cTemplar Reviews

We live in a time when social media platforms spy on, fact-check, censor, and ban their users with abandon. Rather than put yourself at their mercy, it’s better to invest in alternative ways of communication, such as email. Touting itself as “armored email,” cTemplar provides an encrypted email service that does not stockpile user data. cTemplar’s servers are stationed in Iceland, which boasts the strongest privacy laws regarding anonymity and user data collection. I decided to find out what’s beneath the claims, which is why I’m doing this cTemplar review.

cTemplar — email encryption service

As Mark Zuckerberg famously said in 2018, “Security is not a problem you ever fully solve.” Tech companies are notoriously lax with security, focusing their efforts on growth and turning a profit instead. As a result, one determined insider can steal data, disrupt services, or jeopardize user accounts. Emails are also vulnerable to intercepting, copying, or deleting en masse. A sensible solution is to use strong data privacy practices: data encryption. The upside of an encrypted email service is that even an insider can’t access or exploit the data. The downside is that encryption is difficult to implement and maintain. In this cTemplar review, I will look at how well the company implemented the different email data privacy practices.

How to use cTemplar?

You must get a cTemplar invitation code. I contacted u/CTemplar-Official on Reddit through direct messages and, within 2 hours, received a free one-time code. The response also contained the link to the official sign-up page, a nice touch that helps avoid phishing. I clicked the link, selected the “Free” plan, typed in my username, chose a password, and finally created my account. Then, I was given a cTemplar email recovery code to enter the account if I lost my password. I was asked to store decrypted data on my local storage temporarily. Since I don’t care about speed when sending a secure email, I checked “Don’t ask anymore” and click NO.

cTemplar email design is nothing special. It uses red, white, and #34495e for the color scheme. The left-hand sidebar contains folders such as Inbox and Draft, while the remaining 85% of the area is reserved for email overview. Clicking “Compose” pops up a messenger-like window for writing. Unfortunately, even when expanded to “full screen,” this window doesn’t cover the entire screen.

Details of cTemplar Features

Now, let’s discover some of its great features.

Payment processing companies, including banks, must abide by two sets of laws — KYC (know your customer) and AML (anti-money laundering). KYC includes asking the client for personal info and proof of residence; AML includes rules that run the gamut from reasonable to superstitious. For example, banks in the US must report money transfers equal to or higher than $10,000 to the IRS. However, if a customer makes a $9,999 transfer and a $1 transfer, that is a crime called “structuring,” punishable under IRS internal rule 4.26.13. How about two transactions for $4,999? Yep, structuring.

The bank must read the customer’s mind, divine the intention behind the transaction(s), and report the event accordingly. AML legislation forces payment processors to stockpile personal data and user logs. Securing all that data costs a lot of money, which most companies don’t have.

So, that data is unsecured, waiting for anyone to waltz in and abuse it six ways to Sunday. cTemplar does away with the AML part of the equation by accepting anonymous payments. This includes Bitcoin and Monero, a dark horse cryptocurrency that appears optimized for privacy.

cTemplar claims to give you the right to instantly delete all your user information, no questions asked. Normally, user information is stored on an internet company’s servers for a few months. This is due to data retention laws intended to help law enforcement agencies.

JavaScript powers the modern internet because I can modify it on the fly. The problem is that JavaScript is notoriously prone to misbehaving because of malfunctioning code or a malicious attacker. When JavaScript is used for encryption, this vulnerability to hacking can defeat the point of having encryption in the first place.

cTemplar uses a JavaScript-free way to verify you’re in the right place. In the “Help” section of the cTemplar website, this is described as using checksums to guarantee the integrity of the index.html file.

cTemplar doesn’t know any of your passwords or has any access to the encryption keys used to process your emails. In other words, cTemplar can’t access your encrypted data and, if any law enforcement agency took the data, cTemplar can’t be compelled to decrypt it.

By default, only the body is encrypted, but other parts of an email can be encrypted, such as the subject and the attachment. In addition, all emails sent from one cTemplar account to another are encrypted, though those sent to non-encrypted email providers (Yahoo, Gmail, etc.) are in plaintext.

Reading the “About Us” section of the cTemplar website reveals its CTO (chief technical officer) is anonymous. Only the alias “The Hidden Hand” and a cartoon avatar reference Alice in Wonderland and The Matrix. This is a neat idea, preventing outsiders from stalking or blackmailing the CTO.

The interface appears to be the biggest offender, especially when composing an email. I advise composing an email in a word processor and then pasting it into cTemplar. Pasting emails from cTemplar to a word processor may be needed, too, as long paragraphs don’t get wrapped.

It also seems that cTemplar is having trouble communicating with other email servers.

The composer has an HTML and a plaintext version. To attach files, add links, and insert images, you need to switch to the HTML version, allowing you to send enriched emails. However, that’s when I experienced problems.

I attached two images, one a 62 KB, 1024 by 768 JPG, and the other a 42 KB, 720 by 458 JPG, and sent the email to my Gmail account. Unfortunately, the first image did not attach, but the other one did. Furthermore, that same email was stripped of all text, which makes me believe there is a bug on cTemplar’s end regarding the HTML composer.

