| Based in | Switzerland |
| Storage | 5-20 GB |
| Price | $4.00/mo. |
| Free Tier | Up to 500 MB |
| Website | ProtonMail.com |
ProtonMail gets a lot of attention as a secure email service, even getting shoutouts in various media outlets. But when you strip away the flowery language, does this email provider really stand above the competition? And is it worth the above-average price? We’ll answer all this and more in our new and updated ProtonMail review for 2022.
If you want to protect your email from prying eyes, but don’t need the kind of protection that keeps spies and whistleblowers alive, ProtonMail could be the secure email service for you. It utilizes PGP encryption standards, end-to-end and zero-knowledge encryption. A high level of encryption is very important in an age of eroding security and regular data breaches in the news.
Because ProtonMail positions its service as one of the most secure email options available, above and beyond other secure email providers, we’re really going to put it under the microscope in this updated ProtonMail review for 2022.
At the end of the day, only you can decide which is the best secure email service for your unique needs and threat model. So let’s get started.
+ Pros
- End-to-end (E2E) and zero-access encryption for Email, Calendar, and Contact information
- Operates under Swiss jurisdiction
- All data stored on servers in Switzerland
- Apps for Android and iOS mobile devices
- Web client, encryption algorithms, Android and iOS code are all open source
- Support for custom domains
- Strips IP address from emails
- Can be used with third-party email clients through the ProtonMail Bridge feature
- Can import contacts and emails
– Cons
- ProtonMail does not encrypt email subject lines
- Sometimes requires personal information for verification of new accounts
- Confusing and expensive pricing
- Incredibly long beta test cycles
- May log IP addresses for government agencies
ProtonMail features overview
ProtonMail utilizes strong end-to-end (E2E) and zero-access encryption standards to protect all email, contacts, and calendar data. All your data is encrypted when stored on ProtonMail servers, except email subject lines (more on this later).
Note: To understand the difference between E2E and zero-access encryption, check out this excellent explanation.
Aside from this multi-tiered encryption system, ProtonMail has plenty of interesting features, including:
- The ability to send “self-destructing messages,” which are automatically deleted at the time the sender specifies.
- Address Verification, a way to ensure that a Public Key received from another user hasn’t been tampered with since you first verified it.
- Full PGP support.
- Premium accounts with a range of additional benefits, including a brandable Business account.
- The ability to send encrypted emails to non-ProtonMail users.
- Android and iOS mobile apps plus a web client.
- ProtonMail Bridge, which allows ProtonMail to integrate with other email clients that support the IMAP and SMTP protocols. This also allows you to import mail into your account from other services.
Overall, this is a good lineup of features.
ProtonMail company history and funding sources
The ProtonMail family of products is run by Proton Technologies AG, a company based in Geneva, Switzerland. The founders met while scientists at CERN and came up with the idea for a secure email provider in the CERN cafeteria, as the story goes.
Funding for ProtonMail has come from various sources over the years. Aside from regular paying users, Protonmail has also benefited from the following funding sources:
- In 2014, ProtonMail launched an Indiegogo crowdfunding campaign which brought in over half a million dollars.
- In 2015, ProtonMail accepted a $2 million investment from a US-based firm called Charles River Ventures (CRV).
- In 2019, ProtonMail accepted €2 million from the EU government to “develop a suite of encrypted services.”
ProtonMail is a bit more expensive than some of the other secure email services we’ve reviewed, such as Tutanota and Posteo for example.
ProtonMail does not encrypt email subject lines
One concern I have is that ProtonMail does not encrypt the subject lines of messages. From the ProtonMail website:
All ProtonMail data at rest and in transit is encrypted. However, subject lines in ProtonMail are not end-to-end encrypted, which means if served with a valid Swiss court order, we do have the ability to turn over the subjects of your messages. Your message content and attachments are end to end encrypted.
ProtonMail complies with the OpenPGP encryption standard, which is based on the proprietary PGP standard. In that standard, address-related metadata is part of the message header and must remain unencrypted to allow a message to reach its destination.
ProtonMail does not encrypt the subject of your emails. If this is a problem for you check out our Tutanota review, which does not rely on PGP and fully encrypts subject lines.
The ProtonMail approach makes them compliant with the PGP specification, but leaves this potentially-revealing data unencrypted. We will return to this important subject in a moment.
ProtonMail servers and data security
All ProtonMail servers are physically located in Switzerland in secure facilities. This means user data is protected by Swiss law, which generally provides for better privacy than USA or EU law.
However, ProtonMail makes it clear that if you violate Swiss laws, and they receive a Swiss court order, they will have to turn over whatever information they have on you to the Swiss authorities. This is where the lack of encryption for the Subject line of messages can become a problem.
While the bodies of your messages and any attachments should remain safely encrypted, addressing information and the Subject lines of your messages are stored in the clear and would be provided to the authorities. This information is enough to give anyone possessing it a good idea of who you communicate with and the subjects you discuss with them.
ProtonMail logging IP addresses
Additionally, ProtonMail may also be logging your IP address and providing this to government authorities. I learned about this by reading ProtonMail’s Transparency Report.
There was another high-profile case of ProtonMail logging IP addresses in 2021. This case received lots of attention because:
1) the ProtonMail user was arrested by authorities; and
2) ProtonMail then scrubbed its website of the “no IP logging” claims after the incident
This is another reason we also recommend using a good VPN service that hides your true IP address and location. Using a good VPN is also essential for basic digital privacy in a world when ISPs log everything you do online.
Some people also question how free from USA and EU influence Proton Technologies really is. Additionally, Switzerland now has data retention regulations, but ProtonMail argues that these regulations do not apply to their services, but rather Swiss internet providers.
All that said, the ProtonMail threat model document specifically states that,
“we cannot guarantee your safety against a powerful adversary.”
The spy agencies serving the USA and EU definitely qualify as “powerful adversaries.” Under most circumstances, this is a secure email service. But if you decide to take on one of the Five Eyes, violate Swiss laws, or do something else equally crazy, using ProtonMail is unlikely to save you.
