Protect your privacy with zero-access encryption

Zero-access encryption is a way of protecting your data stored in the cloud so that only you have access. Proton uses zero-access encryption to store your personal data, like emails, calendar events, and files, on our servers. Your data is encrypted using your public key, and only you can decrypt it using your private key. No one else has access, not even Proton.

With Proton Mail, zero-access encryption only applies to messages stored on Proton Mail. If the person you wrote an email to doesn’t use Proton Mail, their email service can likely read it. To send a truly secure message to someone who isn’t on Proton Mail, you can use a Password-protected Email.

End-to-end encryption means that you encrypt your own data on your own device, and only you and the intended recipient can access it. When you send an end-to-end encrypted email, no one else can read your message, not even Proton or the recipient’s email service.

At Proton, we use both zero-access encryption and end-to-end encryption to protect your data. To understand the difference, consider two scenarios:

1. Someone using Gmail sends an email to your Proton Mail account. When it arrives at Proton Mail, our servers can read that email because Gmail doesn’t support end-to-end encryption. But after receiving the email, we encrypt it immediately using your Proton Mail public encryption key. Afterward, only you can decrypt the encrypted email using your Proton Mail private encryption key. This is zero-access encryption.

2. Someone on Proton Mail sends an email to your Proton Mail address. The email is encrypted on the sender’s device using your public encryption key before being transferred to the Proton Mail server and then to you. In this way, the message is already encrypted before it reaches our server, and only the sender and you can decrypt the email. This is end-to-end encryption.

End-to-end encryption is the stronger of these two types of encryption because Proton never sees the unencrypted message. So for highly sensitive conversations, we recommend that both parties use Proton Mail or a Password-protected Email. With Password-protected Emails, you can send an end-to-end encrypted message to any email address.

Although all major email services use some level of encryption to protect your emails, the term “encrypted email” is often used to describe an end-to-end encrypted email service. Using end-to-end encrypted email ensures that only authorized recipients can access the contents of your messages. Not even the email service itself can read the contents of your emails.

In contrast, email services that don’t use end-to-end encryption retain the ability to access your emails, hand them over to third parties, and put you at increased risk in the event of a data breach.