Proton Mail

Proton Mail is the email service of Proton AG, a Swiss company headquartered in Plan-les-Ouates near Geneva, and the product that started the company back in 2014. It is aimed at people who want their stored mail to be unreadable to the provider itself, and who are willing to accept the constraints that come with that: no password reset, and extra steps when writing to someone outside Proton. What you get in exchange is an ordinary-looking mailbox on every platform, with the encryption handled in the background for the cases where it can be.

Security

Three different encryption guarantees are often collapsed into the phrase “encrypted email,” and they are worth separating, because they apply to different messages in your inbox.

The first is automatic end-to-end encryption between two Proton Mail accounts. Nothing is required from either side — Proton manages the underlying PGP keys transparently, and its Key Transparency system automatically verifies a contact’s public key to guard against a man-in-the-middle swap. Mail sent Proton-to-Proton is unreadable to Proton in transit and at rest.

The second is zero-access encryption of stored mail, and this is the one that covers the bulk of a normal inbox. A message arriving from any outside provider is encrypted on Proton’s servers with your public key the moment it lands, after which Proton has no technical means of decrypting it. That applies to storage, not transport: the message still crossed the internet under whatever protection the sender’s provider offered, typically SMTP over TLS.

The third is end-to-end encryption to a recipient who is not on Proton, and this one is not automatic. There are two routes. Password-protected Emails let you set a password on a single message before sending it; the recipient opens it with that password and needs no software, no account, and no technical knowledge. The other route is conventional PGP, which requires a manual key exchange — either the recipient sends you a signed message with their public key attached and you accept it with “Trust key,” or you upload their key yourself under Contacts, Advanced PGP Settings. Proton’s own documentation says setting up PGP encryption is not simple and not for the faint of heart, and recommends that both people create Proton Mail accounts instead. Only after PGP is configured by hand for a specific external address does Proton start encrypting to that person automatically. Web Key Directory lookup exists for external domains that publish their keys that way, but few do, so it does not change the general case.

The cryptography is elliptic curve, built on OpenPGP, with post-quantum encryption support in place for the future. Two independent audits are public. Securitum, a European firm that runs over 300 security projects a year including work for major European banks, audited the redesigned Proton Mail web client and Proton Calendar before release and published its report on 5 July 2021, finding no major issues or security vulnerabilities. Ruben Santamarta, an independent researcher with more than twenty years of work across desktop software, mobile apps, e-voting platforms and industrial control systems, assessed the Windows and macOS desktop clients in a report dated 23 February 2024. Proton links both full reports from its open-source page.

One vulnerability disclosure is worth stating plainly. In September 2023 the research team at Sonar published details of a cross-site scripting flaw they had found in the open-source web client, which in theory would have let an attacker steal decrypted mail and impersonate the victim, bypassing the end-to-end encryption. Exploiting it required the target to open two specially crafted malicious emails, and in most scenarios to click a link in the second. Sonar disclosed it privately in June 2022, Proton patched it shortly after, and Sonar states users were not at risk once patches were applied. This was responsible disclosure of a researcher-found bug, not a breach of user data — but it is a reminder that end-to-end encryption in a web client is only as strong as the client’s handling of untrusted content.

Proton’s security page says it owns and controls its server hardware at several locations within Switzerland rather than renting third-party cloud, with biometric access to the data centers. Proton stated in 2025 that, because of legal uncertainty around Swiss surveillance proposals, it is moving most of its physical infrastructure out of Switzerland, with its AI assistant Lumo the first product to move. Heise online wrote in March 2026 that Proton has closed its data center at its Geneva headquarters. Swissinfo reported in September 2026 that Proton says it has halted plans to invest in more infrastructure in Switzerland, in response to the 2025 proposal to revise the Swiss surveillance ordinance so that larger platforms face data-retention and cooperation requirements.

Privacy & Trust

Swiss jurisdiction is the basis of Proton’s positioning, and the ownership structure is the part that has actually changed. Since June 2024 the primary shareholder of Proton AG has been the non-profit Proton Foundation, endowed by the founder, the co-founder and the first employee through a donation of Proton shares, which Proton calls irrevocable. Proton says no change of control can occur without the Foundation’s consent, which is meant to block a takeover.

The company’s history points the same way. Proton Mail launched in summer 2014 out of a crowdfunding campaign that drew more than 10,000 backers and over $500,000; the founders met at CERN. Proton says it has no venture capital investors and does not sell user data.