Is ProtonMail really anonymous?
If you look at the ProtonMail home page, you’ll find this claim:
I like the idea of being able to create an account without providing any personal information. Just finding a secure and private email service is hard, which is why we have created this series of email reviews for you. An anonymous and encrypted email service would be great — but there’s a problem.
When creating an account to test out ProtonMail for this review, I was forced to go through a verification that is the exact opposite of “anonymous” — as they boldly claim to offer.
How does ProtonMail square this requirement to enter personal information, with their claim that, “no personal information is required to create your secure email account”? To me, it seems like a clear contradiction.
To attempt to explain away this contradiction, ProtonMail has created a page explaining their “Registration Human Verification” procedures, which you can read about here.
First, the system doesn’t always force you to enter personal information. They have, “an intelligent algorithm that determines the required verification method based on a number of factors.” Sometimes it will only require a reCaptcha to confirm that you are human.
At other times you will be forced to use email or SMS verification, or make a “donation” using a credit card or PayPal. In other words, their algorithm will decide for itself whether or not you are allowed to create an account without disclosing personal information. So let’s call it conditional anonymity.
The page also explains that if you do use email or SMS for verification, only a cryptographic hash of this information is stored. This hash, “is not permanently associated with the account that you create.” The page doesn’t explain if “not permanently associated” means “never associated,” or “temporarily associated.” Nor does it explain how credit card and PayPal verification is tracked.
I can understand the company’s desire to have processes in place to prevent spammers from abusing the system. But I can’t understand their claim that no personal information is required to create your secure email account with the fact that sometimes personal information is required. The fact that the email and SMS hashes are not permanently associated with your account doesn’t change the fact that you must provide them, then trust ProtonMail’s handling of them.
We have reviewed other secure email services that give you more privacy when registering for an account. For an example of this, see our Tutanota review.
My Two Cents: ProtonMail needs to clarify or eliminate the claim of offering anonymous email.
ProtonMail technical specifications
ProtonMail uses a variety of encryption algorithms to protect your messages. All messages are end-to-end encrypted and also remain encrypted in your mailbox until actively being read. The algorithms they use are open source versions of AES and RSA along with OpenPGPjs algorithms:
- AES-128
- TLS 1.0
- DHE RSA
- SHA 3
QuoVadis Trustlink Schweiz AG signs SSL certificates for ProtonMail.
Security features of the certificates include:
- Extended Validation (EV)
- Certificate Transparency (CT)
- 4096-bit RSA
- SHA-256 hash
ProtonMail hands-on testing
If you’ve used email services like Microsoft Outlook or Gmail, you will find ProtonMail to be easy to work with. For this review, we’ll be looking at ProtonMail Plus plan, the first tier of paid ProtonMail service. At this time, you need to have a paid ProtonMail account and access the beta version of the product to use some of the newest features, such as their new encrypted Calendar.
Creating a ProtonMail account
Creating an account with ProtonMail is pretty self-explanatory. You can get an account in a matter of minutes:
- Go to the ProtonMail website and select the SIGN UP button.
- Create a username and password. (Recovery email is optional.)
- Go through the verification steps
I’ve seen complaints that ProtonMail sometimes forces people to go through phone (SMS) verification if they try to sign up using a VPN or the Tor network. While I don’t like the idea that ProtonMail may force you to use SMS verification, I understand their desire to protect the service from spammers and bots.
Note: I have no reason to suspect that ProtonMail is lying to you about this, but I also understand that many people want to use ProtonMail truly anonymously. I could imagine someone like that using an anonymous payment method like a new, virtual credit card to make a donation. Or maybe renting an SMS number just long enough to complete the process. Even using a disposable email address then discarding it once the verification is done.
ProtonMail betas
Before we go further, we have to discuss how ProtonMail handles beta versions. They are serious about wanting community involvement in the process. As a result, the newest version of ProtonMail can be stuck in beta for a long time. How long? Years.
ProtonMail version 4 went live in October of 2019. The new ProtonMail was finally released in June of 2021, more than a year and a half later.. I find this mind-boggling but that’s the way this team rolls, apparently. In response to the various complaints on Reddit, ProtonMail acknowledges the missed deadlines and delays:
So what does this mean to you? I don’t think it is a good idea for a privacy-oriented person to rely on beta software. By definition, beta software isn’t completely ready yet. This could include flaws, bugs, and/or exploits that undermine your privacy and security.
Unless you are comfortable with the real, but hard to quantify privacy risks of using beta software, I recommend you stick with the released version of ProtonMail (v4.0.20 at the time of this review).
Signing in to ProtonMail
Signing in to ProtonMail is easy and straightforward. Simply go to the homepage and enter your login credentials. When using ProtonMail, you have the option to create a recovery email inbox, which can be used if you lose your password.
Once you sign into ProtonMail, you can stay with the free plan or upgrade to one of the paid plans. As is common with most secure email services, the paid plans offer more storage and additional features over the free plan. We noted this same dichotomy in our ProtonVPN review.
Note: As we go through this review, I’ll let you know which features are available only in a paid plan or only in the beta.
The look and feel of ProtonMail
The new version of ProtonMail has a pretty standard interface, with a 3-pane “Row View” layout (we saw that when talking about encrypted subject lines earlier). They also offer the “Column View” option, as you can see here:
With Column View, you get all the usual folders in the left-most pane, with the ability to add any custom ones you wish. And like other privacy-oriented mail services, ProtonMail blocks remote content like images by default, giving you the option to load them right at the top of the window.
The web client works smoothly although there can be a delay when opening a message, given that the message must be decrypted before you can read it. Since the client is browser-based, instead of a stand-alone app, you might find that it slows down as the number of messages as your folders increase, but I didn’t notice any problems during testing.
