SECURE YOUR PROTON MAIL ACCOUNT

Protect the account behind your private email.

Proton Mail is part of your Proton Account, which can also provide access to other Proton services. Protect the account itself, its recovery methods and the encrypted data connected to it.

Start with account access and recovery.

Proton's security model is different from many ordinary email providers. Your recovery settings can affect both your ability to sign in and your ability to recover encrypted data.

Work through these checks one at a time. After each important change, use the VERIFY section to confirm that the protection is actually active.

What should I never share?
Never give anyone your Proton password, 2FA code, recovery code, recovery phrase or private encryption key. Legitimate support should not require you to reveal these secrets.
Why is the recovery phrase especially important?
Proton's recovery phrase can be used to reset your password and recover encrypted account data. Treat it as a highly sensitive secret and store it securely.
PROTON ACCOUNT SECURITY

Protect access, recovery and encrypted data.

Work through these checks one at a time. Proton may show slightly different options depending on the services, devices and recovery methods associated with your account.

Turn on two-factor authentication

Add another layer of protection so a stolen Proton password is less likely to be enough to access your account.

Click to see protection steps

Step-by-step

  1. Sign in to your Proton Account.
  2. Open Settings and then select All settings.
  3. Select Account and password from the sidebar.
  4. Scroll to Two-factor authentication.
  5. Turn on Authenticator app 2FA if you want to use an authenticator app.
  6. Follow Proton's instructions to pair your authenticator app.
  7. Enter the verification code from the authenticator app when Proton asks you to confirm the setup.
  8. Save the 2FA recovery codes Proton provides and store them somewhere secure.

VERIFY: Return to Two-factor authentication and confirm that your authenticator app protection is enabled.

Add a security key when appropriate

A physical U2F or FIDO2 security key provides strong protection against phishing and can be used as a second factor when signing in.

Click to see protection steps

Step-by-step

  1. Open your Proton Account Settings and select All settings.
  2. Select Account and password.
  3. Scroll to Two-factor authentication.
  4. Turn on the Security Key option.
  5. Insert or connect your compatible U2F or FIDO2 security key.
  6. Follow the browser's instructions and touch or activate the security key when prompted.
  7. Give the key a recognizable name so you know which physical key it is.
  8. If appropriate, add a second security key so losing one key does not automatically leave you without this authentication method.

VERIFY: Confirm that your security key appears under the registered security keys in your Proton Account.

Protect your recovery phrase

Proton's recovery phrase can reset your password and recover access to encrypted account data, making it one of the most important secrets associated with your account.

Click to see protection steps

Step-by-step

  1. Open your Proton Account Settings.
  2. Select Recovery from the sidebar.
  3. Look for the Recovery phrase option.
  4. Enable or generate the 12-word recovery phrase if Proton shows it as unavailable.
  5. Write it down or store it using a secure method recommended for protecting highly sensitive recovery information.
  6. Keep the recovery phrase separate from your normal password.
  7. Never send the recovery phrase through email, WhatsApp, social media or an unsolicited support conversation.
  8. Never enter the recovery phrase into a website unless you have independently verified that you are using Proton's legitimate account recovery process.

VERIFY: Confirm that your current recovery phrase is stored securely and that nobody else has access to it.

Set up additional recovery methods

Proton recommends using multiple recovery methods because different methods can serve different recovery purposes.

Click to see protection steps

Step-by-step

  1. Open your Proton Account Settings.
  2. Select Recovery from the sidebar.
  3. Review the account safety review shown for your account.
  4. Review the available password reset recovery methods.
  5. Review the available data recovery methods.
  6. Consider enabling a recovery method that you personally control, such as a recovery email or phone number, where appropriate.
  7. Consider enabling an additional data recovery methodif available to you.
  8. Do not rely on a single recovery method for an account containing important encrypted data.

VERIFY: Review the Recovery section and confirm that you have at least one practical password-reset method and one method that can recover your encrypted data.

Review your recovery email and phone

Recovery contact methods can help with password recovery, but they should always remain under your direct control.

Click to see protection steps

Step-by-step

  1. Open your Proton Account Settings.
  2. Select Recovery.
  3. Review the recovery email address if one is enabled.
  4. Review the recovery phone number if one is enabled.
  5. Confirm that each recovery method belongs to you.
  6. Confirm that you can currently access the recovery email or phone.
  7. Remove or replace outdated recovery information using Proton's available settings.
  8. Never add a recovery method because an unknown person tells you to.

VERIFY: Confirm that every recovery contact belongs to you and is currently accessible.

Review your active sessions

Proton lets you review account sessions and log out devices that you no longer trust or recognize.

Click to see protection steps

Step-by-step

  1. Open your Proton Account Settings.
  2. Open the account security or Sessions area available in your settings.
  3. Review the devices and sessions associated with your account.
  4. Look for sessions you do not recognize.
  5. Investigate unfamiliar activity before assuming that it is safe.
  6. Log out of a session that you know is no longer needed or that you have confirmed is not yours.
  7. If you discover suspicious activity, review your password and 2FA settings as well.

