ProtonMail Review: The Complete Edition You Should Not Miss

A lot of reviewers who reviewed ProtonMail about a year ago thought of it as a fledgling email service.

And of course, it was.

Back then ProtonMail hadn’t launched officially.

Users could only utilize ProtonMail via its alpha phase.

Now, ProtonMail is no longer in the alpha phase of its development cycle.

But even in the days of its alpha stage, ProtonMail showed great promise.

Potential users had to understand its limitation in order to maximize their benefit though.

Today, ProtonMail is a fully fledged email service.

Since its younger days, it has introduced lots of new features.

Some of these features include,

• Premium account
• A new feature where ProtonMail users can send encrypted email messages to other non-ProtonMail users
• Fully open source, which might be the most important feature of them all.
• Mobile apps

Apart from these feature ProtonMail has actually improved many other aspects of its email service.

With that said, there are also other areas where ProtonMail should have worked a bit more.

But it has not.

In this ProtonMail review, we won’t re-invent the wheel.

And we’ll only take a look at ProtonMail as it is now rather than how much it has or hasn’t improved.

ProtonMail Full Review

ProtonMail is not your average email service.

It is an email service that has privacy as its core focus.

That’s what ProtonMail is.

A privacy-focused email service.

The people behind ProtonMail have designed ProtonMail to provide the ease-of-use and functionality of other email services such as Gmail and others.

But unlike Gmail and all other email services, ProtonMail is secure.

Although most importantly, it does not engage in spying activities on its customers nor their communications.

That’s what other email service providers like Gmail do.

Gmail would say that it is only flogging its customer base with stuff.

But in reality, we don’t think Gmail would stop to think even for a second if the NSA demands a specific customer’s data from the email service.

Who Is Behind ProtonMail?

A team consisting of research students from institutions such as Harvard and MIT developed ProtonMail.

Andy Yen, a Harvard Ph.D. student, and a CERN researcher headed the project that we now know as ProtonMail.

In the beginning, the team behind ProtonMail took advantage of a wildly successful and crowdfunded IndieGoGo campaign.

The Waiting List

As you would imagine, ProtonMail has attracted a lot of attention from users who are serious about their privacy.

And because of that high amount of attention, ProtonMail has actually struggled to properly accommodate all the new users who want to use the service.

As a result of that, ProtonMail has a waiting list because the team behind ProtonMail actually goes ahead and activates new accounts.

This is frustrating, to say the least because it has given birth to lots of other issues.

That has caused a lot of these new potential customers to move towards another great email service by the name of Tutanota.

Tutanota doesn’t have any waiting list.

From what we have heard, the time required to spend on the waiting list has gone down considerably.

People no longer have to wait to use ProtonMail for a period of 8 months.

In the early days of ProtonMail, users had to wait for close to a year before they could get their hands on ProtonMail as a service.

Now users only have to wait for about two weeks before they can use ProtonMail.

Of course, that is not the general rule.

It is rather anecdotal.

If this keeps up that ProtonMail will have to contend with a lower share in the privacy-focused email service market.

Not all users are patient enough to wait two weeks to try out a piece of software application.

Update:

ProtonMail has now removed the waiting list feature.

And now the service is open to everyone.

All you have to do is go to the official website of ProtonMail and then sign up for the service.

Price

The most important development that has come out of ProtonMail upgrade process is the introduction of new features such as premium plans.

Don’t worry, because ProtonMail still has its free offering.

That will hopefully exist for a considerable period of time.

In fact, according to ProtonMail, they will continue to offer the free tier service forever.

But the thing is this:

Premium plans really do add some very neat features.

Neat features such as,

• Web addresses
• Custom domains
• Increase messages per day
• Increase storage per day

How much does the premium ProtonMail plan cost?

Well, it starts at around $5 per month.

If you pay no a yearly basis then you can have the premium ProtonMail plan for just $4 per month.

With that said, ProtonMail does give lots of other options to really customize your package.

There is also the ProtonMail Visionary plan.

This will cost you around $30 per month.

The thing about the VIsionary plan is that ProtonMail people have intended this plan for businesses.