ProtonMail Settings
You can customize the layout of your ProtonMail inbox by clicking the Settings icon. In the menu that appears, select Go to settings, which opens the Settings window. Then select Appearance in the left-hand column of the Settings window. For example, I used the Layouts section of Settings to switch back and forth between the Row View of the inbox and the Column View.
Exactly what you can do here will of course depend on which ProtonMail plan you subscribe to. We’ll look at the differences between the plans later in the review.
Composing messages with ProtonMail
By default, you compose ProtonMail messages in a pop-up window called Composer. It comes with a good set of HTML formatting options, including inline images. This window appears in the lower-right corner of the ProtonMail window, and looks like this:
Once you get used to the layout, the composition window makes including things like Attachments, an Expiration time, a Read Receipt Request, and Encryption fast and easy. If you don’t like working in this little window, can make the Composer window large by clicking the Settings icon, then Appearance. In the Composer section that appears, select Maximized.
Note: You can only set an expiration time on messages sent to other ProtonMail users or encrypted messages sent to non-ProtonMail users. You cannot make an unencrypted message to a non-ProtonMail user expire.
There are a few keyboard shortcuts that help with composing messages. But you won’t find more advanced editing features such as macros and automatic suggestions.
Sending messages to non-ProtonMail users
Like some other secure email services, such as Tutanota and Mailfence, ProtonMail gives you the option to send encrypted messages to people who don’t use the service. The recipient will need to know the shared password you are using, so that will need to be arranged outside the system. These encrypted messages automatically expire in 28 days (but you can set a shorter date if you wish). Here’s a screenshot from our tests:
The recipient will then get an email with a secure link. If they enter the correct password and click the View Secure Message button, they will be able to see the message you sent them.
This system seems to work very well, as long as you can share the password outside the ProtonMail system to get the process started. For this endeavor, you could consider using a secure messaging app.
Searching for messages in ProtonMail
ProtonMail has a very limited ability to search your messages. Because messages are encrypted (except while you are actually viewing them), the client can’t search message bodies. This, of course, can be frustrating and really limit your ability to find the message you are looking for. Here’s a screenshot of the search feature:
If you give ProtonMail 4 permission to do so, it can download, decrypt, and index the bodies of your messages to facilitate searching them. This approach appears very similar to that taken by Tutanota several years ago.
Comparison to Tutanota search – In comparison, we noted in our Tutanota review how this email offers full-text search capabilities — and has done so since 2017. To do this, Tutanota creates an encrypted search index which can then be searched locally on the users’ device.
ProtonContacts
The ProtonContacts secure contact manager is integrated into ProtonMail, giving users a secure way to protect their contacts while functioning smoothly with ProtonMail.
ProtonMail creates ProtonContacts encryption keys for you. It uses those keys in their zero access encryption system to encrypt clear text contact data, ensuring that once they do encrypt your data this way, even ProtonMail can’t read it. ProtonContacts also uses digital signature verification to ensure that no one else can secretly tamper with your contact information. ProtonContacts is also implemented in the mobile apps.
Note: Email addresses in contacts are not encrypted using zero access encryption. Why? Because ProtonMail needs to be able to read the email address to make sure your message gets sent to the right place.
ProtonCalendar
Building an encrypted calendar sounds pretty easy at first. Just encrypt all the data until the user opens the calendar, then decrypt the data for them. But just as an email service has to interact with other email services, a calendar service needs to be able to interact with other calendar services.
Even worse, a full-powered calendar system needs to be able to share events with other calendar systems. The engineers battled with this complexity for over a year, and on December 20, 2019, they announced the arrival of ProtonCalendar.
It features:
- Calendar sharing
- Event invitations to anyone (whether they use ProtonMail or not)
- The ability to sync the calendar with events found in your ProtonMail inbox
- The ability to import other calendars in .ICS format
ProtonCalendar is also now available for iOS and Android.
ProtonDrive (beta)
In November, 2020, Proton announced the release of ProtonDrive in beta. This is a basic secure cloud storage feature that can be used with certain accounts. However, as we noted in our ProtonVPN vs NordVPN comparison, the Proton team has a habit of restricting features to only the highest-paying subscription tiers.
We see that ProtonDrive is only available to the following users at this time:
- Visionary or Lifetime accounts
- Accounts with both ProtonMail Plus and ProtonVPN Plus with one-year or two-year plans
- Accounts with both ProtonMail Professional and ProtonVPN Plus with one-year or two-year plans
How long will ProtonDrive stay in beta? Who knows. But given Proton’s history, it could be a really long time. I’ve seen a growing chorus of ProtonMail users voice their frustration over the endless beta status of this and other products:
This will someday be a welcome addition to the Proton product line. But if you need secure (non-beta) cloud storage now, I suggest you consult our guide to the best cloud storage instead of waiting for ProtonDrive to come out of beta.
ProtonMail mobile apps
ProtonMail has apps for both iOS and Android. I’ve been working with the Android app and it looks good and functions smoothly. At the time of this ProtonMail review, the Android app had 42,000 reviews with a rating of 4.2 out of 5 stars.
Since our last major review, Proton Technologies completed the process of making their Android app open source. However, it is still not available on F-Droid.
The iOS app is also open source. The iOS app gets a score of 4.0 out of 5, with over 2,900 reviews.
ProtonMail business features
ProtonMail also offers a service for businesses that provides “end-to-end encryption to secure your business communications.”
This service includes migration tools and dedicated support to transition your business from its current hosting to the ProtonMail infrastructure. It incorporates a user hierarchy allowing your Email Administrators to manage user accounts appropriately.
Given the current limitations with search and calendar, I’m not sure ProtonMail would be a great fit for businesses that need all these features. There are other good options that are more fully-featured, such as Mailfence or Mailbox.org.
ProtonMail Support
ProtonMail provides differing levels of customer support depending on which subscription plan you have. Not surprisingly, free users get a basic support level, with access to a searchable knowledge base and some helpful step-by-step guides. As you move up through the paid plans you get email support and eventually priority support.
