Proton Mail stores mail end-to-end encrypted, so its servers don't speak plain IMAP. Proton Mail Bridge is Proton's open-source local application that fills the gap. It logs in to your Proton account, decrypts and encrypts on your machine, and exposes an ordinary IMAP and SMTP server on localhost. Any standard client (Mutt, NeoMutt, Thunderbird, mbsync) can then use the account as if it were a normal mailbox.

 Mutt / NeoMutt / mbsync
        │  IMAP  127.0.0.1:1143 (STARTTLS)
        │  SMTP  127.0.0.1:1025 (STARTTLS)
        ▼
 Proton Mail Bridge  ── decrypt/encrypt locally ──►  Proton API (HTTPS)

Bridge vs SMTP submission. Bridge is for a client that needs full read and send access to a Proton mailbox. To have a server or a Postfix relay send as your custom domain, use Proton's SMTP submission service instead (smtp.protonmail.ch:587 with a per-address SMTP token). It needs no local software. See Relaying Outbound Mail in the Postfix guide.

Requirements¶

• A paid Proton Mail plan. Bridge isn't available on the free tier.
• A supported Linux distribution (Proton publishes .deb and .rpm packages), macOS or Windows. There are also community packages (Flathub, AUR).
• On Linux: a secret store for Bridge's encrypted vault key, either the Secret Service API (GNOME Keyring or KWallet) or pass. On a headless box, pass is the practical choice.

Desktop install¶

# Debian / Ubuntu: download the .deb from proton.me/mail/bridge, then
sudo apt install ./protonmail-bridge_*.deb

# Fedora / RHEL
sudo dnf install ./protonmail-bridge-*.rpm

Launch it, sign in (including 2FA), and let it finish the initial sync. Large mailboxes can take a long time. Then open the account's mailbox details to see the IMAP/SMTP settings and the Bridge password.

The Bridge password is generated by Bridge and is not your Proton account password. Your mail client authenticates to Bridge with it. It never leaves the machine.

Headless install (server or VM)¶

Running Bridge on an always-on box lets several devices or tools (mbsync backups, a Mutt in tmux) share one session.

1. Dedicated user and keychain¶

sudo useradd --create-home --shell /usr/sbin/nologin protonbridge

# A GPG key just for the pass store that holds Bridge's vault key.
# No passphrase, because the service has to start unattended. The account's
# security therefore rests on this user's file permissions: keep the home directory 0700.
sudo -u protonbridge -H gpg --batch --passphrase '' \
     --quick-gen-key 'Proton Bridge vault' default default never
sudo -u protonbridge -H pass init 'Proton Bridge vault'

2. Log in once through the CLI¶

sudo -u protonbridge -H protonmail-bridge --cli

>>> login          # Proton username, password, 2FA code
>>> list           # accounts and their status
>>> info           # IMAP/SMTP host, ports, username and Bridge password
>>> change mode    # combined (one inbox for all addresses) vs split (one per address)
>>> help
>>> exit

The binary name depends on the package (protonmail-bridge, proton-bridge, or bridge when built from source with make build-nogui).

3. Run it as a service¶

# /etc/systemd/system/proton-bridge.service
[Unit]
Description=Proton Mail Bridge
After=network-online.target
Wants=network-online.target

[Service]
User=protonbridge
Environment=HOME=/home/protonbridge
ExecStart=/usr/bin/protonmail-bridge --noninteractive
Restart=on-failure
RestartSec=10

[Install]
WantedBy=multi-user.target

sudo systemctl daemon-reload
sudo systemctl enable --now proton-bridge
journalctl -u proton-bridge -f

Reaching it from other machines¶

Bridge binds to 127.0.0.1 on purpose. Avoid patching it to listen on 0.0.0.0 or NAT-forwarding ports to it. Anything that can reach the port can try the Bridge password against your decrypted mailbox. Safer options:

• SSH tunnel from the client machine: ssh -N -L 1143:127.0.0.1:1143 -L 1025:127.0.0.1:1025 user@bridge-host
• Run the mail client on the same host (Mutt in tmux over SSH).
• If you must expose it, do it only on a VPN or WireGuard interface with a firewall rule limited to known peers.