ProtonMail has also introduced a new package called the Professional plan.

This plan will set you back about €8 per month if you pay on a monthly basis.

If you bump up the time period then this plan will cost you around €75 per year.

Both the Visionary and Professional plans come with an unlimited number of addresses and messages.

There are also some storage differences between all the four plans.

All free users get a storage of 500MB.

Plus plan subscribers can avail 5GB storage.

The professional package subscribers can avail from one to 50 users.

Each user can utilize 5GB of storage.

The Visionary plan supports six users and offers 20GB of storage.

The professional and Visionary plans also have priority support and an unlimited number of labels and folders.

These two premium plans also have email filters and autoresponders which the Plus and Free plan don’t have.

Apart from that, the Visionary plan comes with ProtonVPN.

The rest of the plans don’t offer ProtonVPN but users can buy it separately.

What Are Custom Domains?

Custom domains are basically your own domain names.

Users can use these custom domain names to receive and send encrypted messages via their ProtonMail account.

A typical example of a custom domain name for an email account would look something like:

myname@myname.com.

ProtonMail Addresses

What is this feature?

This feature basically decides the quantity of @protonmail.ch or even @pronmail.com email addresses that the user can have.

According to official sources from ProtonMail, the company will add more sorting features for both of the above-mentioned features very soon in the future.

You also have to remember the fact that ProtonMail generates new keys for each new and different custom domain.

It also does the same for ProtonMail alias.

Our research for this ProtonMail service shows that the free ProtonMail service will suffice most casual users.

But there are always those power users who want the extra features which only the premium accounts can offer.

Moreover, they will also welcome the additional storage capacity and number of messages that come with the premium plans.

Apart from the fact that you are paying for a superior service, you should also keep in mind that paying for the premium plan actually helps the company out in its funding activities.

You also have to consider the fact that ProtonMail makes absolutely no money at all via questionable practices such as advertising and/or selling the user’s data to third-party companies such as marketing agencies and other advertising companies.

Features

Each ProtonMail package comes with the following features,

• End-to-end encryption for all email messages
• New developments means that now users can send encrypted email messages to their contacts that don’t use ProtonMail or non-ProtonMail users
• Useful self-destruct emails
• Vastly improved online web interface that comes with features such as drag and drop messages along with a contact manager and authentication logs. For more improvements click here.
• Dedicated apps for mobile platforms such as the iOS and Android.
• The company is based in Switzerland which is a feature on its own. We’ll talk more about this feature in later sections.
• Fully open source email service
• Supports public key support which ProtonMail allows users to send to other online PGP users.
  Users can also use the public key to verify email messages manually.

ProtonMail And Switzerland

Many online users are drawn towards ProtonMail for the simple fact that the company operates out of Switzerland.

And as anyone with a high school diploma would know that Switzerland is far away from the United States of America.

It doesn’t come under US jurisdiction, in other words.

Moreover, it also doesn’t come under EU jurisdiction.

Switzerland, as most of us already know, has a good reputation for keeping extremely strong online privacy laws.

Law enforcement agencies have to first obtain surveillance directives from the courts.

And law enforcement agencies in Switzerland do not have gagging powers.

Hence they must notify their targets.

Moreover, Switzerland laws only permit technical interception of various electronic communications when it involves internet service providers.

The laws do not extend these laws to mere internet application service providers such as online email services etc.

So is Switzerland the safest country in the world?

In other words, can Switzerland really justify its privacy policies?

Well, we can’t say for sure.

It is rather unclear at this moment in time.

You would hear a lot of security experts talk about how Swiss law enforcement authorities don’t really have an interest in cooperating with law enforcement agencies from the United States and its other allies.

But that isn’t true.

At least it isn’t true 100 percent of the time.

If you don’t want to take our word for it then fine.

You should talk to some of the US tax evaders who stashed their million dollar wealth in Swiss bank accounts.

Law enforcement agencies found them out back in 2013.

That shows us that if you are someone that law enforcement agencies are looking for, then no place on earth is safe for you.

Except for China and Russia of course.