ProtonMail cost and pricing plans
Since they don’t display ads in their clients, or sell access to your messages to advertisers, ProtonMail charges for their services. ProtonMail has four pricing plans, including a free tier with 500 MB of storage.
The Free plan, with 500 MB of storage, 150 messages per day, and 3 folders / labels could be enough for you. If not, one of the paid plans will likely meet your needs.
The details of each pricing plan tend to change, so I haven’t included a screen capture. Your best bet is to go to the signup page and see what the current offer looks like.
ProtonMail’s paid plans have historically been more expensive than the competition. Their individual plans (Plus and Visionary) will set you back $48 per year and $288 per year respectively, while the Professional plan runs $6.25 per month per user.
Note that the Free, Plus, and Professional plans all offer ProtonVPN as an option, while the Visionary plan has the VPN built in.
ProtonMail alternatives
While there are several secure email services on the market, Tutanota is the first alternative I would suggest. Rather than using PGP and S/MIME, Tutanota has rolled out their own encryption standard incorporating AES and RSA, which encrypts the subject line, supports forward secrecy, and can be updated/strengthened over time. Tutanota has also rolled out a fully-encrypted Calendar feature.
My verdict: Tutanota is the best alternative to ProtonMail in the high-security category. (It is based in Germany.)
There are other alternatives to ProtonMail that offer a lesser degree of encryption and security, but with more features:
- Mailfence is a Belgium-based email that has many features, integrated PGP support, and it works well for groups/teams.
- Mailbox.org is another good option based in Germany with many features and options for teams.
Both Mailfence and Mailbox.org support custom domains.
ProtonMail FAQ
Here are some of the more common questions about this product and its related components such as ProtonMail Bridge.
Is ProtonMail really secure?
There is a lot of debate out there about how secure ProtonMail really is. Aside from the financial ties to the US and EU that we discussed earlier, there have been some criticisms of the service on other grounds as well.
- The browser client uses JavaScript encryption libraries. These are considered to be less secure than the libraries used in the ProtonMail mobile apps.
- Leaving the Subject field in the clear (for PGP compatibility) means more data could be exposed to those spying on the message traffic.
- A paper published at the end of 2018 criticized ProtonMail’s cryptographic architecture on a number of grounds. However, these same criticisms could be applied to any browser-based email client (not just ProtonMail). Here is the response from ProtonMail.
On the subject of using PGP, there are also some benefits in terms of security. OpenPGP is an open standard, which has been extensively audited for security, and is battle tested, and well proven to be secure. ProtonMail also the maintainer of OpenPGPjs, which is the most widely used open source encryption library and has therefore been thoroughly audited.
Lastly, we also have to keep in mind that ProtonMail is arguably the biggest name in the private email space. This makes it a good target for criticism, as we also noted in our NordVPN review, as the largest VPN provider.
Can ProtonMail hand over my data to the authorities?
Because ProtonMail uses E2E and zero-knowledge encryption, there isn’t a lot of data that they can hand over to anyone. The only thing that is stored unencrypted is message headers and the email addresses of contacts.
Even here, Proton Technologies says they won’t hand over any data unless directed to by the appropriate Swiss authority. Your data is about as safe as it can be using publicly available tech.
A bigger risk to the security of your data, is the way governments are pushing to break end-to-end encryption. There are constant efforts to force companies to insert “backdoors” into their software that would allow law enforcement to bypass encryption. This recent Fortune magazine article nicely describes the situation in the United States today.
Can you switch between paid and free ProtonMail versions?
Proton Technologies allows you to switch between the free and paid versions of this encrypted email service. You can go from a paid version to the free version, but if you do you’ll lose all the premium features of the paid version you are leaving. You can also return to a paid version from the free version. How? By subscribing to the paid version you want. You won’t lose any of your messages when you do this.
What is ProtonMail Bridge?
ProtonMail Bridge handles encrypting/decrypting messages when you connect it to a third-party email client. The ProtonMail Bridge page describes it best:
Bridge runs in the background by seamlessly encrypting and decrypting messages as they enter and leave your computer. The app is compatible with most email clients supporting IMAP and SMTP protocols.
You must have a paid subscription to use the bridge.
ProtonMail review conclusion
ProtonMail is a polished and popular end-to-end encrypted email service that will meet the needs of many regular users.
As one of the most popular secure email services on the market, with a free basic account, it is a great option for regular encrypted communications with friends, business partners, and others who want protection from routine snooping and hacking. You will, however, need to be patient about getting advanced features thanks to ProtonMail’s extended beta test cycles.
For those who want maximum security with full encryption of subject lines and strong data security, or simply faster delivery of new features, Tutanota might be a better fit.
Is ProtonMail the best secure email service for you?
I can’t tell you that since everyone’s needs are different. There are many factors to consider when selecting a secure email provider and the choice all comes down to your own preferences. You can learn more about ProtonMail on their website here:
Alternatives to ProtonMail
We have numerous email solutions that offer a higher level of privacy and security. You can also check out our full lineup of recommended secure email providers.
We also have a roundup guide on temporary disposable email services if you need a quick email for registration.
And here is a list of other email services we have reviewed:
Tutanota Review
Mailfence Review
Mailbox.org Review
Hushmail Review
Posteo Review
Fastmail Review
Runbox Review
CTemplar Review
This ProtonMail review was last updated May 1, 2022.
I have been through several proton mail addresses and my experiences is that back door access is a problem at proton mail. Every time I lose control there’s a slew of back-and-forth with proton mail support about issues with the account and the next thing I know my passwords been reset. Big issue I see is the VPN that seems to get added on these occasions which hides the ip of logins. The p.m. me seems to appear out of nowhere and that requires domain service which I have not paid for. And the biggest issue is when you know you’ve been compromised and you delete the account they let it get put right back up the next day and then say it’s not your account. I know my proton mail is compromised when I see that the Messages counter stops working and shows no mail when there are messages and also when I delete my trash and it stays in the trash. So my advice is don’t open a ticket because they’ll lock you out and your hacker will have permanent ownership of your email account. I currently have an email with proton mail with these issues.
