How to Secure a Proton Account
Proton offers some of the best privacy tools on the planet — but even the most secure platform can be compromised by weak user practices. This guide walks you through every step to ensure your Proton account is as hardened as possible.
1. Use a Strong, Unique Password
Your Proton password is the master key to your entire account. Because Proton uses zero-access encryption, your password also derives the encryption key for your mailbox. This means:
- Use at least 16 characters with a mix of uppercase, lowercase, numbers, and symbols
- Never reuse a password from another service
If you lose your Proton password and haven't set up a recovery method, your encrypted data is permanently lost. Proton cannot reset it for you.
2. Enable Two-Factor Authentication (2FA)
Two-factor authentication adds a second layer of security beyond your password. Even if someone obtains your password, they cannot access your account without the second factor.
Proton offers support for TOTP based apps & hardware passkeys like yubikeys. The very best & convenient secure option we suggest is using Proton's very own & offline based authenticator app; Proton Authenticator
To enable 2FA: Go to Settings → Security → Two-factor authentication and scan the QR code with your authenticator app.
For maximum security, use a hardware security key (FIDO2/U2F) like a YubiKey. Proton supports these as a second factor.
3. Setup A 2nd Password
Uniquely, Proton allows you to setup a secondary password for your account commonly referred to a secondary or mailbox password.
The feature was originally designed to separately secure your account with the primary & encrypt your data with the secondary. However, Proton's research team has developed alternative & secure means to facilitate the end-to-end encyption.
Today the 2nd Password acts as a 3rd layer of protection requiring any person attempting to sign in to enter at least 2 unique passwords & a verification from a 2FA method.
4. Set Up Account Recovery
Proton offers two recovery methods to help you regain access if you forget your password:
- Recovery email — Like many email platforms, Proton allows you to setup a backup recovery email that can be used as a means of account recovery. However, to ensure it is absolutely secure, we would only advise using another proton email that has been secured using this guide also. A good option for families or couples.
- Recovery phone — You can also use your phone number as your recovery phone. This allows you to send a SMS code to your designated phone number which can be entered to verify & reset your password. A potentially more vulnerable method versus a strong recovery email or the recovery phrase.
- Recovery phrase — The recovery phrase is a generated series of 12 words provided for you in your recovery kit when first setting up your account. If you haven't taken note of this you can generate a new one by going to Settings → Recovery → Generate Recovery Phrase
For the most secure setup, don't use either recovery email or phone & instead just take particular attention to recording & storing your recovery phrase somewhere safe.
Write down your recovery phrase and store it in a physically secure location. This is your last line of defense against permanent data loss.
5. Enable Proton Sentinel Program (Premium Plans Only)
-
Strict challenges for suspicious login attempts
-
Greater visibility on logins and account changes in their security logs
-
24/7 escalation of suspicious login attempts to security analysts who will review assessments made by the automated systems
-
Support requests related to account security will automatically be escalated to trained security specialists.
Proton Sentinel can be enabled on accounts with proton unlimited & above by going to Settings → Security & Privacy → Proton Sentinel
6. Use Dark Web Monitoring
Proton has built in dark web reporting for your email account. When your email is found in a dark web leak, Proton can send you a warning to notify you that your information has been identified. This is often is a result of the security we can't control; the cyber defences of companies we setup accounts with.
7. Enable Detailed Security Event Logging
Proton allows for very detailed identification of information about device used to attempt logins of your account. This can record IP addresses, location, ISP information, browser & device information of attempted sign-ins. Detailed Event Logging is a great feature to monitor account activity, especially if you feel as though you have targeted hacking attempts.
Stay Vigilant
Securing your Proton account isn't a one-time task — it's an ongoing practice. Regularly review your security settings, stay alert to phishing attempts, and keep your recovery information up to date. With these measures in place, your Proton account becomes one of the most secure digital identities you can have.