Bridge's TLS certificate¶

Bridge offers STARTTLS on both ports with a self-signed certificate it generates for 127.0.0.1. Clients therefore need to be told to trust it:

• Mutt/NeoMutt: on first connect, choose (a)ccept always. The cert is stored in $certificate_file. Re-accept after Bridge regenerates it (rare, but it happens on reinstall).
• mbsync and other tools: export the certificate (the desktop app has an export TLS certificates option under advanced settings) and point the tool at it. Alternatively, grab it from the running server:

bash openssl s_client -connect 127.0.0.1:1143 -starttls imap -showcerts </dev/null 2>/dev/null \ | openssl x509 > ~/.config/protonmail/bridge-cert.pem

Use the address exactly as 127.0.0.1 in client configs (not localhost), so the hostname matches the certificate.

Mutt / NeoMutt configuration¶

# ~/.config/mutt/accounts/proton.muttrc
set realname  = "Your Name"
set from      = "[email protected]"     # or you@proton.me
set use_from  = yes

set imap_user = "[email protected]"     # the username shown by `info`
set my_pass   = "`pass show email/proton-bridge | head -n1`"   # the BRIDGE password
set imap_pass = $my_pass
set smtp_pass = $my_pass

set folder    = "imap://127.0.0.1:1143/"
set spoolfile = "+INBOX"
set postponed = "+Drafts"
set record    = ""                        # Proton files sent mail in Sent itself
set trash     = "+Trash"
set mbox      = "+Archive"

set smtp_url  = "smtp://[email protected]@127.0.0.1:1025/"
set ssl_starttls  = yes
set ssl_force_tls = yes

set header_cache     = "~/.config/mutt/cache/proton/headers"
set message_cachedir = "~/.config/mutt/cache/proton/bodies"
set certificate_file = "~/.config/mutt/certificates"

set imap_keepalive = 300
set mail_check     = 120
set move           = no
set edit_headers   = yes
set send_charset   = "us-ascii:utf-8"
unset use_domain                          # never generate user@localhost addresses

Notes:

• Folder names. Bridge presents Proton's system folders at the top level (INBOX, Drafts, Sent, Archive, Spam, Trash, All Mail, Starred). It puts your custom folders under Folders/ and labels under Labels/. Some older community configs use a [Protonmail]/… prefix, which doesn't match current Bridge. Browse the server (c then ? in Mutt) to confirm the exact names.
• Labels are folders. Copying a message into Labels/Foo applies the label. Moving it out of Labels/Foo removes the label.
• No smtp_authenticators needed. Bridge accepts PLAIN/LOGIN. Old configs that set gssapi:login gain nothing from the GSSAPI entry.
• Don't embed the password in smtp_url (smtp://user:password@…). It ends up in mutt -D output and debug logs. Use smtp_pass from a password manager.
• PGP. Mail between Proton users is already end-to-end encrypted by Bridge. Mutt's own GPG setup (see Mutt and GPG) is for external recipients who use OpenPGP.

Common errors¶

Backing up a Proton mailbox¶

Because Bridge exposes plain IMAP, any IMAP sync tool can make a local, decrypted Maildir copy. This is the most flexible backup and the same Maildir can feed notmuch search (see NeoMutt).

# ~/.mbsyncrc
IMAPAccount proton
Host 127.0.0.1
Port 1143
User [email protected]
PassCmd "pass show email/proton-bridge | head -n1"
TLSType STARTTLS                      # older isync: SSLType STARTTLS
CertificateFile ~/.config/protonmail/bridge-cert.pem

IMAPStore proton-remote
Account proton

MaildirStore proton-local
Path ~/Mail/proton/
Inbox ~/Mail/proton/INBOX
SubFolders Verbatim

Channel proton
Far :proton-remote:
Near :proton-local:
Patterns * !"All Mail" !Starred       # skip virtual folders that duplicate everything
Create Near
Expunge None                          # a backup should never delete
Sync Pull
SyncState *

mbsync proton    # run from a systemd timer

Key decisions for a backup channel:

• Sync Pull, Create Near, Expunge None: one-way, local only grows. A mistaken delete on the server never propagates into the backup.
• Exclude All Mail and Starred: they're virtual views. Syncing them stores every message two or three times.
• The result is plaintext. Proton's encryption doesn't extend to this copy. Keep the Maildir on an encrypted volume, and encrypt any offsite copy (restic, borg, or age/gpg on the archives).

Proton also offers an official Proton Mail Export Tool, which downloads messages as .eml files plus metadata without needing Bridge. It's handy for a one-off full export, while the mbsync approach suits continuous, incremental backups.

Alternatives¶

• hydroxide: a third-party, open-source Bridge reimplementation (IMAP, SMTP and CardDAV). It's useful on platforms Proton doesn't package for, but it's unofficial, so weigh trusting it with your credentials.
• Thunderbird works directly with Bridge using the same 127.0.0.1 settings, which is useful as a GUI fallback on the same machine.