Swiss jurisdiction also means Swiss court orders. Proton’s transparency report lists 9,301 legal orders for Proton Mail in 2025, of which it contested 988 and complied with 8,313. Proton says it rejects requests from foreign authorities directly, but Swiss authorities can pass on foreign requests under mutual legal assistance. In March 2026 heise online, reporting 404 Media, described a case where a US request under the US–Switzerland treaty led Swiss authorities to order Proton to release the payment data of a paid account, which the FBI used to identify the account holder; Proton’s head of communications said Proton passed no data directly to the FBI and answered only binding Swiss orders.

The code is open. Proton says all its apps are open source and on GitHub, publishes audit reports for the web and desktop clients, and runs a public bug bounty program. Proton also develops and maintains OpenPGPjs and GopenPGP, two OpenPGP libraries used well beyond Proton’s own products, which means a portion of its cryptographic work is scrutinized by people with no stake in the company.

On its own analytics, Proton uses locally hosted rather than cloud-based tools, anonymized where possible, and does not retain IP addresses for that analytics. Crash reporting exists so bugs get fixed quickly. The company states it does not keep permanent IP logs in relation with an account, with temporary logs used only against abuse.

Features

Custom domain support is a paid feature: one domain on Mail Plus, three on Proton Unlimited, with catch-all addresses on paid plans. Hide-my-email aliases are the more unusual inclusion, since ten of them ship even on the free plan and Proton Unlimited makes them unlimited — that is normally a separate purchase.

Spam and phishing filtering had to be built differently here, because encryption means Proton cannot read message bodies. PhishGuard works on email authentication — SPF, DKIM and DMARC checks — plus metadata such as headers, sender, link URLs and attachment hashes, and flags suspected phishing and spoofing without scanning content. Proton puts its effectiveness at 70% above conventional spam filters. The machine-learning model retrains on your own actions, so marking a message as spam or pulling one back into the inbox feeds it, and a 24/7 deliverability team handles new campaigns the automation misses.

Account recovery is where the architecture imposes a real cost. Proton does not store user passwords on its systems and states outright that it cannot reset a password for you. Recovery splits into two separate problems — regaining access to the account and regaining access to the encrypted data — and both have to be configured in advance by the account owner. A recovery phrase covers both at once; most of the other recovery methods cover only one. Set nothing up, lose the password, and the mail is gone permanently. There is no support path around that.

Proton Unlimited bundles more than mail: Calendar, Drive, VPN and Pass in one subscription, with Dark Web Monitoring and Proton Sentinel for accounts at elevated risk of takeover.

Usability

Clients exist for Windows, macOS, Linux, Android and iOS alongside the web app. The desktop app launched in March 2024 for Windows and macOS, and the Linux app is listed as beta. On the free plan the desktop app is a 14-day trial, after which it becomes a paid feature. If you prefer an ordinary mail client, Proton Mail Bridge provides IMAP and SMTP access, also paid-only.

Day to day the experience is a normal mailbox: Proton-to-Proton encryption is invisible, and mail from outside arrives and reads like mail from outside. The friction is concentrated in two places. Writing an encrypted message to a non-Proton recipient means choosing between a password you have to communicate some other way, and a manual PGP setup Proton itself calls difficult. And the recovery setup is a decision you have to make correctly at signup, before you have any feel for the consequences.

Price & Value

The free plan gives you 1 GB of storage, one address, a 150-message daily limit and ten hide-my-email aliases, with zero-access encryption and password-protected emails included. No custom domain, no priority support, and the desktop app only for the trial period.

Mail Plus costs $4.99 on the month-to-month plan, and $47.88 every 12 months ($3.99 a month) on the annual plan. It raises storage to 15 GB and gives ten encrypted addresses, one custom domain, unlimited folders, labels and filters, priority support, the full desktop app and IMAP/SMTP access through Bridge.

Proton Unlimited costs $12.99 on the month-to-month plan and $119.88 every 12 months ($9.99 a month) on the annual plan. It is a suite subscription rather than a mail plan: 500 GB of storage, 15 additional addresses, three custom domains, unlimited aliases, Dark Web Monitoring, Sentinel, the full VPN with 20000+ servers in 140+ countries, and the password manager with 50 vaults. Judged on mail alone it is poor value; it makes sense if you would use the bundled VPN, Drive and Pass. All paid plans carry a 30-day money-back guarantee.

Pros and Cons

Our Rating

Proton Mail suits people who want their stored mail out of the provider’s reach and are prepared to plan for recovery in advance — the encryption of everything at rest is the strongest part of the product, and it applies whether or not the sender uses Proton. It suits them less if the goal is encrypted correspondence with people who are not on Proton, because that case still comes down to per-message passwords or hand-configured PGP. The Swiss base, the non-profit primary shareholder, the open code and the two published audit reports are what a reader can check; Swiss court orders and legal-assistance requests still apply to account and payment data.