All right, we’re doing this. Here’s how the cTemplar encryption works. Upon making your account, cTemplar’s server creates two keys, strings of numbers, letters, and characters: public and private. If you want to research more on this, it’s called PGP. Beware! It involves a lot of interesting math, but it’s explained poorly, especially on Wikipedia. You can share your public PGP key with everyone, and they can encrypt messages sent to you. They can use your private key to automatically decrypt emails encrypted using the public key and sent to you. Finally, it is tied to and retrieved from cTemplar’s server using your cTemplar password.

The simpler option is to use the baked-in encryption in cTemplar. When composing an email, click the icon of an envelope with a padlock to send an encrypted email. You will be asked to enter a password and a password hint and select the expiration date for the message. Fill out those fields and send the email.

In Gmail, Yahoo, etc., the recipient will get an email with a big red button, “View secure message,” and the password hint. Clicking the button takes the recipient to cTemplar’s website, with a field to input the password. Typing it reveals the message, with the option to reply to the sender and securely download it as an .ASC file that users can send out through the cTemplar user interface.

Clicking the three dots in the email composer and checking the “Attach Public Key” option will attach a file to your email. Users can open ASC files in any text editor. It holds ten lines totaling about 500 characters that look like gibberish. Don’t modify anything in it or copy/paste anything. Single characters or lines are unusable; you need the whole thing. To use the .ASC file, get an external program to encrypt a message using that key.

Download a free program such as GPG4win, which will ask for a donation before downloading it ($0 is a valid amount). Then, install it and launch it. A module of GPG4win called Kleopatra will start. You will import your public PGP key, encrypt a message, and send the result. So, click “Import.”

Select the .ASC file you downloaded, and Kleopatra will process it. Next, click the Recipients tab and then “Encrypt for others” (you may need to uncheck “Encrypt with password”). If all goes well, Kleopatra will automatically fill out the email address field with your cTemplar address, confirming you’re on track.

Go to the Notepad tab, type in your message, and click “Encrypt Notepad.” The program will report if the operation succeeded, giving you a gibberish message that starts with “BEGIN PGP MESSAGE” and ends with “END PGP MESSAGE.” Copy/paste the whole thing (including the BEGIN and END parts) into any email provider and send it to a cTemplar email account.

I tested the sending part using Gmail. After a few tense moments, the email arrived in my cTemplar inbox and was properly decrypted, revealing the message I typed into Kleopatra’s Notepad. YES!!!! If you managed to get this far, a fist pump would be in order. Good grief, that was a lot of work, but that’s how encryption is meant to be. The idea is that you inconvenience yourself and the recipient for an added layer of security in your communications.

One issue with all this is the continuous copy/pasting. When you’re done with encryption, always clear your clipboard (on Windows 10, press Windows Key + V, press the three-dot menu, and click Clear all). People using your device can access your clipboard to see what you copied, but some programs can access it too.

Alternatives to cTemplar

Do you know what beauty is in this industry? That you can find a lot of products for your business. Or personal use. Thus, if cTemplar is not for you, let’s discover some of its alternatives. I’m sure that you’ll find the one for you.

cTemplar vs. ProtonMail

ProtonMail is perhaps the most serious contender for the title of the best private email. But, then, there are the Calendar and Drive functions, encryption, of course.

In September 2021, ProtonMail handed over the private data of one of its users to the French government, leading to the person’s arrest. ProtonMail managed to do it by fingerprinting browsers and keeping IP logs, despite the company’s heartfelt promise stating otherwise. After the scandal, they modified the homepage to read, “we put people (not advertisers) first.”

cTemplar vs. Tutanota

A German-based email provider, Tutanota provides encrypted emails, calendars, and notes. The code is open-source, and there is a free plan. Business plans are available too. One gimmick of Tutanota is that it’s powered by renewable energy. So there’s the option to send a password-protected message like cTemplar. The mailbox has no ads. The design is like Gmail, which eases you into Tutanota, but it’s quite fiddly and requires a lot of mouse clicks for the simplest actions.

cTemplar Review Conclusions

There is a definite need to have more diverse communication methods. Whether you use smoke signals, Morse code, or yodeling, you’ll have more success transmitting your message than through cTemplar. The email composer felt janky. The most basic features did work as expected, but the advanced functions were a dice roll.

These could be teething problems, of course. However, it was stellar when the encryption did work, showing why governments worldwide fear and loathe personal encryption. cTemplar’s effort is evident and could become a serious player in the privacy-oriented communication industry. I don’t think that will happen until a huge scandal jeopardizes US-based tech giants, which is possible. Now that I think about it, I am glad to have made a cTemplar account.

To me, it’s quite clear that cTemplar is an encrypted email service that’s best for private use only. Trying to run it in any enterprise capacity is like pulling teeth. You get data privacy, but the hassle is not worth it. Ultimately, even if you don’t care about encryption, you can use cTemplar as free 1 GB cloud storage, which is worth the few minutes of your time it takes to set it up.