Proton Mail Review 2023 – Most Secure Email Service?

Proton Mail is probably the most well-known end-to-end encrypted (E2EE) email service today. It certainly has brain-power behind it, having been designed by engineers and scientists from places like CERN and MIT. Since it launched a few years ago, Proton Mail has only grown more polished, more powerful, and more popular. It is obvioreusly the choice for our first secure email service review here at Security Tech.

Let's dive right in, shall we?

This table highlights the main facts about Proton Mail:

Based in	Switzerland
Storage	5-20 GB
Price	$4.00/mo.
Free Tier	Up to 500 MB
Website	ProtonMail.com

Proton Mail Pros and Cons

Here's a quick summary of the pros and cons of Proton Mail.

+ Pros

• Mail and Contacts protected by end-to-end and zero-access encryption
• Can import Mail and Contacts from other services
• Swiss jurisdiction provides good privacy protection
• Data is stored on servers in Switzerland
• Android and iOS device support
• Parts of Proton Mail are open source: Web client, encryption algorithms, Android and iOS code
• Support for custom domains with paid accounts
• Proton Mail Bridge to connect to third-party apps

– Cons

• Proton Mail doesn't encrypt Mail subject lines and headers
• You may be required to submit personal information for verification of new accounts
• Zero-access encryption is done on Proton Mail servers
• May log IP addresses or other info for government agencies

What you need to know about end-to-end and zero-access encryption

As we go deeper in this review, you will read a lot about end-to-end (E2E) and zero-access encryption. So let's get clear on exactly what those two terms mean right now.

E2E encryption

E2E encryption (often written as E2EE in Proton Mail documentation) is encryption that gets applied to your Mail messages before they leave your Proton Mail app. Only you and the intended recipient of the message are able to read it.

Zero-access encryption

Zero-access encryption comes into play when messages arrive at the Proton Mail servers without being encrypted. For example, if a non-Proton Mail user sends you a message, that message will arrive at the Proton servers in an unencrypted form. Zero-access encryption is the process of encrypting that message so that only you can read it, after which the unencrypted original gets deleted from the Proton server.

The problem with zero-access encryption is that someone at Proton AG could potentially get access to copies of unencrypted messages before they are deleted. Not that I think this is happening, mind you. The engineers at Proton Mail are dealing with a difficult problem when it comes to unencrypted messages. Applying zero-access encryption to an unencrypted message and deleting the original is certainly more secure than keeping the unencrypted message on a Proton server. But zero-access encryption is certainly less secure than E2E encryption.

Getting your hands dirty with Proton Mail

The best way to learn about a product is to use it. Reading a review or two and looking at some screen captures can tell you a lot, but you learn a lot more actually using the product. Along these lines, Proton Mail offers us a rare opportunity.

You can install the free version of Proton Mail on your computer in less than 5 minutes, with no risk or obligation. That will let you follow along using the actual product as we go through the review. If you would like to do that, keep reading. If you would rather just read about the product without installing it, skip ahead to “The Proton Mail user interface” and read along.

How to install the Proton Mail Free version

I recommend that you start your Proton Mail experience with the free version here. After all, this gives you a chance to test everything out before committing to a paid subscription plan.

The free version doesn't have all the bells and whistles of a paid Proton Mail account but is perfectly usable as a free email account and as a way to see if it might be worth investing in a paid account.

What I am going to do here is walk you through the sign-up process for the free version to get you up and running fast. But aside from this, we'll be looking at my paid account throughout this review so you can see all the features. If you decide the paid version is for you, you can easily upgrade from within the Proton Mail client.

How to create your free Proton Mail account

Proton Mail and its siblings (Proton VPN, Proton Calendar, and Proton Drive) can each function on their own. But the Proton AG has joined them together under one Proton Account. Signing up for a free Proton Account automatically gives you access to the free versions of all four products.

The setup is a bit tricky to navigate so we'll go through it in detail.

1. Go to the Proton Mail website. Then click the Create a free account button. Surprisingly, this takes you to the Pricing page.
2. There you are presented with three plan options. To start using Proton Mail for free, you should select the Proton Free option. This will take you to a page where you can create your free Proton Account.

2. Once you finish this, you may see a box like the one below, where you are forced to verify that you are human, in order to, “fight spam and abuse.” (I'll have more to say on this shortly.)

