# SSL, TLS and STARTTLS explained
Source: https://docs.webgee.com/en/email/email-what-is-the-difference-between-ssl-tls-and-starttls



Every mail client asks you to pick an encryption setting, usually offering
`SSL/TLS`, `STARTTLS` and `None`. This explains what they mean and which to
choose.

**Short answer:** choose **SSL/TLS** on port 993 for incoming and port 465 for
outgoing. Both options encrypt equally well; SSL/TLS just fails more safely.

## The terms [#the-terms]

**SSL** — Secure Sockets Layer. The original protocol. Every version is now
considered insecure; SSL 3.0 fell to the POODLE attack in 2014 and has been
disabled by default ever since. The name survives in mail client menus out of
habit, where "SSL" almost always means TLS underneath.

**TLS** — Transport Layer Security. SSL's successor and what actually runs
today. TLS 1.0 and 1.1 are also retired; **TLS 1.2 and 1.3** are current, and
WebGee servers accept those.

**STARTTLS** — not a protocol but a *command*. It opens an unencrypted
connection on the normal port, then asks the server to upgrade it to an
encrypted one. Recognised by SMTP, IMAP and POP3.

## The practical difference [#the-practical-difference]

The distinction is not how strong the encryption is — both end up negotiating
the same TLS. It is **when** encryption starts.

|                     | SSL/TLS (implicit)                   | STARTTLS (explicit)               |
| ------------------- | ------------------------------------ | --------------------------------- |
| Port                | Dedicated encrypted port             | Standard port                     |
| Encryption begins   | Immediately, before anything is sent | After an unencrypted greeting     |
| If encryption fails | Connection fails                     | May silently continue unencrypted |

That last row is the reason to prefer SSL/TLS. With STARTTLS, a client that
mishandles a failed upgrade can carry on in plain text, sending your password
unencrypted. With SSL/TLS there is no unencrypted state to fall back to.

## Which ports [#which-ports]

| Purpose | Encryption | Port    |
| ------- | ---------- | ------- |
| IMAP    | SSL/TLS    | **993** |
| IMAP    | STARTTLS   | 143     |
| POP3    | SSL/TLS    | **995** |
| POP3    | STARTTLS   | 110     |
| SMTP    | SSL/TLS    | **465** |
| SMTP    | STARTTLS   | 587     |

Use the bold ones unless something specific stops you. Full settings are in
[Email server settings](/en/email/manual-configuration).

<Callout type="warn">
  Never choose **None**. Your mailbox password is sent in clear text on every
  check, readable by anyone on the same network.
</Callout>

## Why "plain" authentication is not insecure here [#why-plain-authentication-is-not-insecure-here]

Mail clients often ask for an authentication method as well, and the safe choice
is called **Plain** or **Normal password**. That sounds alarming but is not:
encryption is established first, so the password travels inside the encrypted
channel. WebGee servers refuse to authenticate over an unencrypted connection at
all.

## Related [#related]

* [Email server settings](/en/email/manual-configuration)
* [Set up email on Mac and iPhone](/en/email/apple-macos-ios)