VERIFY: Review your sessions again and confirm that the remaining active sessions are devices you recognize and control.

Review authentication logs

Authentication logs can help you investigate account activity and notice sign-ins or authentication events you did not initiate.

Click to see protection steps

Step-by-step

  1. Open your Proton Account Settings.
  2. Find the available authentication logs or account security activity.
  3. Review recent authentication events.
  4. Look for activity that does not match your normal sign-in behavior.
  5. Pay attention to unfamiliar devices, locations or unusual sign-in events where Proton provides that information.
  6. If something looks suspicious, investigate it before continuing normal account activity.
  7. Change your password and review your 2FA and recovery methods if you believe someone else accessed the account.

VERIFY: You should be able to recognize the important authentication activity associated with your account.

Use a strong, unique password

Your Proton Account can provide access to multiple Proton services, so its password should be strong and unique.

Click to see protection steps

Step-by-step

  1. Open your Proton Account Settings.
  2. Select Account and password.
  3. Choose the option to change your password.
  4. Create a strong password that you do not use on another important account.
  5. Avoid passwords based on easily guessed personal information.
  6. Store the password securely, preferably in a reputable password manager.
  7. Never give your Proton password to someone claiming to be Proton support.

VERIFY: Confirm that the new password has been accepted and that you can sign in normally using it.

Review your connected Proton services

Your Proton Account can be shared across services such as Mail, Calendar, Drive, VPN, Pass and other Proton products.

Click to see protection steps

Step-by-step

  1. Sign in to your Proton Account.
  2. Review the Proton services you currently use.
  3. Check whether your account is signed in on devices you no longer use.
  4. Review your active sessions.
  5. Sign out of devices or sessions that you no longer need.
  6. If you stop using a Proton service, make sure you understand whether your account remains active across other Proton services.

VERIFY: Confirm that the Proton services and sessions associated with your account are ones you recognize and still use.

Protect your Proton Mail messages

Treat sensitive messages, attachments and account information as private data that should not be exposed through unnecessary sharing or forwarding.

Click to see protection steps

Step-by-step

  1. Review messages containing passwords, financial information, recovery codes or private documents.
  2. Avoid sending passwords or recovery secrets through ordinary email.
  3. Be careful when forwarding sensitive messages to another address.
  4. Before opening a sensitive attachment, verify that the sender and request are legitimate.
  5. Do not follow urgent security instructions from an email without independently verifying the request.
  6. Use Proton's available security and privacy controls when sending information that requires additional protection.

VERIFY: Before sharing sensitive information through Proton Mail, confirm that the recipient and reason for sharing are legitimate.

Never expose your Proton encryption keys

Proton Mail uses encryption keys to protect messages. Private keys are sensitive credentials and should never be shared with another person.

Click to see protection steps

Step-by-step

  1. Remember that your private encryption key is secret.
  2. Do not send your private key to someone claiming to be Proton support.
  3. Do not upload your private key to an unknown website or service.
  4. Be careful when downloading or managing advanced encryption-key settings.
  5. If you believe a private key has been exposed, stop and review Proton's official key-management and security guidance.

VERIFY: Confirm that your private encryption keys remain under your control and have not been shared with an untrusted person or service.

Secure your account after suspicious activity

If you discover an unfamiliar session, unexpected authentication event, changed recovery information or other unusual activity, treat the account as potentially compromised.

Click to see protection steps

Step-by-step

  1. Stop sending sensitive information while you investigate.
  2. Open your Proton Account Settings.
  3. Review your active sessions.
  4. Review your authentication logs.
  5. Review your 2FA settings.
  6. Review your recovery methods.
  7. Change your password if you believe it may have been exposed.
  8. If you lose access to your 2FA device, use your 2FA recovery code or another legitimate recovery method rather than asking an unknown person for help.
  9. If you cannot safely recover the account, use Proton's official account recovery guidance.

VERIFY: Do not return to normal account use until you have reviewed the suspicious activity and confirmed that your password, 2FA and recovery methods are under your control.

Something does not look right?

If you find an unfamiliar login, changed recovery information, unexpected security alerts or another sign that someone may have accessed your account, stop the normal security check and move to the recovery process.

I think my account is compromised →
Still need help?

If you have worked through the relevant settings and something still looks wrong, do not give your security secrets to someone promising to fix the account. Use the service's official support and recovery resources for service-specific account problems.

For broader cybersecurity problems, you can also use the professional assistance pathway on this platform.

Need Professional Help? →
Proton security is not a one-time task.

Review important account settings periodically, especially after a password change, device change, suspicious message or unexpected login alert.

VERIFY BEFORE YOU TRUST.

← Back to Secure Your Accounts