What Is NOT Encrypted in Proton Mail?

This page is part of the Proton Mail FAQ Hub.

What exactly does Proton Mail leave unencrypted?

What Proton Mail does not encrypt end-to-end is the metadata every email needs in order to travel: who sent it, who received it, and when. Subject lines fall into the same bucket. The body and attachments are encrypted, but the envelope details are not, because the servers along the route have to read them to do their job.

Think of a physical postcard versus its address. The message can be sealed, yet the address, the postmark and the delivery time are visible to anyone handling it. Email is much the same. The content can be locked tight whilst the routing information stays legible by design.

Why can’t subject lines be end-to-end encrypted?

Subject lines sit in the message header, which the OpenPGP standard does not encrypt end-to-end. Encrypting them completely would break compatibility with every other mail server on earth, and your messages would stop arriving. So Proton makes a deliberate trade: interoperability over total secrecy in the header.

There is a meaningful consolation. Stored subject lines are covered by zero-access encryption, so once a message is in your mailbox, Proton cannot read the subject either. The exposure is mainly in transit and in the metadata records, not in Proton’s storage. Small distinction, but it matters.

Who can actually see this metadata?

In transit, the mail servers that relay your message can log the sender, recipient and timestamp. If you email a non-Proton address, that provider sees the same envelope. This is ordinary for all email, Proton or otherwise, and no provider has solved it without breaking delivery.

Metadata is quietly revealing. A pattern of who you email, how often and at what hours can sketch a surprisingly detailed picture, even when nobody reads a single word of content. This is the part people underestimate, and the reason the limitation is worth taking on board rather than shrugging off.

How do you reduce what leaks?

You cannot make routing metadata vanish, but you can be sensible about it. Keep subject lines vague when the topic is sensitive. Put the detail in the encrypted body where it belongs. Treat the subject as a label a stranger might read, because in transit, one might.

None of this is a reason to distrust the encryption that is there. It is a reason to understand its edges. The content protection is genuine and strong. The metadata gap is a property of email itself, not a corner Proton cut.

• Keep sensitive detail out of the subject line; it is the least protected part.
• Assume sender, recipient and timestamp can be observed in transit.
• For high-stakes contact, consider that the fact of the conversation is visible, even if its contents are not.

Does this make Proton Mail pointless?

Not remotely. Zero-access encryption on stored mail and end-to-end encryption between Proton users are real, and they put your actual messages beyond Proton’s reach. The metadata limitation is shared by every email service, including the ones that market themselves as private without mentioning it.

If metadata itself is your threat model, email is the wrong tool, and a paid tier will not change that. Proton Mail Plus adds domains, storage and aliases, which help you compartmentalise, but the envelope stays visible. Honesty here beats a comforting fib.

---