Why do they never address back door access and limitations? Time to change the laws about deleting an account permanently. Swiss laws is actually a harbor for hackers. I’d gladly let the government read my boring email if they’d keep big tech and data brokers out.
I have been a user of Proton Mail for some years..that and Gmail. The “old” proton was great. everything fit well, writing area was great, address book just fine, in other words, a well-done email app. Now they come out with the “new” proton version which you must change to. Now I can’t access my address book in the same browser I was using. And the whole thing llooks like it was designed by one of those “techs” that got a trophy for everything he did. Sad, as the Swiss are usually pretty good but I guess it’s back to Gmail for me.
I closed my Proton Mail account, right after I was hacked a few months ago! I’m still looking for another secure email. I’m considering StartMail, but I like to try it for more than the 7 day trial they offer, that’s not long enough. Does anyone know anything about MsgSafe.io or GMX?
“May log IP addresses for government agencies” Are you saying that they have been granted permission to log, or that there is some probability that they do it? If it is the latter you want the word ‘might’. Note
https://datatracker.ietf.org/doc/html/rfc2119
Proton mail filters do not read the inbox. So if someday you decide to organize your inbox – you can’t, unless you want to go through one by one. Is there a security reason for that? I am thinking pop3 and local mail client on linux, will have to research which one. Suggestions?
Their pricing is tiered, and though they quote ‘per month’ it is actually ‘per two years’.
This happened last year and gives the background about their disclaimer that they may log I addresses for government agencies. They will only if required to and in this case they were. Proton has fought off other subpoenas in the past, but this incident involved a potential terrorist.
https://techcrunch.com/2021/09/06/protonmail-logged-ip-address-of-french-activist-after-order-by-swiss-authorities/
Just tried to renew ProtonMail email account and came across a new bump in road. It’s called 3 D Secure (its actually been around for about 15 years or so)and in my very humble opinion is just a third party parasitic piece of junk(I am being nice here) . So I had to enter more information about myself than Proton asked for and when I pressed submit button, I was told I couldn’t be verified.
Seriously? This is a program available to merchants through Visa according to my research. Out of country (USA) merchants such as ProtonMail use this more than merchants inside U S. .
Because of this third party junk program, I can no longer use ProtonMail and am losing access to my important stuff Why?
Because I live in a small town and my banks VISA never heard of 3D Secure. The banks Visa system has to sign on with 3D secure..
Unless my Visa Card is in the 3D system Proton no longer recognizes me. So 3D Secure and Proton just “cancelled” this small town gal.
3 D Secure sells itself as being an added layer of protection, blah, blah, blah,. If my email’s encrypted, and VPN is involved why all the anxiety?
As far as payment goes the program is redundant, you can either pay or not. How much protection is needed before going overboard? I had plenty available in my Visa to pay this renewal, BTW.
Proton will be losing subscribers like me because of it. Smart move Proton
I am hoping Tutanota isn’t using this garbage if so, I will be stuck with some unsecured US program. Or may solely try using a secure messaging program if there is such a thing.
I liked Proton, it was uncomplicated and worked fine–til now.
Only use Protonmail if you don’t mind potentially losing all access to your email and connected accounts in the future… if you make two or three Protonmail emails, they will most likely lock all your accounts for “abuse” and refuse to allow you access back into them. Most people need multiple emails for different things, such as different accounts on the same social media where a unique email is needed for each account. You will lose access to these accounts connected to the Protonmail account if you create two or three. I would highly recommend not using Protonmail for this one reason. I have lost access to many of my accounts which each used a Protonmail account as an email. These accounts were only signed into once and never sent a single email, they were just used to sign up for other websites and social media. Even after explaining this to support, I was denied access into my now locked email account due to “spam” (even though I have never sent a single email from a Protonmail account).
1. Protonmail free users now can stay login in the browser.
2. You can also use ElectronMail app to do the same.
3. It also comes with recovery codes feature.
Had a protonmail account for a few months. My mistake was making it my exclusive account and deleting all others. I used it for business and personal, collected many valuable contacts.
One morning I noticed my browser did not fill in my proton password as usual. So I accidentally typed in old password and bam! No more protonmail. My account suspended, compromise detected. Had to open another email to email protonmail help to restore my account. That’s been weeks ago now, still no access, response from them has been obtuse and ineffective, and I’m doubtful I will ever recover my contacts much less receive emails from those contacts.
So thanks, Protonmail. Thanks for f***ing me over, costing me time and money. Far as I’m concerned, you are either incompetent or intentionally malignant. Not sure which, maybe both, but doesn’t matter now. What matters now is me telling as many people as I can, in every forum I find how sh***y Protonmail is.
That’s strange. I have entered the wrong password on my ProtonMail account a number of times without an issue.
For that matter, someone should not be able to lock your account by trying to guess your password.
Perhaps I’m not understanding something.
Someone actually got ahold of my password and stole my Proton account. I emailed support and answered each of their account recovery questions 100% accurately. They declined to give me my account back.
I even sent them screenshots of me logged into the account, such as the settings menu and IP address screen. They said they do not rely on screenshots because they can be faked and photoshopped, yet the information present in the screenshots couldn’t be faked (IP, name, recovery email) unless the person “faking” them knew all information about the account. All Protonmail would have to do is check if the data in the screenshots (and data I provided) matched the email before it was stolen and the data would have matched 100%. I have no idea how I was denied access back into my own account created on my own IP on the same computer, but oh well. Back to Gmail for me!
I just opened an account today to make the switch from hotmail.com to protonmail.com but your message isn’t really comforting. Just wondering how did you set up the account? I inserted a recovery email address so in case I lose my login details it will be send to me recovery email. This is what Proton says about account recovery:
“In case you lose your login details, we’ll send you recovery instructions via email or SMS.”
