Which offers a higher level of safety: Webmail or using a POP3/IMAP client?

Assume the following for webmail:

  • Access via HTTPS
  • Rarely downloading any attachments, but in cases where it may be necessary, carefully verifying the integrity and authenticity of the attachment after it has been downloaded

Assume the following for POP3/IMAP client:

  • Always using the latest version of the client
  • Rarely opening attachments (the client will still download all of them), but in cases where it may be necessary, first carefully verifying the integrity and authenticity of the attachment

In both cases, assume the OS has the latest security patches applied.


I can't see difference if we are talking just about data transfer. If HTTPS, POP3S, IMAPS and SMTPS protocols are in use of course. Always use secured versions of protocols.

If we are talking about software - browser or the client, thats the same. Use patched software, all the time. The hole can be in both, web browser and mail client too.

Never opening attachments can't make the email more secure. It will make it useless. If you would state: never opening suspicious attachments it would sound better.

What I can see as a problem is user behavior. While POP3/IMAP client will be probably used only in user's device, it is highly probable that the web mail will be used from anywhere, even from a non-trusted PC. There is no possibility to guarantee "security" in this case. Traffic analyzers, key loggers, or whatever so can be installed there.

Edit: for somebody the added value of thick email client would be it is possible to install some kind of antivirus/antimalware plugin there. But in reality, this can't increase protection against malicious software so much.

  • 1
    I agree with all @Fis has to say, but i'm still looking out for a more technical and detailed justification.
    – Adib N
    May 26 '17 at 16:30
  • Regarding attachments, differentiating between suspicious attachments and non-suspicious attachments is not trivial. Devices of business associates, colleagues, and friends can all be compromised, sending out malware disguised in what looks like legitimate emails. Quite a few of us only accept properly signed and encapsulated attachments so we can very the integrity and authenticity. I'll update the question to allow for this. May 26 '17 at 16:42
  • I have a rule... don't execute anything from email.If it is document I have no problem to open it. If it requires scripting I am really suspicious about it and rather give a call to sender. But you are correct. I can imagine people who does not know what .exe is. But everybody should be somehow educated in basic computer security.
    – Fis
    May 26 '17 at 16:44
  • I don't recommend opening documents like that. It's often trivial to compromise a system using a malformed document. Also, don't forget that executables are not just .exe files! (I'm guessing you were just using that as an example.) May 26 '17 at 16:47
  • Didn't happen to me for about 20 years ;) I am working with images, videos, words, excels, powerpoint... If the software used to open the document is fine, you are fine too. If you would open the .swf and give it all permissions to do whatever on your computer its much bigger problem.
    – Fis
    May 26 '17 at 16:49

I assume here that you only use TLS whatever the client and protocol. IMHO, the main difference is that when you use a IMAP/POP/SMTP client, the interface is controlled from your machine, so the provider cannot inject links.

When you use a HTTP Webmail, the interface is controled by the server, so he can add links to advertise his own add ons. This is not related to security but to user experience.

The other (more important difference) is that when you use IMAP/POP, you normally have all the mails in a local folder. It should not be a problem if you manage the security of your machine, but you should be aware of it.

My advice is:

  • use IMAP/POP if you want to keep archived mails localy and do eventually complex searches in the mailboxes. I have always used a full mail client for my professional mail for example
  • use a Webmail when you borrow a machine: when you visit a friend or a family member and you need to download/print something or you have no smartphone - but be cautious about the security of the borrowed machine: it depends on how you trust the person you borrow it from.

As I have already said, this is a matter of user experience, not of security - except of the security related to using a machine you do not own in case of webmail, but it is not this question...

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.