versions, this could be a great resource, as long as you don’t mind that the files you store here are not encrypted.

No mobile or desktop apps

Like Posteo, Runbox is purely browser-based. That means no mobile or desktop apps. This is definitely a problem if you want to use Runbox on a mobile device. The browser interface is not responsive or adaptive, making it difficult to use on a mobile device. Here is the basic mail view when opened on a Samsung Galaxy S9+ (Android), rotated sideways to get a better fit:

The text on the physical screen is tiny, even with the phone in HD+ resolution (1480 x 720). Worse, when you scroll down, the Runbox header scrolls off the top of the screen, taking with it the menus and options you need to work with your messages.

In short, you will want to sync your Runbox account with a third-party email client if you plan to make much use of the service on a mobile device. The Access page in the Runbox Manager links to instructions that will help you do this.

The lack of a desktop client is less severe, since a larger, higher-resolution display makes the interface easy to work with. However, be aware that the Runbox header will scroll off the screen on desktop browsers too. So you might want to consider using a third-party email client here as well.

Support

While I found them to be responsive and informative, Runbox Support gets mixed reviews from users. I think much of that comes from their cumbersome problem reporting approach. They offer support by Twitter, email, and a web page, which looks like plenty of options.

However, if you look closely at the Runbox Support Guide, you’ll see that Twitter support is only for general questions. Support through the web page requires you to sign up for an account, then reply to an automated email, then log in to submit your question.

If you want to contact Support via email, you can only do so using your Runbox email account or the alternate email address. Happily, in my test, it only took about 2 hours for Runbox Support to email me an answer to my question.

There is a decent chance you can skip all this by hitting the Runbox Help pages first.

These are reasonably well-stocked with answers to common questions and with any luck will save you from having to deal with the Support team itself.

Runbox pricing and plans

Runbox offers four Main Accounts:

• Runbox Micro: $19.95/year
• Runbox Mini: $34.95/year
• Runbox Medium: $49.95/year
• Runbox Max: $79.95/year

Each one of these plans offers its own number of email accounts, amount of email storage, and file storage. The last three in the list also support using your own domain name, in addition to the runbox.com domain.

You also have the ability to add Sub-accounts to each type of Main Account, along with various addons of additional storage and so on. It can get a bit complicated, but this approach gives you the flexibility to buy exactly the configuration you need.

Runbox goes beyond many services in giving you lots of ways to pay. In addition to the usual Visa, Mastercard, and American Express, they will accept PayPal, International Money Orders, SWIFT wire transfers, Cash, and cryptocurrencies. A definite plus there.

Runbox privacy and logging policy

The Runbox Privacy Policy is a good read if you are seriously considering the service. It describes the jurisdiction Runbox falls under (Norway) and the applicable privacy protection laws. These include:

• Personal Data Act (Norwegian)
• EU General Data Protection Regulation (GDPR)

Runbox maintains server logs as they explain for the following periods:

Server logs relating to email delivery are stored for 10 days, while server logs relating to usage of the web interface are stored for 1 month.

This information is securely stored on the same servers that our services run on. It is not sent to any other company, and we do not pass on statistics to anyone else.

Runbox Solutions’ hosting provider and ISP do not log any traffic to or from our servers.

As we’ve explained before, using a secure VPN provider will ensure your IP address remains hidden regardless of your email service’s logging policies.

The privacy policy also describes how Runbox does not use any third-party tracking, ads, or web beacons. You can read the full privacy policy here.

Should you consider Runbox?

Runbox is a decent email service. I signed up for an account myself in the wake of the Snowden revelations. The system works and the company seems committed to providing privacy and security for its users.

However, Runbox lags behind the competition in a few areas:

• They are behind when it comes to features such as a Calendar or a more modern interface, although hopefully Version 7 will address these issues.
• More importantly, their security model is based on physically protecting the unencrypted data that lives on their servers. In today’s world, where bad actors hack everything and government agents want access to all data, end-to-end encryption is the only way to really keep your data secure.

Until Runbox upgrades their encryption and features, you may want to consider alternatives.

Runbox alternatives

If you shouldn’t use Runbox, who should you consider? My first suggestions are ProtonMail and Tutanota. ProtonMail has more features than Runbox, along with strong security, end-to-end encryption by default, and a vastly larger user base. It also offers a way to send encrypted messages outside the system without the headaches of setting up PGP yourself.

Tutanota is very similar to ProtonMail, but with a strong encryption standard that does not rely on outdated PGP. It offers full encryption at rest and free accounts with up to 2 GB of storage.

Mailfence is another good option, although like Runbox, it also does not store plain-text messages encrypted at rest (but plans to in the future).

Runbox review conclusion

Runbox has a lot going for it, especially considering the good company history, Norway jurisdiction, and privacy-focused corporate values. When it comes to the email service itself, however, it’s not quite on the level of other secure email providers we’ve reviewed.

Once Version 7 of the Runbox client is realeased, this will be a perfectly acceptable general-purpose email service. As it stands now, Runbox may still be a good option for many users, especially depending on your threat model.