MEGA vs Proton Drive: More Storage or Fewer Open Questions
Published October 22, 2026· By Juan Martinez
Both encrypt files and names on your device. MEGA gives 20 GB free and 3 TB for €99.99 a year; Proton Drive has open apps, paid-by-Proton audits, a nonprofit owner.
MEGA vs Proton Drive is a choice between two cloud storage services that encrypt files on your device before upload. On paper they protect the same things: in both you hold the keys, and both encrypt file contents and file and folder names. They differ in how much storage you get for the money, and in how many questions about their security are still open.
MEGA gives far more space. The free plan holds 20 GB, and 3 TB costs €99.99 a year. But cryptographers have published attacks on MEGA’s design three times, and MEGA has not said whether the cause they named is fixed. MEGA does not name its owners and has no published security audit. Proton Drive’s free plan holds 5 GB, and a single person who needs more than 200 GB has to buy a bundle with Proton’s other services. In return its apps are open source, three audits of them are public, and its main shareholder is a nonprofit foundation.
Proton Drive is rated 7.7 and MEGA 6.6. Proton Drive is ahead in Encryption & Key Custody (8.5 against 6.5) and in Trust & Transparency (7.5 against 4.5). The two are level on Features & Sync and on Usability & Platforms (7.5 each). MEGA is ahead in Price & Value, 8.5 against 6.5.
| MEGA | Proton Drive | |
|---|---|---|
| Rating | 6.6 | 7.7 |
| Security Audit | None found | Company-paid audit (Securitum, 2022) |
| Client Code | Partly open | Open source |
| Security Incident | 2018: a malicious version of its Chrome extension stole passwords for other sites | None reported |
| Owner | Independent company | Proton Foundation |
| Free Plan | 20 GB; downloads limited per IP address | 2 GB, 5 GB after setup tasks |
| About 200 GB | €40 a year (Essential, 200 GB) | $47.88 a year (Drive Plus, 200 GB) |
| 3 TB | €99.99 a year (Pro I) | $287.88 a year (Proton Family: 3 TB shared by up to 6 users, bundled with other Proton services) |
| Collaborative Editing | Not available | End-to-end encrypted |
| Linux Desktop Sync | ✅ | ❌ (command-line tool only) |
Want to compare every field side by side? Open the full comparison table.
What each one encrypts
In both services the keys are created on your device, and the company receives them only in encrypted form. Both call the result “zero-knowledge” storage, and in both cases that is the company’s own description, not the finding of an outside review of the whole design.
The scope of the metadata encryption is close. MEGA encrypts file names, folder names and thumbnails; its privacy policy lists file sizes, the order of file versions and which file sits in which folder among the data it keeps unencrypted. Proton Drive encrypts file and folder names and thumbnail previews; its privacy policy says Proton can see when each file and folder was created and modified, who has which permissions and which username uploaded each file, and it stores the size of the encrypted file rather than the original.
Proton splits large files into 4 MB chunks and signs each one, so its server cannot swap, drop or reorder parts of a file without the app noticing. MEGA’s whitepaper says MEGA chose not to protect the folder structure cryptographically, so that it can move or remove files itself.
Both web apps load their encryption code from the company’s servers on every visit, so a browser user trusts that the code that arrives is the published one. MEGA offers an extension for Chrome and Edge that keeps this code on your computer instead. Both companies’ desktop and phone apps carry the code with them and change only with an app update.
Who has checked MEGA and Proton Drive
This is where the two differ most. In 2022 Matilda Backendal, Miro Haller and Kenneth Paterson of ETH Zurich described five attacks open to anyone controlling MEGA’s servers. The main one recovered a user’s private key after 512 logins with a password; with that key the attacker could decrypt the user’s files and plant files that the apps would treat as uploaded by the user. Researchers at UC San Diego cut the number of logins to six. The cause, the ETH team wrote, is that one master key protects all other keys in a mode with no check that the stored keys have not been altered.