I’ve also setup a recovery phrase which is a sentence with random words which allow me to unencript my data once I reset my password. This is what Proton says about the data recovery:
“After a password reset your data is locked in encrypted form to keep it safe. To decrypt and view your emails and other data, you need a recovery phrase or recovery file.”
I’m really curious if you did the same and still got locked out. A honest reply is appriciated!
“ProtonMail has introduced an enhanced email tracking protection system for its web-based email solution that prevents senders from being tracked by recipients who open their messages.”
https://www.bleepingcomputer.com/news/security/protonmail-introduces-a-new-email-tracker-blocking-system/
I didn’t see a review for Zoho? I had a small business with private domain that my wife & used for business and now retired would like to continue with our domain email address. We have used the free Google for years, and now workspace is taking over. No longer a business expense and Google’s “bad behavior “, I’d like to find a new email host. I think about 10GB per email is the most we need, probably need IMAP for my iOS client “Spark”, and we need to share calorie keep track of each other’s appointments. Importing our existing MBOX FILES from Google would be important. I am definitely willing to pay something for privacy, but just not sure how much, depending on our features. I have gone through your reviews, but would appreciate some advice. Thank you.
I used Zoho for a while for our users. We dropped it when one user objected to having their e-mail which can contain personal financial information hosted outside the country.
I did encounter one minor issue with Zoho that I remember. If I remember correctly, while using imap I deleted the mail from my spam folder one night and this was interpreted as marking them as not being spams.
In general, I liked Zoho and we would probably still be using it if not for that one user’s objection.
Do not be fooled by Protonmail’s deceptive claims and do not believe in any policies NO LOGS, because this is the worst of possible profit-oriented postal services, not privacy. They have dodgy and twisted records in privacy policy / terms of use of the service, cheeky and vindictive customer service, which will write after a few days they will not restore the account without any justification. And you remain without mailbox from day to day on which you have everything you need to work. Rate the quality of services offered by this company after reading he whole eview, I guarantee that no one will treat them seriously anymore.
Suddenly, your account has been blocked by the anti-spam system, even though it’s your only account and you have never sent any spam from it (after all, they keep metadata and know it). Therefore, you lose everything that is on this email (the ability to recover passwords to other boxes, bank data, important emails and contacts) and there is no appeal from this, because despite the multiple kind requests, they do not care and and they are not going to help you by writing the same thing over and over again like bots.
No logs policy and zero knowledge? Well, some people also believe in Saint Nicholas … They keep absolutely all your identification data: IP, which you log in, used device, address used to recover your account, or phone number and the same data to confirm that you are a man and metadata. It is also a pity that this data is also a greedy bite for hacker (data leaks happens everyday), corporations and all national services. This is how the website provides private e-mail services?
Of course, all these activities are aimed at preventing abuses: https: / /protonmail.com/privacy-policy, https://protonmail.com/terms-and-conditions. For me it is simple, or there is privacy and zero knowledge about the user, or it does not have it, you can not just be a bit pregnant … Unlike, for example, Tutanota during registration, they do not also mention that you can not have several accounts, and either the fact that after recovering the account, if you forget your password, you will irretrievably lose access to the old e-mails, accumulated on the site, because they are encrypted with the old forgotten password.
If I can suggest something if you do not have any choice, take your account in this damn service as a temporary and do not store any important data on them, nor contacts, use a Tor Network, put your account there, use different IP and logins not related to you, do not set any a password recovery and use to verify RE-CAPTCHA, or temporary email.
Have had a free Protonmail account for several months. Works ok but it is not my main account. Have had a gmail account for over 15 years but have been concerned about it the last year due to privacy and the fact it is a business account with 15 years of data that is fairly sensitive. Tried Proton as a free account. While ok it is a bit of a pain to use, lack of storage and now reading all this info makes me leery. The VPN does not work well as it shows my computer and makes a lot of websites fail to load. Sometimes if I reload it works but many times it doesn’t. SO I am really good for a good solid privacy based encrypted email to move my business account to and a good VPN. A deep dig of Express shows it is owned by a conglomerate that has China ties (based upon my research) so I am still looking for a good fast VPN. Also would like an email account that has lots of storage without costing an arm and a leg. Overall would rate Proton as ok but my lack of daily use may be a factor with that rating.
ExpressVPN had an office in Hong Kong, as well as other locations around the world. It was purchased by London-based Kape Technologies, as we discussed in this article.
I also found ProtonVPN to be slow in the last round of tests — much slower than other leading VPNs.
For our latest VPN recommendations, see our best VPN list.
Does anybody know what happened to cryptoheaven secure email out of Canada?
What do you think about zohomail? I would like to know if it is one of the best private email services. Thanks in advance.
We haven’t tested it, but our top recommendations for email are here.
Zoho Mail is not end-to-end encrypted meaning emails can be read by them. But Zoho Mail is ad-free and has a strict policy for accessing user data. So Zoho Mail is not private by design, just by principle.
I pay protonmail $150 USD a year for two accounts, and I have a couple of free accounts as well.
This is to wake you all up out there who think that Protonmail is PRIVATE. It is not private. They now have BOTS that read your incoming and outgoing email and SHUT YOU OFF for nothing, arbitrarily banning you from using your own account, alleging “bulk mail” when there is NO BULK MAIL happening.
On 24 Sept 2021, I sent a total of 3 emails, 2 to a bishop in Canada, 1 to a show-host about an interview he had done with a lawyer. The next day, on 25 Sept 2021, I RECEIVED 3 autoresponders from another show because I had used the FORM at their own web site to send them comments on their show and links to information related to their show.
PROTONMAIL SHUT DOWN MY ACCOUNT AND BANNED ME on 25 September alleging “bulk mail” for 3 incoming autoresponders that day and 3 outgoing emails the previous day.
Then, when I complained about this outrageous abuse, they accused me of sending “BULK MAIL” and BANNED me again for 48 hours more immediately after I had sent one REPLY email to an incoming email.
