Does Proton Use AES-256?

This page is part of the Proton Mail FAQ Hub.

Does Proton Mail use AES-256, and where?

Does Proton Mail use AES-256 for the heavy lifting? Yes. AES-256 is the symmetric cipher that actually scrambles your email content, both when it is sent between Proton users and when it rests in your mailbox. The elliptic-curve keys you may have read about handle a different job: agreeing the secret that AES then uses.

This pairing is completely standard. Symmetric ciphers like AES are fast and strong for bulk data, whilst public-key cryptography solves the awkward problem of sharing a key with someone you have never met. Proton did not invent an exotic scheme. It used the boring, well-tested tools, which is exactly what you want.

Is AES-256 obsolete or broken?

No, and it is not close. AES-256 has been public and heavily scrutinised for over two decades, and no practical break exists. It underpins online banking, government classified systems and most of the encrypted internet. If it fell, Proton Mail would be a long way down your list of worries.

Age, in cryptography, is often a compliment. A cipher that has survived twenty years of the world’s best cryptanalysts trying to dent it is more trustworthy than a shiny new one nobody has tested. AES-256 is old in the way a proven bridge is old.

What about quantum computers?

This is the fair question, and the answer is reassuring. The relevant quantum attack, Grover’s algorithm, speeds up brute-force searching, but only enough to halve the effective key strength. That turns AES-256 into something with roughly 128 bits of security against a quantum attacker, which remains far beyond any feasible brute force.

NIST, the US body that standardised AES, expects it to hold up for the foreseeable future, quantum machines included, and specifically favours AES-256 for long-term protection. I will not quote a number of years or a benchmark, because honest cryptography does not come with a firm expiry date. The direction of travel is clear enough.

So what actually is at risk?

The public-key side, not the symmetric side. Elliptic-curve cryptography is more exposed to a future large quantum computer than AES is, which is why the industry is moving towards post-quantum algorithms for key exchange. Proton has already begun adding post-quantum protection, so this is being addressed rather than ignored.

For today, none of this changes your day-to-day risk. There is no quantum computer that can touch AES-256 or current key exchange, and there may not be for a long time. The threats that actually reach you are phishing, weak passwords and lost devices, not a lab in the future.

Do you need to do anything about it?

Practically, no. The cipher choice is made for you and it is a good one. Your energy is better spent on the parts you control.

The encryption is the same whether you are on the free plan or paying for Proton Mail Plus. A paid tier buys storage and features, not a stronger cipher. AES-256 is already doing its job, quietly and well.

• Use a long, unique password and store it in a password manager.
• Turn on two-factor authentication, ideally with a hardware key.
• Keep your devices updated and locked; the endpoint is the soft target, not AES.

---