# Proton Mail Proton Mail is the product [[Proton]] started with in 2014 and still the anchor of the suite: encrypted email with two guarantees. **End-to-end encryption** between Proton users (and with anyone whose PGP key you have, or through password-protected messages to outsiders), and **zero-access encryption** for everything else: incoming mail from Gmail is encrypted with your public key on arrival, so Proton can't read it afterwards even though it saw it in transit. Swiss jurisdiction, no data-retention obligation, open-source clients, audited. ## Features - **Encryption**: E2E with Proton users automatically; PGP with anyone else (you can attach your public key, import theirs, and Proton handles WKD key discovery); password-protected messages with expiry for non-PGP recipients - **Addresses**: multiple addresses per account, custom domains (with catch-all on higher tiers), and **hide-my-email aliases** through the SimpleLogin engine shared with [[Proton Pass]] - **Inbox tooling**: scheduling, undo send, snooze, automatic categories, subscription management, PhishGuard link and sender warnings, folders and labels, filters (including Sieve scripts on paid tiers) - **Easy Switch**: import mail, contacts, and calendar from Gmail, Outlook, Yahoo, or Apple, with ongoing forwarding from Gmail - **Proton Calendar** ships with it: encrypted events, sharing, invitations that work with Google and Outlook users - **Proton Scribe**: an optional writing assistant that can run on-device - **Contacts** with encrypted fields ## Clients - Web app; iOS and Android apps - **Desktop app** for Windows, macOS, and Linux (Mail and Calendar in one). On [[Arch Linux]]: `proton-mail-bin` in the AUR - **Proton Mail Bridge** for anyone who wants Thunderbird, Apple Mail, Outlook, or `mutt`: a background app that exposes a local IMAP/SMTP server and does the encryption and decryption on your machine. Paid plans only. On Arch it's `protonmail-bridge` in `extra`; it also runs headless (`protonmail-bridge --cli`) for servers and scripts. Keys and decrypted mail never leave the machine; the local mailbox is a full offline copy ## The trade-offs - **No server-side search of message bodies** unless you enable encrypted search, which builds a local index in the client. Subject and sender search always works - **Integrations go through Bridge**, not through Proton's servers: anything that wants IMAP (a mail client, a backup script, an automation) talks to Bridge on localhost. That's the price of zero-access - **SMTP for apps** exists for business plans (SMTP submission tokens); for a personal account, transactional sending from an app is not what this is for. See [[Cloudflare Email Routing and Sending]] for that job - Emails to non-Proton, non-PGP recipients are encrypted at rest on Proton's side but travel to the recipient's provider as ordinary mail. E2E only holds when both ends can do it ## Why I keep it Same reason as the rest of the suite, see [[Proton]]: the vendor's business model is that it can't read the data. For email specifically, Swiss law plus zero-access means a subpoena to Proton returns ciphertext for anything already in the mailbox. That is a different category from a provider that promises not to look. It's listed under "End-to-end encrypted" in the [[Data Ownership]] ladder for a reason. ## References - Website: https://proton.me/mail - Bridge: https://proton.me/mail/bridge - Bridge source: https://github.com/ProtonMail/proton-bridge - Desktop app: https://proton.me/mail/download - Source (web clients): https://github.com/ProtonMail/WebClients - Arch packages: https://archlinux.org/packages/extra/x86_64/protonmail-bridge/ and https://aur.archlinux.org/packages/proton-mail-bin ## Related - [[Proton]] - [[Proton Pass]] - [[Proton Drive]] - [[Proton VPN]] - [[Cloudflare Email Routing and Sending]] - [[Data Ownership]] - [[Arch Linux]] - [[Omarchy]]