3. A congratulations box appears where you need to enter your Display name. Click Next when done.

4. The Save contact details dialog box appears. You can enter a Recovery phone number, Recovery email address, or skip the whole thing. If you decide not to give them contact details, they will try to change your mind with the annoying Warning message that appears below the dialog box.

5. You are almost ready. Select Proton Mail in the Start exploring the Proton universe list that just appeared to launch the free Proton Mail interface.<start exploring the proton universe>

About entering personal information during registration

During the registration of your new account, Proton Mail may demand some personal details you may not want to share with Proton AG. Proton Mail is much more of a secure email service than a private email service. In other words, their focus is on keeping the contents of your email messages secure from snoops.

Proton Mail is not designed to let you communicate anonymously. We'll see other ramifications of that focus as we go through this review.

Given this, potential requests for personal information make sense. But if you are looking for more privacy or anonymity, Proton Mail may not be the best choice.

The Proton Mail user interface

The Proton Mail desktop (web) client looks much like other browser-based clients. By default, it starts in a 3 column view like the one you see :

In this view, the leftmost column includes a set of the most common folders. You can create new custom folders as necessary (limited to 3 folders in the free version).

While it takes a moment or two to launch, the web client works smoothly once it loads. There can also be a short delay when you open a message, which makes sense since message bodies are stored encrypted and must be decrypted before you can read them.

The basic sending and receiving of messages using Proton Mail is much the same as with any other email program. But there are a few things that we should talk about in more detail, starting with…

Displaying images in messages

Most secure email services won't display images within messages unless you tell them to. This is because downloading an image makes your IP address visible to the page where the image originated. Proton Mail has a solution to this problem that lets you automatically download and display images without exposing your IP address.

Instead of downloading images directly to your Proton Mail app or client, the images go first to the Proton Mail servers. Images that seem malicious are immediately eliminated. Images that appear to be legitimate get passed on to your computer for display. Because the images are downloaded to the Proton Mail servers first, the image websites see only the IP address of the Proton Mail servers. All they find out is that someone using Proton Mail downloaded the images.

You can tell Proton Mail to always display images while keeping your IP address private by going to the Email privacy page in Settings and configuring the switches as shown below:

Proton Mail settings

Speaking of Proton Mail settings, you reach them by clicking the gear icon at the top of the main Proton Mail page. This opens a menu that looks like this:

At the top of the menu, click Go to settings. This takes you to the Proton Mail Dashboard where you can see the details of your subscription. Looking down the menu on the left side of this web page you can see links for the Proton Mail settings pages.

Importing messages using Easy Switch

Switching to a new email service can be a major hassle. Proton Mail makes it somewhat less painful with their built-in Easy Switch tool. If you are currently using an email service that supports the IMAP protocol (most of them do) you should be able to import the messages you have stored in the other service. The messages you import will automatically be encrypted as soon as they arrive.

How to use Easy Switch

To use Easy Switch, go to the Proton Mail Dashboard and select Import via Easy Switch in the menu on the left side of the page. You'll land on the Import via Easy Switch web page.

Select one of the service provider buttons shown on the page and follow the instructions that appear on your screen to import your email (and possibly other content).

Working with other desktop email clients using Proton Mail Bridge

You can use Proton Mail with other email clients, but there is a potential problem. While Proton Mail provides end-to-end (E2E) encryption of email messages, many email clients don't. Proton Mail Bridge lets you add E2E encryption to other email clients so that only you and your intended recipient can read those messages. If you have a paid subscription to Proton Mail, you can download and install Proton Mail Bridge on your Windows, macOS, or Linux system.

Once you configure the bridge to work with your specific email clients, you will be able to follow your existing workflow with your existing email clients, while still getting the benefits of Proton Mail's E2E encryption.

Sending messages to non-Proton Mail users

Proton Mail can send encrypted messages to people who use other email services. It does this by sending the recipient a link to an encrypted web page containing the message. This is a reasonable solution to the problem of sending messages to non-Proton Mail email services while still keeping the messages secure against snoops.

How to send messages to non-Proton Mail users

Here are specific steps for how to send an encrypted message to a non-Proton Mail user:

1. Click the New Message button to open the New message window and enter your message as you would normally.
2. Click the lock icon at the bottom of the New message window. An Encrypt message box appears as shown below.