A trial lawyer by the name of Victor Vital at Barnes and Thornburg, in an interview with Wired, told reporters that people often seemed to have this view that data privacy laws in foreign countries and especially in Europe pose problems.

Some also say that these present a major roadblock.

According to Victor Vital, that is simply not the case.

Why?

Because under the current many treaties, the countries themselves obligate themselves to fully cooperate or at least as broadly and to as much extent as possible.

If that much worrying isn’t enough for you then wait.

We have more for you.

More worrying cases include the fact that new powerful surveillance laws have started to come up strong in the past couple of years.

Yes.

We are talking about Nachrichtendienstgesetzt (NDG) the “BÜPF.

Well, technically speaking these haven’t become laws but the Swiss government is pushing for these because of last year’s horrific terrorist attacks which took place in Paris.

And you can bet that if the Swiss government if pushing for new laws, then there is good chance that they will become actual laws.

If the new proposals do become actual laws then there is no doubt about the fact that they would greatly increase and expand the Swiss State’s surveillance capabilities.

You can thank the system of Democracy in Switzerland for holding off NDG for now.

But the Swiss government has only put a stop to it until the national referendum.

ProtonMail has played its part, rather notable one, by campaigning to acquire more than 70,000 signatures which are usually required to bring about changes such as holding a decision on a proposal.

Right now, the BUPF is actually up for a vote in the Swiss Parliament’s spring session.

Of course, there is always the chance that Swiss authorities may delay or revise it.

Our research for this ProtonMail shows that it is probably fair to state that the current situation is hanging in the air.

ProtonMail is adamant that nothing will change and the company would not feel the aftereffects of the NDG law, even if the people pass it via referendum.

Privacy

All ProtonMail email accounts have the protection of two passwords.

Yes.

Not one.

But two.

The first password helps ProtonMail to authenticate the user.

It also helps the email service to retrieve the proper and correct account.

Perhaps this is a good time to mention that ProtonMail also keeps a copy of this account.

What about the second password then?

The second password is the one that only the user keeps.

Users can use the second password to decrypt their email inbox.

A technologist by the name of Micah Lee who works at The Intercept talked about this two-password approach.

Lee’s work mainly focuses on cryptography and privacy.

Recently he noted that he considered it really nice that ProtonMail had two sets of passwords.

The server received the login password and that’s how the users proved to the system that their username actually belonged to them.

And what about the second password According to Lee?

The second password, according to Lee, basically worked as a mailbox password.

This is the password the ProtonMail servers never receive.

The user’s second password basically runs in the user’s web browser.

And it helps to decrypt the user’s messages there.

ProtonMail servers store all the mail.

But the company encrypts them first.

That means, that the ProtonMail staff doesn’t have any access to any mail.

The ProtonMail servers are themselves very secure.

These servers utilize completely encrypted hard disks.

These hard disks come with multiple and effective (supposedly) password layers.

This is done to ensure that ProtonMail can always keep data security preserved and intact even if someone seizes their hardware.

The other thing you should know right now is that all messages that users send between ProtonMail members actually have complete encryption on them.

Users who want to send messages to other non-ProtonMail members can also encrypt their messages.

Or they can simply send them messages without any encryption.

ProtonMail provides them the opportunity to do so via regular plain text email message.

According to official sources at ProtonMail, the company does not keep any metadata.

Moreover, it does not log any of its users’ IP addresses that they use to connect to ProtonMail.

Of course, it is another fact that from a technical standpoint, there is nothing that is stopping ProtonMail from monitoring your IP address when you connect to their servers.

ProtonMail also mentions the fact that the company’s systems encrypt all email messages.

Hence the company doesn’t really have a way to scan these messages.

And then use the gathered data to deliver their customers targeted advertising.

Update:

ProtonMail has introduced a new feature recently which we missed the first time when we wrote this review.

That feature is this:

ProtonMail now requires all users for human verification when they want to register for a new account.

Users have to verify their accounts via various methods.

Most often, it is via an SMS.

Is that understandable?

Yes.

In many ways it is.

In fact, we think it is rather necessary.

Think of it as a precaution.

Precaution, to block spambots and spammers from abusing the ProtonMail email service.