That’s all it took.
Nothing more than that to be BANNED arbitrarily by these little commie pea brains who use BOTS to read your mail, shut you down for nothing, and then allege “bulk mail”.
The shut-off described above was in a free account. But they shut me off also using bots and for no reason, meaning also arbitrary, in a PAID account at $75 USD a year a couple of weeks ago.
Basically, I can NO LONGER USE MY PAID OR FREE Protonmail accounts for normal correspondence, because (1) it isn’t really private and (2) they shut you off if you send THREE emails or receive THREE emails.
There has to be an alternative to these people, they are SCREWING their members. They need to LOSE their fake “encrypted” email business, for ABUSING the fundamental rights of their paid and free users.
– – –
And that’s not the end of it. Protonmail changed their system completely and by surprise without the decency of telling their long-term members and PAID subscribers that their new system was not compatible with Chrome, Firefox and other browsers on Windows XP Pro SP3, thus LOCKING us out of our PAID accounts.
Protonmail’s original accounts had a couple of problems that needed to be fixed, and that they knew about, and acknowledged; and had FEATURES that users relied on. The new Protonmail has lost some of those features, and the big problem of not being able to READ your message in the reading pane because the pane is too narrow — a problem Protonmail acknowledged and said they were going to fix — has not been fixed in the new Protonmail.
If you can tolerate the garish candy-colors of the new Protonmail, and the outrageous BANNING by BOTS of your free and PAID accounts, then enjoy yourselves, by all means. Protonmail has become just another version of TWITTER.
I’ve had free ProtonMail account for around a couple of years (+a newly created backup account, also free) and been quite happy with it. Yesterday I reset my password by accident on my primary account and all encrypted data were lost, in other words I can no longer read the content of all previously received and sent emails, drafts etc. ProtonMail has a description of how to restore it, which I followed. First step is to access account settings on the web, however, when clicked on settings, I did not access my account settings, but was instead led to their purchase options. Until I read the comments here, I was sure there had to be some kind of error in their system, but now I am not so sure. I am afraid the company is seriously requiring me to purchase a subscription in order to get access to settings to reactivate my previous password, which I luckily remember, and restore all my previous emails. This is, however, not at all mentioned in their support instructions, which I think is really odd: https://protonmail.com/support/knowledge-base/restoring-encrypted-mailbox/
Before it occurred to me that they might actually be serious about asking me for payment in order to restore my data, I emailed Zendesk and asked for help to access settings. I am looking very much forward to their response, that is if I will get any consideration what people are saying about their support in here … I’ll let y’all know what happens.
When you click on Protonmail’s account settings, the first page it opens up to is usually their purchase options. The rest of the settings should be in the menu on the left hand side of the page.
You’re an idiot.
Windows XP SP3 is ancient history. One of the last updates it received was to pop up a reminder every month telling you that it was no longer supported. That was 8 years ago.
Chrome and Firefox no longer support XP. Even when they still did, Chrome and Firefox on XP still lacked support for modern crypto. You literally cannot connect to a web page from XP on those browsers without using a protocol that has multiple severe vulnerabilities.
Wish I had looked online before purchasing. Software never worked with my Mac. Customer service of no help. I tried multiple emails and kept getting the same pat answers that showed they weren’t reading the emails.
Worse, I got this for privacy, and somehow, it completely ignored the name I put for my account and somehow pulled my real name and put it on all emails. Maybe it pulled it from the account I used as a back up, but it should NEVER do that. Further, I can’t change that backup account as it says credentials wrong (they’re not). There is no privacy here. Save your money AND more important, your privacy by passing on this company. Very untrustworthy firm.
Isn’t that the truth. They are definitely not what they pretend to be. There are many disgruntled users who have posted comments about unacceptable abuse by Trustpilot who have been closed down for no valid reason which is what pathological narcissists do. Proton block users when they are the ones failing account holders by giving users different information so they are unable to make the correct choice. This happened to me. They do not sort out the issues they create, instead they abuse users and are vindictive and punish users because they are very low frequency individuals with no conscience and no empathy. I did not get what I paid for and had to cancel. They had sent me emails telling me that I could access ProtonBridge with any upgrade, After I paid for this they told me that I could not access ProtonBridge but could use their VPN. Well it did not work when I tried to use it before on Linux. It was not set up properly. They deliberately hide all the emails that proves they are pathological liars. They are awful and get away with it because they are located in Switzerland. They close down accounts when they are at fault and if you have not backed up your data they get to steal your information and do what they like with it. They are wolves in sheep’s clothing. Luckily I had already got another account with a very good techie guy from YouTube. They are a corporation of disordered characters with no values and underdeveloped brains. As soon as they received contact from my bank they closed my account. Thank you so much for this article and for the highly informative comments from those who have received unacceptable treatment from Protonmail narcissists. Proton should not be allowed to get away with holding on to personal data and behaving like 3 year old toddlers who hate their toys because of bad parenting. Their behavior is unacceptable. Sadly, unscrupulous corporations located outside of the UK get away with doing as they please and this must be changed. Instead of the British government wasting time and fiat currency on enforcing stupid rules about mask wearing, which is just a ritual to their two headed fictional God Janus, they should stop Protonmail from stealing our data and be forced to refund those who have been scammed and be hit where it hurts most when they stonewall financial institutions when they receive complaints about their incompetence.
I think your comment should mention whether we have the ability to export data and whether we need to pay a price (such as cost). In my research, ProtonMail only provides a single email export function for free users, if you need to export For many emails, you need to become a paying user and use the bridging tools they provide. For resource information that values user privacy, whether your data belongs to you, can it be easily obtained, and leave the existing service provider, this is an important reference information.
It lacks a description of how to handle the collection and storage of unencrypted emails, and whether it may be required by the authorities to record unencrypted emails (such as “Tutanota saves unencrypted emails for German authorities” you mentioned).