MEGA added checks to its apps in June 2022 and said it knew of no account compromised this way. In 2023 a team from Royal Holloway and ETH Zurich showed that those checks could themselves be used to recover the private key, with hundreds to thousands of logins. MEGA released a wider update in March 2023 that, MEGA says, makes its apps immune to the private-key recovery described in all three papers. Its announcement does not say whether the stored keys are now protected against alteration, and MEGA’s whitepaper dates from June 2022, before that update.
One part of the 2023 update was relaxed nine days later. When you share a folder with another MEGA user, the apps can check that the other person’s public key really belongs to them, a step called contact verification. Since March 2023 this check is optional again: MEGA shows a warning for folders from people you have not verified, but accepts them. If you share a folder with someone you have not verified, a compromised MEGA server could hand you a different key and read what you share with that person afterwards. Shared links work differently: the key sits after the # sign in the address, a part browsers do not send to MEGA.
Proton Drive has three public security audits by Securitum, a Polish security firm, all arranged by Proton itself. The first tested the web app between September and October 2021 and found five issues, two rated low severity and three informational. In 2022 Securitum tested the Android app with its API, finding two low-severity issues, and the iOS app; Proton reports no outstanding vulnerabilities in either mobile app. No published audit covers the Windows or macOS apps, and none is newer than 2022.
An audit and an academic paper answer different questions. A penetration test looks for bugs in a given app over a few days or weeks; the MEGA papers studied the design of its encryption against a hostile server. Proton’s audits do not prove that its design would survive the same kind of study. MEGA has no published audit at all, and the question the researchers raised about its design has no public answer from MEGA.
Open code, ownership and what each company keeps
Proton Drive’s apps are open source: the Windows, macOS, Android and iOS apps under GPL-3.0, the Drive SDK under MIT, and the web app on Proton’s main GitHub account. MEGA publishes the source code of all its cloud storage apps too, but most of it under MEGA’s own licence, which allows reading and testing the code for flaws and is not an open-source licence; only the library the apps are built on is under a standard open-source licence. Neither publishes its server code. Both pay for reported vulnerabilities; MEGA pays up to €10,000 for each.
Proton AG is a Swiss company whose primary shareholder is the non-profit Proton Foundation in Geneva, and Proton states it has no venture capital investors. MEGA was founded in New Zealand in 2013; since May 2025 its cloud service has been run under Hungarian law by MEGA Privacy Kft, a company registered in Hungary, and its website does not name the shareholders.
In September 2018 an attacker uploaded a malicious version of MEGA’s Chrome extension to the Chrome Web Store. If a user granted it access to all websites, it sent logins for Amazon, Microsoft, GitHub and Google, keys from cryptocurrency wallet sites and data from login forms on other sites to a server in Ukraine. MEGA uploaded a clean version four hours later. This security incident exposed passwords for other websites, not the files stored in MEGA. No breach involving Proton Drive has been reported.
What each company keeps outside the encryption also differs. MEGA keeps your email address, payment records, IP addresses with the time of each login, upload and link, your device type and the email addresses of your contacts, and its privacy policy allows it to give authorities your files, in encrypted form, and your account data. Proton keeps your name and the last four digits of your card, and IP addresses only temporarily against abuse, according to its privacy policy, and discloses user data only on a binding order from Swiss authorities; for Drive that data excludes file contents, names and thumbnails.
On telemetry the defaults favour MEGA. MEGA uses analytics and advertising cookies only if you accept them. Proton Drive sends anonymous usage statistics by default, which Proton says contain no personal information and are deleted after 30 days; the “Collect usage diagnostics” toggle in the privacy settings switches them off.
If you lose the password
Neither company can reset access to your encrypted files. Both rely on a recovery key or phrase that you keep.
MEGA’s account recovery depends on a recovery key that you can export only while signed in. If you forget your password and are signed in nowhere, the key lets you set a new one; without it, MEGA can only reset the account, and the files in it become unreadable. If the password or the key turns up within 60 days, support can bring the old account back. The same key replaces a lost authenticator app for two-factor authentication, so export it on the first day.