You have to keep in mind that human verification in every way undermines the notions of ProtonMail anonymity.

Fortunately, users who don’t want to provide their phone number and/or email address to ProtonMail have no other choice but to sign up for a premium account.
Existing users with the free version can simply upgrade to the premium account.

The premium account is great when it comes to anonymity because ProtonMail accepts payments via Bitcoin.

Security

As mentioned before time and time again, ProtonMail makes use of end-to-end encryption for all its encrypted messages.

It uses very secure implementations of all the major open source encryption technologies such as,

• AES
• And RSA
• And OpenPGP libraries such as TLS 1.0, AES-128 CBC, DHE RSA handshake along with SHA 3 hash authentication.

Is this implementation okay?

Yes.

It is.

But it is only okay.

Not perfect.

Why?

Because TLS 1.0 is kind of outdated.

Moreover, a lot of security experts believe that AES 256-bit is actually more secure than the older AES 128-bit.

Of course, we have to mention that the AES-256 vs AES-128 security debate is still wide open.

Why?

Because as far as key schedules go, AES-128 is stronger than AES 256.

If you are wondering who signs these SSL certificates now, then know that QuoVadis Trustlink Schweiz AG does.

QuoVadis recently put out a statement and said that advanced features of their new certificate included Extended Validation or EV along with 4096-bit RSA and SHA 256 bit hash with CT, or Certificate Transparency.

The company also said that together with QuoVadis, they would continue to stay on the real cutting edge of technologies related to SSL certificates in order to ensure the ProtonMail users get the highest level of online security possible.

One of the biggest issues that reviewers had ProtonMail earlier on was that ProtonMail software application wasn’t really fully open source.

Thankfully, that has changed now.

Now, ProtonMail is absolutely and 100 percent open source.

But just because something is open source doesn’t mean it is legitimate or even genuine.

ProtonMail’s case is different.

Unlike a lot of the open source code on the internet, a respected team of able and well-known cryptographers have extensively audited ProtonMail.

These cryptographers actually volunteered to do the audit and did not accept any payment.

In other words, the oversaw the whole project with taking a single penny.

But what did these auditors actually do?

Well, the searched ProtonMail for any potential backdoors and other types of nasty things.

You might as well think that ProtonMail has so far ticked all the right boxes.

That is true.

So far so good right?

Not quite.

As with everything in the real world, everything is never rosy.

A Wired magazine write by the name of Yael Grauer recently explained that one of the big issues that he saw with ProtonMail was that it wasn’t easy to know if an online message that was sent to another ProtonMail user was being encrypted to the related recipient’s correct public key.

As we have mentioned before, it is actually ProtonMail key servers that store the correct public key.

To take an example, Yael said, if Alice sent Bob a message which was encrypted to Bob’s public key, it was harder for hackers or anyone else to read that encrypted message.

The problem with ProtonMail, according to Yael, was that ProtonMail itself distributed the encryption keys to its users.

In other words, ProtonMail actually possessed the ability to give Alice her own keys in addition to Bob’s public keys.

Hence, ProtonMail encrypted messages in such a way that it would expose these messages to potential eavesdropping.

Our research for this ProtonMail review tells us that Apple iMessage shares this weakness.

But applications such as Signal have actually solved this kind of problem.

How?

By simply verifying the user’s public encryption keys.

There is another ProtonMail glaring problem.

Let’s discuss that now.

You see, ProtonMail performs all its cryptography from within the user’s web browser.

And is uses Javascript for that purpose.

This is essential because the system has to perform the encryption end-to-end.

In a parallel universe, ProtonMail could perform this encryption on its own but it would have to hold the private keys.

Luckily, we’re in our universe and not a parallel one.

That doesn’t change the fact that most security experts consider Javascript cryptography inherently insecure.

Or rather very insecure.

Of course, users who are utilizing ProtonMail services via mobile apps don’t have to worry about this problem as it does not affect them.

But they are safe only as long as they do not access their ProtonMail email accounts via any other devices other than mobile apps.

Why?

Because mobile apps don’t really use javascript for functions such as cryptography.

