Proton Mail — BrandWiki

Proton Mail

Overview

Proton Mail

screenshot	ProtonMail screenshot.png
country	Plan-les-Ouates, Switzerland‡R1R‡
commercial	No
num users	100 million (April 2023)‡R2R‡
registration	Required
language	English, Catalan, Chinese, Dutch, French, German, Hungarian, Italian, Japanese, Polish, Romanian, Russian, Spanish, Turkish, Portuguese, Ukrainian
owner	Proton AG
launch date	May 16, 2014
current status	Online
url	* https://proton.me/mail *

Proton Mail is the largest end-to-end encrypted email hosting service. It was launched in 2014 by a team of scientists at CERN and MIT, led by co-founder Andy Yen. Proton Mail is headquartered in Geneva, Switzerland.[8] It is owned by the non-profit Proton Foundation through its subsidiary Proton AG, which also operates Proton VPN, Proton Drive, Proton Calendar, Proton Pass and Proton Wallet. Proton Mail uses client-side encryption to protect email content and user data before they are sent to Proton Mail servers, unlike other common email providers such as Gmail and Outlook.com.[9][10]

Proton Mail received its initial funding through a crowdfunding campaign, and initial access was by invitation only, but it opened to the public in 2016. There were two million users by 2017[11]

History

On May 16, 2014, Proton Mail entered into public beta.[19] Due to high demand, after three days beta signups were temporarily restricted to expand server capacity.[20] Afterwards, Proton Mail implemented an invite-only waiting list.

In summer 2014, Proton Mail received US$550377 from 10,576 donors through a crowdfunding campaign on Indiegogo, while aiming for US$100000.[21] During the campaign, PayPal froze Proton Mail's PayPal account, thereby preventing the withdrawal of US$251721 worth of donations. PayPal stated that the account was frozen due to doubts of the legality of encryption, statements that opponents said were unfounded.[22][23] The restrictions were lifted the following day.[24]

On August 14, 2015, Proton Mail released major version 2.0, which included a rewritten codebase for its web interface. On March 17, 2016, Proton Mail released major version 3.0, which saw the official launch of Proton Mail out of beta. With a new interface for the web client, version 3.0 also included the public launch of Proton Mail's iOS and Android beta applications and the removal of the waiting list.[25]

On January 19, 2017, Proton Mail announced a Tor onion site.[26] On November 21, 2017, Proton Mail introduced Proton Mail Contacts, a zero-access encryption contacts manager. Proton Mail Contacts also utilizes digital signatures to verify the integrity of contacts data.[27] On December 6, 2017, Proton Mail launched Proton Mail Bridge, an application that provides end-to-end email encryption to any desktop client that supports IMAP and SMTP, such as Microsoft Outlook, Mozilla Thunderbird, and Apple Mail, for Windows and MacOS.[28]

On July 25, 2018, Proton Mail introduced address verification and Pretty Good Privacy (PGP) support, making Proton Mail interoperable with other PGP clients.[29]

Around July 2021, Proton Mail's security and cryptographic architecture were both independently audited by Securitum, a European security auditing company, who uncovered no major issues or security vulnerabilities, and the audit results were publicly published.[30]

In April 2022, Proton acquired SimpleLogin, a company based in Paris, France that provides email aliasing addresses. SimpleLogin functionality was subsequently integrated into Proton Mail, but the email masking service is also available independently to use with any email provider.[31][32] That same month, Proton also announced that users would now be able to create @proton.me email addresses, to complement the @protonmail.com addresses that were previously the default choice.[33]

In May 2022, following a rebrand of Proton, a space was added to the official name of the service, transitioning from ProtonMail to Proton Mail.[34] In February 2023 a new version of the Proton Mail Bridge was launched that was considered to be a major improvement.[35] Proton Mail Bridge allows Proton Mail to be used with any third party email client on Windows, macOS, or Linux, without losing end-to-end encryption.

In April 2024, Proton Mail launched a desktop app for Windows and macOS. A version for Linux is in beta.[36][37][38] The desktop client is only available for users with a paying subscription, despite Proton AG's earlier comments that it would be "gradually be made available to all users, including free".[39] The app also allows access to Proton Calendar.[36][40]

In July 2024, Proton released a private AI writing assistant for Proton Mail called Scribe.[41]

Encryption

Proton Mail uses a combination of public-key cryptography and symmetric encryption protocols to offer end-to-end encryption. When a user creates a Proton Mail account, their browser generates a pair of public and private RSA keys:

This symmetrical encryption happens in the user's web browser using AES-256. Upon account registration, the user is asked to provide a login password for their account.

Proton Mail also offers users an option to log in with a two-password mode that requires a login password and a mailbox password.