3. Enter a Password and optionally a Password hint, then click Set encryption. The recipient will need to know the password, and sending it to them through the same email account makes no sense. You should agree to the password using some other service, ideally a secure chat like Signal messenger.
4. Instead of the actual message, the recipient gets a message containing an Unlock message button. Clicking that button brings you to an Unlock message box where you can enter the password, then click Read message.

5. If the recipient enters the correct password, they are taken to a web page where they can read the message. By default, the encrypted message will expire in 28 days.

Searching your messages in Proton Mail

Proton Mail allows you to search your messages, even though they are encrypted. If you are using a paid version of Proton Mail, you can create and search an encrypted index of your messages in the web client.

If you aren't using a paid version of Proton Mail, you can use the Proton Mail Bridge and an unencrypted email service to search your messages. The details of how this all works are beyond the scope of this review. Full instructions are included on the Proton Mail website.

2FA for enhanced security

ProtonMail supports 2FA (two-factor authentication) on all their apps. Using Google Authenticator or another Time-based One Time Password (TOTP) app like Authy, you can add this additional level of security in minutes.

Important: You enable 2FA using the Proton Mail desktop (web) app. Once enabled it will work on both the desktop and mobile apps.

How to enable 2FA on Proton Mail

Follow these steps to enable 2FA on Proton Mail:

1. Open Settings. In the list that appears, click your name under the Account settings heading.
2. Click Password & Recovery, then set Multi-factor authentication.
3. You will be asked to snap the Proton Mail QR code with your phone's camera to add ProtonMail to your authenticator.

For step-by-step instructions tailored to different authenticator apps, check out this Proton Two-factor authentication guide.

Proton Mail mobile apps

Proton Mail offers mobile apps for both iOS and Android devices. The mobile apps are very similar to the desktop apps but do have some additional features.

The apps support biometric identification using your fingerprint. They also support swiping. By default, a left swipe marks a message as spam, while a right swipe deletes the current message. You can redefine the function of left and right swipes as well. Finally, you can create a mobile signature that differs from your regular signature.

During our testing we found the apps to work well, with no leaks or bugs detected.

Creating and importing Contacts

A Contact manager is built into Proton Mail. It stores Contact information in an encrypted form, protecting the information from prying eyes in a manner similar to the way Proton Mail protects your messages.

Here's how it works: Proton Mail automatically creates encryption keys for your Contacts, and uses those keys to apply zero-access encryption to the Contact data. The system also uses digital signature verification to prevent anyone from tampering with your contacts.

Be aware that zero-access encryption doesn't get applied to the email addresses of your Contacts. That's because Proton Mail needs to be able to read the email addresses to send messages to them.

Proton Mail company history

At the time of this review (March, 2023) the Proton family of products consisted of Proton Mail, Proton VPN, Proton Calendar, and Proton Drive. The company behind them is Proton AG, a Swiss firm. The founders met at CERN and decided to develop a secure email provider. Once Proton Mail was launched, they branched out to develop the other products in the family. Proton VPN was the first out of the gate in 2017. While it's not quite a cheap VPN, it still remains a good all-around option.

Here's a short company history focused on Proton Mail:

• 2014, the company raised money to launch Proton Mail through an Indiegogo crowdfunding campaign. The campaign raised more than $550 million dollars.
• 2015, US firm Charles River Ventures invested $2 million in the company.
• 2019, Proton Mail accepted €2 million from the government of the European Union. The goal of the investment was for the company to “develop a suite of encrypted services.” They also released the Proton Calendar beta.
• 2021, Proton Calendar became available to all users of Proton Mail.
• 2022, In April, the company changed its name from Proton Technologies AG to Proton AG. They also acquired SimpleLogin, an email startup that makes it possible to send and receive messages anonymously. In May, the company moved all their products to a single subscription model. They also redesigned their user interfaces and logos to be consistent across products.

Proton Mail security

The question of how secure your Proton Mail messages are is complicated. First off, all Proton Mail servers are physically located in Switzerland. They are housed in secure facilities which have been audited by Securitum, a European security auditing firm. Securitum found that both the facilities and the cryptographic architecture of Proton Mail had no major issues or vulnerabilities. In other words, the physical side of Proton Mail security is solid.