We already know that when someone sends an encrypted email to other non-ProtonMail users, the related content of the encrypted email messages along with any attachments are also encrypted.

Moreover, we should also know that the header in an email message includes information related to normal email metadata.

The header also contains other information such as the sender’s email address along with the time the receiver received the email message.

Add to that list the Subject title as well.

And we know that this scenario could cause some problems as far as anonymity is concerned.

What we mean to say is that metadata is a lot more dangerous than some people like to believe it is.

What’s the takeaway then?

The takeaway is that ProtonMail is an email service that is a lot more secure than many regular online webmail services.

Moreover, ProtonMail would definitely have resistance to those notorious blanket surveillance programs.

We also know that ProtonMail would not spy on its user’s email address.

So they can’t really use the user’s data to sell it to third-party companies and advertisers.

With that said, there is no doubt about the fact that security services along with the NSA will already have the infrastructure they need to monitor ProtonMail accounts very vigorously.

Regardless, ProtonMail continues to claim that the company provides anonymous email services.

Our research for this ProtonMail tells us that you should take that claim with a rather large pinch of salt.

What we mean to say is that you should have no problems in understanding that ProtonMail is not the most secure webmail service in the world.

It is not even close.

That is only if you know how to protect your messages.

In other words, if someone uses a standalone email client and knows how to install a good PGP plugin then that setup is far more secure.

Moreover, you can use web browser add-ons like Mailvelope to further secure your online communications.

ProtonMail Installation And User Interface

Let’s start this section off with the signup process.

If you want to sign up for ProtonMail then you will have to provide ProtonMail with two passwords.

The first, as mentioned before, is the account password.

ProtonMail knows this password.

And the second one is the mailbox password.

ProtonMail doesn’t know this password.

So make sure that you are the only one who knows this password.

Anyone using webmail services for any period of time will definitely feel at home when he/she looks at the ProtonMail interface.

The ProtonMail 2.0 looks great.

And more importantly, it works smoothly enough.

As we have indicated earlier, messages that users send to other ProtonMail users go through the process of encryption automatically.

What about the messages that ProtonMail users send to other non-ProtonMail users?

Well, ProtonMail users have the option of encrypting these as well.

Do take note that any such messages will usually expire or self-destruct in about 28 days.

You can configure the settings to delete your messages earlier than that if you want to.

What happens when you send an email address to your contact?

Well, the recipient of your email message receives a link which points towards the encrypted message.

It also comes with a hint if the sender has configured it.

Readers should know that the above-mentioned message normally expires after about one hour.

The other thing we should all take a note of is the fact that this message does not hide the metadata related to the message.

When the recipient of the message enters the required password, he/she can then read the message.

What happens if the message expires and the recipient hasn’t opened the link?

Well, the link dies.

ProtonMail is available on mobile platforms such as iOS and Android.

You can use them if you want to.

They look and feel really good and tight.

Although, ProtonMail has a responsive website design and that means that you can use the website in your mobile web browser as well without any problems.

Other Platforms

As mentioned before, if you don’t want to use the mobile apps there is always the web interface.

It is available on all mobile platforms.

You can access the online web interface via your regular web browser.

ProtonMail has dedicated apps for Android and iOS.

As far as the Android app goes, it works well and feels smart.

Both the apps come with a ton of the same features that have made ProtonMail so well-known in the world of encrypted email services.

As far as Google Play Store goes, ProtonMail has over 11000 ratings and at the time of writing this review, it had an average rating of 4.7.

That is a pretty good.

So how secure are these mobile apps?

Well, if you want to take Wall Street Journal’s word for it then ProtonMail does manage to offer an encrypted email service that actually makes it very difficult and almost impossible for anyone apart from the sender and the receiver to read and send the actual messages.

Since there are more than 2 million ProtonMail users in the world, we would like to think that ProtonMail’s numbers on Google Play Store will also go up.

Readers should also know that the Android app also brings the same secure email and an easy-to-use interface along with email encryption to the mobile platform.

According to ProtonMail, their Android app seamlessly integrates PGP end-to-end encryption.

The Android app has a modern user interface and comes with a few modern features of its own.

