How to Secure a Proton Account

Almost everything in this guide lives in your Proton account settings, so let's start there. In Proton Mail, click the gear icon in the top-right corner, then choose All settings.

That opens the full settings dashboard at account.proton.me, where you'll find the Account and password and Security and privacy sections used throughout this guide.

If you haven't already set a unique, complex password, set one now. From the settings dashboard (Step 1), open the Account and password tab in the sidebar, then select Change login password.

Your Proton password is the master key to everything. Because Proton uses zero-access encryption, it also derives the key that decrypts your mailbox — so its strength directly determines how protected your data is. Use at least 16 characters, unique to Proton and never reused anywhere else.

You have a few ways to create one: come up with a strong password yourself, use Proton's built-in password generator, or let Proton's official password manager — Proton Pass — generate and store it for you.

Proton's two-password mode splits your account into two separate keys: one password to log in, and a second one to decrypt your mailbox. Because they're independent, even if someone gets past your login — your password and 2FA — they still can't read a single message without the second password. It's an extra layer protecting your data itself, not just access to the account. The trade-off is that you'll enter two passwords each time you sign in.

To set it up, navigate to Settings → Account and password and switch on Two-password mode. You'll be asked to enter your current main password (and your 2FA code, if you have set it up).

You're then asked to set a new login password. If yours is already long and complex, you can simply re-enter the same one you have been using.

Next, you'll set your second password. We suggest using Proton's built-in generator to create a strong one — just note it down somewhere safe first. Then use the built-in copy button to copy it to your clipboard and paste it into both fields.

Two-factor authentication (2FA) means a stolen password alone isn't enough to get in. Proton supports two kinds: an authenticator app that generates time-based codes (TOTP), and a hardware security key (FIDO2, such as a YubiKey).

For most people, an authenticator app is the best balance of security and convenience. You can use whichever app you prefer — but we'd suggest avoiding one that syncs your codes to an online account (such as Google Authenticator, which backs them up to your Google account), since that ties your second factor to another login that could be compromised. Our pick is Proton Authenticator: it generates codes offline and encrypts them locally on your device.

To turn it on, go to Settings → Account and password → Two-factor authentication and switch on Authenticator app. Scan the QR code with your app, then enter the 6-digit code it generates to confirm. Proton will then show a set of backup codes — save these somewhere safe, as they're the only way back in if you lose your device. For the highest assurance, you can also register a hardware security key.

Recovery is what gets you back in if you forget your password or lose access to your 2FA. Proton gives you a few options, all found under Settings → Recovery: a recovery phone, a recovery email, and a recovery phrase.

For maximum security, we'd avoid the recovery phone entirely — it ties your account to your SIM. A recovery email is only worth considering if it points to another Proton inbox (ideal if you have a partner or trusted friend on Proton). The best option is the recovery phrase, which is entirely offline.

When you first set up your account, Proton should've encouraged you to download your recovery kit (which contains your recovery phrase) or shown the phrase on screen for you to note down. It's extremely important to keep this phrase safe — it's what gets you back in if you forget your secondary password or lose access to your 2FA.

If you have forgotten or lost your recovery phrase, you can create a new one on the recovery page under Recovery phrase → Generate new recovery phrase. As before, store the new phrase somewhere safe. A similar option in the same section is the device data backup file, which you can also download — this one is a little more precarious if you keep it on a device you use day to day. To be safe, store it on a USB drive (or two) kept somewhere secure, as an extra offline means of recovery.

Finally, by default you'll also have QR sign-in and device-based password reset enabled. We suggest turning these off: if one of your devices were ever compromised, they could become a route back into your account.

Proton Sentinel is Proton's highest level of account protection, built for people who could be targeted — it combines automated defences with a team of human security analysts.

With Sentinel switched on, suspicious sign-in attempts face much stricter scrutiny and extra verification, high-risk events are escalated around the clock to Proton's security team for manual review, and you get far more detailed security logs — the device, location and IP behind every attempt. In short, it's designed to stop an account takeover even if an attacker already has your password.

Turn it on under Settings → Security and privacy → Proton Sentinel. Sentinel is available on Proton Unlimited and above.

Your email address is the key to most of your online accounts — and when another company gets breached, your address and passwords can end up for sale on the dark web. Dark Web Monitoring continuously scans known breach databases and leaked data dumps for your Proton addresses (including aliases and custom-domain addresses) and alerts you the moment your details show up.

Each alert tells you which breach exposed you and what data leaked, so you can change the affected password and lock that account down before anyone can abuse it. It runs automatically in the background — there's nothing to check manually.

Turn it on under Settings → Security and privacy. Unlike Sentinel, it's included with every paid plan — from Mail Plus up (it isn't on Free).

Proton's Account monitor keeps a log of every authentication event on your account — sign-ins, password changes and blocked attempts. By default it records only the basics, but you can switch on detailed events for far more.

With detailed events enabled, each entry records the IP address, approximate location, ISP, and the device or browser behind it. That detail is what lets you catch trouble early: an unfamiliar city, an unknown device, or a blocked sign-in from abroad is your first sign that someone is trying to get in — and if you ever need to investigate or report an incident, you'll have a clear record to work from.

Turn it on under Settings → Security and privacy → Account monitor and toggle on Enable detailed events. As this is a sensitive change, Proton will likely ask you to confirm your password and complete your 2FA before it takes effect.

Once it's on, Proton will typically send a notification to the Proton Mail app whenever a new sign-in occurs. If one looks suspicious, you can act on it immediately — and the detailed device, IP and location information in your logs is exactly what helps you identify who, and where, was behind the attempt.