Furthermore, the fact that Proton AG, Proton Mail, and their mail servers are under Swiss jurisdiction means that your data is protected by Swiss law. Switzerland gives better privacy protection than even the United States or EU laws. Add in the fact that you can protect your logins with TOTP two factor authentication (2FA) devices like YubiKey and FIDO, and your Proton Mail messages are pretty darn secure against outside snooping.

But Proton Mail is also bound by Swiss law on when it has to give up information about its users. Given a valid Swiss court order, Proton Mail is required to turn over whatever information they can to the Swiss authorities. The bodies of your messages, as well as any attachments to those messages, are secure. Even Proton Mail cannot decrypt those parts of messages.

However, message headers (which include crucial information like email addresses) are not encrypted. Neither are the Subject lines of your messages. Those pieces of information must be turned over to the authorities in response to a court order. Exposing who you are exchanging messages with, and the subjects of those messages, is a large security problem in itself.

Proton Mail may log IP addresses

Proton Mail has the capacity to log your IP address and has sometimes done so. One worrisome example of this occurred in 2021. Swiss authorities gave Proton Mail a valid legal request to log one user's IP address and other device information. The company gave this information to Europol as requested, and the user was arrested.

Prior to this incident, the company website claimed that “we do not keep any IP logs.” Proton Mail has since removed that claim from their website. This incident illustrates why you should always use the best VPN, even when communicating through a “secure” email service like Proton Mail.

If the user in the above case had been using a VPN to connect to the internet (and hence to Proton Mail), the IP addresses that were logged be registered to some company's VPN server rather than directly to the user's computer.

Proton Mail encryption

Proton Mail uses several different encryption algorithms to protect your messages. They are open source versions of AES, RSA, and OpenPGPjs:

• AES-128
• TLS 1.0
• DHE RSA
• SHA 3

Proton Mail SSL certificates are signed by QuoVadis Trustlink Schweiz AG.

As noted earlier, messages sent between Proton mail users are automatically encrypted before leaving the app and decrypted only by the recipient. They are End-to-End encrypted and Proton Mail cannot read them.

But messages sent from non-Proton Mail apps will arrive at the Proton Mail servers unencrypted. Proton Mail's zero-access encryption system will encrypt those apps for you, but the company could conceivably decide to (or be forced to) record the contents of these messages before encrypting them.

Proton Calendar

Proton Calendar is a free, encrypted calendar app available to all Proton Mail users. It supports all the standard calendar features like recurring appointments and sending and receiving invitations. The mobile and web versions of the app automatically sync, so your appointments and events are visible wherever you use Proton Mail.

If you have a paid Proton Mail account, you can share calendars with other Proton users by sending them a link. The table below is a side-by-side comparison of the Proton Calendar features available to users of the free version of Proton Mail (left) and the paid versions (right).

Proton Mail Support

Like other aspects of Proton Mail, you get more customer support with a paid Proton subscription than you do with a free subscription. The base level of support is a searchable knowledge base and some helpful step-by-step guides. Paid subscriptions get you the features of the free one, plus priority support through the Customer Support form accessible here.

Proton Mail price and refunds

Proton Mail used to be rather expensive, but it is priced much more reasonably now. A 24-month Proton Mail Plus subscription gives you a fully usable encrypted email service plus an encrypted calendar for $3.29 per month. Unless you need Proton VPN or one of the other features only available in Proton Unlimited, Mail Plus is probably the option to choose.

Proton Mail FAQ

Here are some Frequently Asked Questions related to Proton Mail and related components such as Proton Mail Bridge.

Proton Mail conclusion

Proton Mail has been one of the most popular end-to-end encrypted email services on the market today. And recent updates to the service make it better than ever. These include more features, lower prices and a look and feel consistent with other products in the Proton family: Proton VPN, Proton Calendar, and the newly-released Proton Drive.

Another benefit of Proton Mail is its free basic account. If your need for encrypted email communication is limited, this free version could be all you need to get the job done. If you want more (more storage, more features) Proton Mail Plus is definitely worth investigating.

To get started, just go to the website here for a free account.

However, if you need maximum security mail that has full encryption of subject lines and message headers, or you don't like that the Swiss government can force Proton Mail to secretly log and turn over a user's IP address, you might want to keep looking.

Want to check out other options?

See our guide on the best secure email services.

This Proton Mail review was last updated March 14, 2023.