Upon logging in, the user has to provide both passwords. This is to access the account and the encrypted mailbox and its private encryption key. The decryption takes place client-side either in a web browser or in one of the apps. The public key and the encrypted private key are both stored on Proton Mail servers. Thus Proton Mail stores decryption keys only in their encrypted form so Proton Mail developers are unable to retrieve user emails or reset user mailbox passwords.[42] This system absolves Proton Mail from:

Proton Mail exclusively supports HTTPS and uses TLS with ephemeral key exchange to encrypt all Internet traffic between users and Proton Mail servers.

In September 2015, Proton Mail added native support to their web interface and mobile app for PGP. This allows a user to export their Proton Mail PGP-encoded public key to others outside of Proton Mail, enabling them to use the key for email encryption. The Proton Mail also supports PGP encryption from Proton Mail to outside users.[44]

The public key is used to encrypt the user's emails and other user data.
The private key capable of decrypting the user's data is symmetrically encrypted with the user's mailbox password.

The login password is used for authentication.
The mailbox password encrypts the user's mailbox that contains received emails, contacts, and user information as well as a private encryption key.

Storing either the unencrypted data or the mailbox password.
Divulging the contents of past emails but not future emails.
Decrypting the mailbox if requested or compelled by a court order.[43]

Email sending

An email message sent from one Proton Mail account to another is automatically encrypted with the public key of the recipient. Once encrypted, only the private key of the recipient can decrypt the message. When the recipient logs in, their mailbox password decrypts their private key and unlocks their inbox.

Email messages sent from Proton Mail to non-Proton Mail email addresses may optionally be sent in plain text or with end-to-end encryption. With encryption, the message is encrypted with AES under a user-supplied password. The recipient receives a link to the official and limited version of Proton Mail website, on which they can enter the password, read the decrypted message, and reply back securely end-to-end encrypted. Proton Mail assumes that the sender and the recipient have exchanged this password through a backchannel.[42] Such email messages can be optionally set to self-destruct after a period of time.[45]

Legal status

According to Proton Mail's transparency report[55][56] it is legally obliged to follow Swiss court orders if Switzerland law is broken. Due to the encryption utilized, Proton Mail is unable to hand over the contents of encrypted emails under any circumstances, but according to Proton's 2021 privacy policy Proton Mail can be legally compelled to log IP addresses as part of a Swiss criminal investigation.[57] For this reason, the company strongly suggests that users who need to hide their identity from the Switzerland government use their Tor hidden service/onion site or Proton VPN, noting in particular that under Swiss law, VPNs are treated differently from email, and Proton VPN is not obliged to keep data retention logs of online activity and cannot be forced to log user activity.[58] In July 2025, Proton began steps to diversify its infrastructure, starting with its AI component, to the EU due to concerns over proposed Swiss privacy legislation. The AI infrastructure will be based in Germany with an additional datacenter located in Norway.[59]

In 2020, Proton Mail received 3,572 orders from Swiss authorities and contested 750 of them.[60] Notable court orders include a case involving death threats made against immunologist Anthony Fauci, a case involving French activists accused of property damage, and a case involving a person allegedly involved in Catalan independence activism.[61][62][63] In all three cases, Swiss authorities issued court orders to Proton in response to international requests for assistance. In October 2021, Proton won a Switzerland court case that confirmed that email services cannot be considered telecommunications providers, and consequently are not subject to the data retention requirements imposed on telecommunications providers.[64]

On November 15, 2019, Proton confirmed that the government of the Republic of Belarus had issued a block across the country of Proton Mail and Proton VPN IP addresses. The block was no longer in place four days later. No explanation was given to Proton Mail for the block, nor for the block being lifted.[65]

On January 29, 2020, the Russian Federal Service for Supervision of Communications, Information Technology and Mass Media reported that it had implemented a complete block of Proton Mail services within the Russian Federation.[66] As a reason for the block, it cited Proton Mail's refusal to give up information relating to accounts that allegedly sent out spam with terror threats.[67][68] However, Proton Mail claimed that it did not receive any requests from Russian authorities regarding any such accounts.[69][70] In response to the block, the Proton Mail Twitter account recommended legitimate users circumvent the block via VPNs or Tor.[71]

In March 2020, the company announced that even though the Russia ban was not particularly successful, and the service continues to be largely available in Russia without using a VPN, Proton Mail will be releasing new anti-censorship features in both Proton Mail and Proton VPN desktop and mobile apps which will allow more block attempts to be automatically circumvented.[72]

In April 2025, the Karnataka High Court directed the Indian government to block Proton Mail following a legal complaint filed by New Delhi-based M Moser Design Associates who alleged that its employees had received sexually explicit content in emails sent via Proton Mail.[73]

Proton Mail

History

Encryption

Email sending

Data centers

Controversies

Reception

Legal status

See also

External links

References