Proton splits recovery into getting back into the account and decrypting the data in it. A 12-word recovery phrase covers both. Recovery by email or SMS resets only the password; without a separate data recovery method (a recovery file, a backup stored in your browser, or trusted contacts who confirm your request), every file uploaded before the reset stays locked.
The free plans
The 20 GB free plan is MEGA’s clearest advantage, and it comes with limits. Downloads by free users, and by anyone without an account who opens your links, count against a transfer quota set per IP address over the past six hours, which can pause a large download. A file counts toward it only after it has been downloaded in full more than 10 times. Password-protected links and links with an expiry date are for paid plans only. Rewind, which restores deleted files to a past date, goes back 30 days on the free plan, and restored files can only be viewed. MEGA may delete the files of a free account after at least 10 months without a sign-in, following warning emails.
Proton’s free tier starts at 2 GB and grows to 5 GB after a few setup tasks. It keeps up to 10 versions of each file for 7 days and allows up to three sharing links with edit rights. Proton sets no limit on downloads per link, and a recipient needs no Proton account to open a link.
Paid plans and price
The prices are in different currencies, MEGA in euros and Proton in US dollars, and are shown as listed, not converted.
At about 200 GB the two are close: MEGA’s Essential costs €40 a year for 200 GB and is sold only yearly, and Proton’s Drive Plus costs $47.88 a year or $4.99 a month for 200 GB. MEGA has no monthly 200 GB plan; its cheapest monthly plan is Pro Lite, €4.99 a month for 750 GB.
Above 200 GB the gap opens. MEGA sells storage on its own: Pro Lite at €59.99 a year for 750 GB, Pro I at €99.99 for 3 TB, Pro II at €199.99 for 10 TB and Pro III at €299.99 for 20 TB. Every paid MEGA plan also includes MEGA’s VPN and password manager. Proton’s next step for one person is Proton Unlimited at $119.88 a year for 500 GB, bundled with the rest of Proton’s paid services. Its 2 TB plan is Proton Duo at $179.88 a year for up to two people, and its 3 TB plan is Proton Family at $287.88 a year, shared by up to six people. Proton’s 1 TB per user plan is the business plan Drive Professional, which starts at two users.
The terms around the price favour Proton. Its paid plans come with a 30-day money-back guarantee. MEGA has none: residents of the EU can cancel within 14 days and residents of Brazil and South Korea within 7 days, and elsewhere a payment is refunded only if it was charged in error.
Sync, versions and editing
MEGA has desktop sync apps for Windows, macOS and Linux that sync the whole drive or chosen folders and back up folders from your computer. Proton has sync apps for Windows and macOS; on Linux there is only a command-line tool. Both have apps for Android and iPhone, and neither limits file size.
File versioning depends on the plan. MEGA keeps up to 100 versions of each file with no time limit on every plan, free included. Proton keeps up to 200 versions for up to 10 years on paid plans, and 10 versions for 7 days on the free plan.
Collaborative editing is Proton’s. Drive includes a document and spreadsheet editor with end-to-end encryption and live cursors, and collaborators can join through a link without a Proton account. MEGA has no document editing. Someone you invite to Proton Drive by email who is not on Proton has to create a free Proton account first.
What we didn’t compare, and why
Speed and reliability of sync. Neither review includes transfer-speed or reliability tests, so no winner is named. If you sync large libraries, try both free plans with a copy of your files first.
Business use. This article covers personal plans only.
Which one to pick
Read the full MEGA review if you need more than 200 GB for yourself at a low price, use Linux, or want the larger free plan (20 GB). You accept that the question the researchers raised about MEGA’s key protection has no public answer, that no audit is published, that the owners are not named and that refunds outside the EU, Brazil and South Korea cover only billing errors. Verify the contacts you share folders with, and export the recovery key on the first day.
Read the full Proton Drive review if open-source apps, published audits, a nonprofit owner and encrypted document editing matter more than storage per euro. You accept a 5 GB free plan, no Linux sync app, audits that Proton arranged itself, none of them covering the Windows or macOS apps, and bundles for anything above 200 GB. Set up the recovery phrase and a data recovery method before you upload anything you cannot afford to lose.