Short answer: Sign in at account.proton.me, go to Account and password → Two-factor authentication, and enable it with an authenticator app. Save the recovery codes Proton shows you — they matter more here than almost anywhere, because Proton’s encryption means nobody can reset your account for you. Then add a security key as a second method if you have one.
Why recovery is different at Proton
Most services can restore your access if you prove who you are, because they hold your data in a form they can read.
Proton cannot. Your mailbox is end-to-end encrypted with keys derived from your password, and Proton does not hold those keys. That is the entire point of the service — and the direct consequence is that losing access means losing the mail, not waiting in a support queue.
So the usual advice about saving recovery codes stops being good practice and becomes the whole exercise. Set up recovery properly on the day you enable 2FA, not later.
Step 1: Enable two-factor authentication
- Sign in at account.proton.me.
- Open Account and password.
- Find Two-factor authentication and turn on Authenticator app.
- Enter your password to confirm.
- Scan the QR code with your authenticator, or use the key manually — see manual key entry.
- Enter the six-digit code to confirm.
Any standard TOTP app works — Google Authenticator, Aegis, 2FAS, Ente Auth, Microsoft Authenticator, or a password manager including Proton Pass. New to this? What is an authenticator app.
Note Proton does not offer SMS 2FA, which is a deliberate and correct decision — text codes are exposed to SIM swapping.
Do not screenshot the QR code. On a privacy-focused account this would be a particularly unfortunate way to undo the point of using it.
Step 2: Save the recovery codes — properly
Proton shows a set of recovery codes immediately. Download them and store them somewhere physical: printed, in a document folder, or a safe.
Not in your Proton Drive. Not in an email to yourself. Not in a note synced to an account that Proton is protecting. See where to store 2FA backup codes safely and, for the terminology, backup codes vs recovery keys.
Step 3: Set up account recovery
Separate from 2FA, and equally important. Under Recovery in your account settings:
- Recovery phrase — a 12-word phrase that can restore access to your encrypted data. This is the strongest option Proton offers, and the closest thing to a master key. Write it on paper; treat it like a crypto seed phrase, because functionally it is one.
- Recovery email — an address at a different provider, itself well protected. Useful for account access, though note it does not by itself decrypt old messages.
- Recovery phone — optional, and it reintroduces phone-number dependency. Consider whether you want it.
Set at least the recovery phrase. People who skip it and then lose both their password and their 2FA device discover exactly how serious end-to-end encryption is.
Step 4: Add a security key
Proton supports FIDO2 security keys as a second-factor method. If you have one, register it — and register two.
A key is phishing-resistant in a way TOTP is not, which matters for an account that is often chosen precisely because the user expects to be targeted. See hardware security keys, which key to buy and phishing-resistant MFA.
Step 5: The rest of the account
- Sessions — review active sessions and sign out anything unfamiliar.
- Two passwords mode — Proton offers a separate mailbox password distinct from your login password. It adds friction and a genuine layer: someone who obtains your login password still cannot decrypt the mailbox.
- Proton Pass, Drive, VPN and Calendar — all covered by the same account, so this one setup protects everything.
- Bridge and app passwords — if you use Proton Mail Bridge with a desktop client, its credentials are separate. Treat them as sensitive.
- Address verification and encryption settings if you correspond with other PGP users.
A note on threat models
People choose Proton for different reasons, and it changes what you should do.
If you are using it for general privacy, the steps above are ample. If you are a journalist, activist or someone with a specific adversary, go further: security keys only, no recovery phone, a recovery phrase stored physically in a location an adversary cannot reach, and careful thought about who knows the address exists. The parallel considerations for Google are in Google Advanced Protection.
Frequently asked questions
Does Proton support SMS 2FA?
No, and that is intentional. Authenticator apps and security keys only. See SMS vs authenticator apps for why that is the right call.
What happens if I lose my 2FA device and my recovery codes?
Without a recovery phrase or recovery method, your encrypted data is unrecoverable. Proton cannot decrypt it — that is the security model working as designed. Set up recovery today rather than testing this.
Can I use Proton Pass to store my Proton 2FA code?
You can, but think it through: if Proton Pass is unlocked by the same account you are protecting, you have created a circular dependency. Keep the Proton code in a separate authenticator. The wider trade-offs are set out in our look at desktop and browser authenticators.
Why is my code being rejected?
Usually clock drift on your phone. Turn on automatic network time. More: why 2FA codes get rejected.
Does 2FA encrypt my emails?
No — encryption is separate and already applied. 2FA controls who can log in and reach the decrypted view. Two different protections, both worth having.
Is the recovery phrase the same as a seed phrase?
Functionally similar: 12 words that can restore access to encrypted data. Store it with the same care you would a crypto seed phrase — offline, physical, and never typed anywhere except Proton’s own recovery screen. See 2FA for crypto for the handling principles.
The bottom line
Enable the authenticator app, add a security key, and then spend the real effort on recovery — the recovery phrase written on paper and stored physically. On most services, poor backup planning means a support ticket. Here it means the mail is gone. That trade is exactly what you signed up for, so plan for it deliberately.
Comparing email providers on security? See our guides for Google and Microsoft.
One Response