Here’s one for you guys. I had a Proton Mail account for my business the last 2 years. In late June 2021 my PM account login was hacked. Some German POS got into it and then changed the back up email locking me out of the account. Dealing with PM customer service has been nothing short of outright idiocy. Because they have no other way to verify they ask you questions about specific dates of logins. They want all kinds of mundane information you were supposed to – according to them – have remembered every detail of. It’s the most ridiculous process ever, and because I couldn’t jump through these overrated idiots hoops I never recovered my account. These guys are TERRIBLE at their business. They focus on email encryption and leave your account wide open to hackers at the login level. I lost all my contacts because of this ineptitude and started an account a Tutanota. I’m not worried the same thing will happen to that account because if it does Tutanota gives you a 64 character code when you create the account that overrides every other action on your account so YOU can recover your account without needing any help from non customer service. Worst experience I have ever had with any customer service at Proton mail and this was the most important customer service I ever needed. They don’t know what they are doing when it comes to securing your account.
I fully concur with the characterization of PM’s support as “idiots.” For the last month now, I’ve been trying to downgrade my Plus account to the free version. I can no longer pay for Plus because: 1) I found it a bit expensive, considering it was something I never really needed in the first place (I signed on and paid two years ago purely out of charity, simply wanting to show my support for what I thought was an honest company); 2) I couldn’t continue the membership even if I wanted to, as I have lost access to the bank account used to pay for the membership (i.e., my bank card had expired and I didn’t have a new one sent to me to the overseas location where I reside). The irony in all this is that if I had never paid for the account in the first place, i would still have access. What’s the expression — “never let a kind deed go unpunished”? So now I’m embroiled in a communication nightmare with the PM support people in trying to get access to the account so that I can delete messages to reduce the storage. Have sent one message after another to their support team and have received responses but no actual assistance, as the problem of non-access persists. Latest response from them (from robot “Johnny”) reads: “Could you tell us if you have difficulties accessing your mailbox? If so, upon a quick check, we notice that there is an unsettled invoice in April 2022.” After all the messages I’ve sent explaining the situation and that’s your response?! Can you not read?! Incredible. After the system denies my access with the rude message of “Your account has at least one overdue invoice. Your access has been restricted. Pay invoice” (Uhh…no, I won’t and I can’t for the reasons previously given), I next try to downgrade the account to the free version. I’m denied with a flash message that reads something like “one or more users are using too much space to downgrade to the free version.” OK, so let me have access to the account so I can delete messages. Here’s the circular logic in this (which sort of reads like a riddle): Access to the account is required to delete messages to enable a downgrade to the free version, which will in turn enable….access to the account. Where’s Virgil when I need him to get me out of this circle of hell? So….my several requests for assistance have yielded nothing and thus, thoroughly fed up, I finally sent PM support a single-word exclamation telling them what I thought of them. Hint: starts with an “a,” has an “h” in the middle, and ends with an “s.” (Perhaps the best response is the most immature.)
One more example of declarations vs. reality:
https://www.theregister.com/2021/09/07/protonmail_hands_user_ip_address_police/
Yes, I hope restoreprivacy.com updates this. From my understanding, while ProtonMail was abiding by the law, the injunction was served way before this came out. They started tracking the climate activist’s IP in January. Had they informed the user was being monitored? If they had a gag order, do they not have a canary?
Excellent points. Yes, we’ll be completely updating recommendations soon. We’re still researching the issue to cover this story in a new blog post.
Some info on this here: https://theconsciousresistance.com/protonmail-is-insecure/
Here is an excellent report about open source.
What I appreciate is it gives some behind the scenes stuff at PM.
https://protonmail.com/blog/open-source-encryption-privacy/
Proton has some arrangement with Google, and my email composition is being examined. Press f12 when composing a message.
I went to this site to check out other encrypted email services.
Other secure mail services are here.
What reference to Google have you found with F12?
There have been questions as to the logging of IP and issues involved with ProtonMail and ProtonVPN, and being in Switzerland with the BUPF.
A discussion ensued and the comment was made that none are exempted. Of course, knowing that hard proof is needed to decide what validity there was of this statement, I dug and asked for help.
An argument from silence, especially those who are trying to point out false statements simply because they do not like ProtonMail and VPN, is no argument at all.
ProtonMail has stated that they are exempted from the logging requirements: https://protonmail.com/blog/swiss-surveillance-law/
Of course, survellince requests of any kind can be taken too far, and yet in Switzerland the amount of survellince is very low compared to the US, UK, AU, etc. In fact, year over year, live survellince has gone down, not up: https://www.li.admin.ch/en/stats.
Are there abuses, yes, no government is perfect. But it is not enough to hear ProtonMail state that they are exempt because any company can say what any company wishes to say. What should be considered is what the law states. It was mentioned that there are no exemptions. This is false.
Article 26 al. 6 BUPF, there is exemptions possible (except for metadata) that can and does exempt companies based on some criteria: https://www.fedlex.admin.ch/eli/cc/2018/31/en#art_26
How does a company know if it is under these exemptions? Art. 51 VUPF gives the criteria and while I do not speak the language, this can be translated, and I used DeepL to do so. https://www.fedlex.admin.ch/eli/cc/2018/32/fr#art_51
Therefore, while there is some discussion about ProtonMail and VPN, at least now we have a reference point to know what the truth is.
ProtonMail and VPN is a very solid company which has done most things right and has proven themselves time and again. If and when that time comes they are required to log IP addresses, then I will admit that a new company is needed and will switch. But if you are on the fence about where to go, I can think of no one better for privacy and security.
I’ve been using Protonmail for quite a while and, for the most part, I like it. However, the Bridge has caused me many problems AND nowhere can I find instructions on how to delete/uninstall it from my computer. That seems to me a serious fault in Protonmail. I’ve never seen/used any program that did not give a way to uninstall it. I wrote to their support and received a cryptic answer that did not work. I am now awaiting an answer to my second and third requests.
https://github.com/vladimiry/ElectronMail/releases