Such as,

• Customizable swipe gestures
• The option to send other users expiring email messages

The other great thing about the app is that ProtonMail only managed to develop with the help of a record-breaking donation campaign that raised $550,000.

ProtonMail apps allow users to create their own free email account.

The Android ProtonMail app also has options for push notifications when new emails arrive in the inbox.

If you ask us to compare the number of features on offer via the web interface with the Android app, then the web interface wins.

But not by much.

Test results On Email Privacy

Mike Cardwell has actually developed a tool called Email Privacy test tool to grade privacy-focused email services like ProtonMail.

You can access that tool here.

Our research shows that ProtonMail had decent results.

But other competitors such as Tutanota had better results.

Conclusion

Pros

• ProtonMail provides way more security than your regular email service provider
• The company does not engage in spying on its users to use their data for advertising campaigns.
• intuitive interface
• Great interface
• Fully open source
• Features that enable sending encrypted email messages to other non-ProtonMail users
• It has self-destruct email messages
• Useful premium subscription options such as custom domain names

Cons

• Research shows that ProtonMail isn’t as secure as some of the other proper PGP email services
• The genuine benefits of an email service provider operating out of Switzerland are still debatable.
• The company requires SMS verification when users try to register which can be a pain.
  You can avoid that by upgrading to ProtonMail premium account though.
• ProtonMail isn’t anonymous even though it advertises as such
• Email Privacy Test results did not blow us away
• ProtonMail users will attract more attention than normal email users but that isn’t really ProtonMail’s fault.
  Just a point that users need to consider.

Bottom Line

Security experts all over the world argue about how the email system has completed reached a point where it is outdated and broken if one is looking for secure communications.

ProtonMail isn’t good enough to fix that problem.

The other problem is that any online webmail service system that managed to implement encryption from within the web browser by using Javascript likely has fundamental security issues.

And this isn’t us hating on ProtonMail.

ProtonMail admits this fact on its official Threat Model web page.

The company states that its services are not recommended for Edward Snowden.

In other words, if a user is anything like,

• Edward Snowden (the famous hacker who released tons of NSA classified documents)
• or on his/her way to becoming the next version Edward Snowden
• Or has an extremely sensitive potentially life-threatening scenario at hand that requires invulnerable privacy tools

then perhaps ProtonMail isn’t something that even ProtonMail would recommend

For all extremely sensitive cases, ProtonMail says that users should simply not use email services to communicate.

Why?

Because as a medium, it is never a good choice to make use of email for privacy reasons.

Okay, onto the good parts then.

ProtonMail has made a tremendous effort to present users with an intuitive and easy to handle webmail service.

Other email service providers like your very own Gmail and the rest of the competition have got nothing on ProtonMail in terms of interface.

ProtonMail will not and cannot really go ahead and spy on its customers communications messages and/or correspondences for the purposes of advertising.

Google along with Apple and Microsoft do engage in that behavior.

Furthermore, ProtonMail will probably not have enough in terms of security to ward off any NSA attacks.

Apart from that, ProtonMail users should know that NSA will, in all likelihood, target ProtonMail users just because they are ProtonMail users.

But for most other purposes ProtonMail does provide a high enough level of online privacy.

It should come in handy if national law enforcement agencies and bodies are carrying out their investigations for whatever reasons.

Moreover, since ProtonMail runs its operations from Switzerland, from a privacy standpoint it should provide a lot of resilience against legal attacks.

What about usability then?

Well, we have already mentioned that ProtonMail has managed to add loads of new features since the company first came onto the scene some years ago.

Hence, ProtonMail is certainly a viable email service provider alternative to all the mainstream webmail service providers.

ProtonMail’s decision to move to 100 percent open source code is also a welcome sign.

In short, users who want to use ProtonMail should first know the limitations of ProtonMail.

After knowing those limitations, ProtonMail certainly represents a positive step forward as far as the user’s privacy is concerned.

It is likely to resist blanket law enforcement agency surveillance programs as well.

But if you are looking for genuine anonymity then don’t expect that from ProtonMail.

Additionally, if the user is up to something very seriously illegal, then too ProtonMail won’t or rather can’t protect that user.