Cock.li offers free encrypted email with no logs and Tor support. This review examines its privacy guarantees, operational risks, and practical use for Monero users in 2026.
Cock.li runs a no-frills email platform that lets users create addresses on its own domains. The free tier supplies basic mailbox functionality without paid upgrades or feature tiers.
Accounts support IMAP, SMTP, and webmail access, so messages can be retrieved through standard desktop or mobile clients as well as the site interface. Storage is capped at a modest level that requires users to delete older mail periodically to stay within limits.
Registration needs only a chosen username, one of the available domains, and a password. No phone number, recovery email, or identity check is collected at creation time.
The service states it keeps messages until the owner deletes them and does not maintain long-term IP or connection logs tied to accounts. Active mailboxes stay on the servers without automatic expiration, though inactive accounts may eventually be removed according to the posted policy.
Users can open multiple addresses across the different domains the platform offers, all managed under the same free model. No paid storage expansion or custom domain hosting is provided.
Cock.li supports OpenPGP for client-side encryption of message bodies before transmission. Users control their own keys, so the provider never sees plaintext content. The service states it maintains no logs of IP addresses or message metadata beyond basic delivery records.
Login and sending are available through a Tor .onion address. This prevents the provider from observing the connecting IP and blocks clearnet exit-node surveillance that standard email providers expose by default.
These controls matter for Monero users who exchange node addresses, transaction details, or multisig coordination via email. Clearnet providers retain timestamps and originating IPs that can be matched against blockchain data or subpoenaed. An onion endpoint plus no-logs policy removes that linkage at the transport layer.
Encryption and Tor access do not protect against endpoint compromise or voluntary key disclosure by either party. They also leave the unencrypted subject line and recipient metadata visible to the provider in the same way as any other SMTP system.
Cock.li operates as a single-admin service with no formal account recovery beyond the recovery code issued at signup. Losing that code permanently locks the mailbox; there is no password reset email, support ticket, or identity verification path.
Every login and SMTP submission occurs over clearnet DNS. Even when the connection is TLS-encrypted, the initial resolver query and subsequent MX lookups expose the domain and timing to any observer on the path, including the user’s ISP or a local network adversary.
The service is hosted under German jurisdiction. German authorities have historically compelled disclosure of user data from small providers when presented with a court order, and Cock.li has no published policy refusing such requests. A subpoena can therefore surface creation IP, last login IP, and any stored recovery information without notice to the user.
Metadata and IP leaks occur at three routine moments: webmail login without an active Tor circuit, SMTP submission from a non-Tor client that includes the real IP in Received headers, and any clearnet DNS lookup performed by the mail client before Tor is engaged. In each case the operator’s logs or an intermediate network can link the Monero user’s activity to a real-world IP address.
| Feature | Cock.li | Proton Mail | Tutanota | Self-hosted |
|---|---|---|---|---|
| Cost | Free, XMR donations accepted | Free tier; paid from €4/mo | Free tier; paid from €3/mo | VPS + domain, €5-20/mo |
| Tor support | Native .onion access | Via Tor Browser only | Via Tor Browser only | Configurable onion service |
| Account recovery | None; permanent loss on key loss | Recovery email or code | Recovery code or email | Depends on setup; often none |
| Monero-specific usability | Direct XMR payments accepted; registration-free | Fiat or crypto via third parties | Fiat or crypto via third parties | Pay VPS in XMR where possible |
Cock.li removes sign-up friction that Proton Mail and Tutanota retain through their free tiers. Those services require a recovery method, creating an identifier that can later link activity. Self-hosted solutions eliminate the provider entirely but shift every operational risk onto the operator, including IP exposure during VPS payments and server maintenance.
Monero users gain the clearest edge with Cock.li because the service accepts direct XMR donations without intermediaries. Proton Mail and Tutanota route crypto payments through processors that may still collect metadata. Self-hosting lets you pay a VPS host in XMR, yet you must also manage Tor configuration, TLS certificates, and backup keys without any external support.
Trade-offs appear in daily use. Cock.li offers no mobile app or calendar integration, while Proton Mail and Tutanota bundle those features. Self-hosted instances can replicate them with additional software, increasing attack surface. Choose based on whether you prioritise zero account creation or full feature sets.
Creating and maintaining a cock.li address for Monero-related activity requires strict isolation from the start. Begin by routing all traffic through the Tor Browser; never access the site on a clearnet connection or from a device tied to your identity. Register the account using only the minimal required fields and generate a long random password stored exclusively in an offline password manager.
These steps reduce but do not eliminate the risk that the email provider itself becomes a single point of metadata collection.
No. Cock.li allows registration with only a username and password. No phone, ID or recovery email is collected at signup.
Yes. Most Monero-related services accept any email address for notifications or 2FA. Cock.li works for receiving transaction alerts or exchange confirmations without additional verification.
The provider states it keeps minimal logs. However, Tor or a VPN is still required at login to avoid exposing your real IP to the mail server.
Accounts can be closed without notice for abuse or policy violations. Always maintain an encrypted backup of important messages and consider a secondary address on another provider.
It offers strong resistance to casual subpoenas but remains a single point of failure. Combine it with client-side encryption and regular rotation of addresses for higher-risk activity.
