Cloud storage is convenient until you remember that most providers can read every file you upload. Google Drive, Dropbox, and OneDrive encrypt data at rest, but they hold the keys — meaning they can decrypt your files for themselves, law enforcement, or anyone who compromises their systems. Proton Drive takes a different approach: end-to-end encryption where only you hold the private key.
The Encryption Model
Proton Drive uses a combination of asymmetric and symmetric encryption based on OpenPGP, the same standard used by PGP email. Here is how a file upload works:
- A random symmetric key (AES-256) is generated on your device for the file.
- The file is encrypted locally using that symmetric key before upload.
- The symmetric key itself is encrypted using your account’s OpenPGP public key.
- Both the encrypted file and the encrypted key are uploaded to Proton’s servers.
Proton servers never see the plaintext file or the plaintext symmetric key. To decrypt, your device retrieves the encrypted key, decrypts it with your private key (which never leaves your device), and uses the resulting symmetric key to decrypt the file.
File names and folder names are also encrypted — Proton cannot see your directory structure, only opaque identifiers.
Important caveat: If you use a weak Proton account password, your private key (which is stored encrypted on Proton’s servers) could be brute-forced. Use a strong, unique password and enable two-factor authentication.
Free vs Paid Storage
| Plan | Storage | Price |
|---|---|---|
| Free | 1 GB (pooled across Proton apps) | $0 |
| Mail Plus | 15 GB | ~$3.99/mo |
| Proton Unlimited | 500 GB | ~$9.99/mo |
| Proton Business | 1 TB+ per user | Custom |
The free tier is usable for sensitive documents but limited. For a primary cloud backup solution, Proton Unlimited makes the most sense and also includes Proton Mail, VPN, and Calendar.
Desktop Application
Proton Drive’s desktop app for Windows and macOS creates a sync folder on your machine. Files placed in this folder are encrypted and uploaded automatically. You can also choose selective sync to keep only certain folders local.
Linux users can use the official Proton Drive CLI:
# Install via the Proton Linux repository
sudo apt install proton-driveOr access files via the web interface at drive.proton.me.
The desktop app also supports drive-on-demand (files are listed locally but only downloaded when opened), which saves disk space.
Mobile Apps
The iOS and Android apps support:
- Automatic photo backup with E2E encryption (unlike Google Photos, Proton never sees your images)
- Offline access to starred files
- Sharing links with password protection and expiry dates
Enable photo backup under Settings > Auto-backup in the mobile app. Photos are organized by date and stored in a dedicated Photos section separate from your main Drive.
Sharing Files Securely
Proton Drive supports two sharing modes:
Sharing with Proton users: Files are re-encrypted for the recipient’s public key. This is the most secure option — the recipient decrypts on their device.
Sharing with non-Proton users: A public link is generated. You can protect it with a password and set an expiry date. The file is still encrypted in transit, but the recipient’s browser handles decryption using a key embedded in the URL fragment (which is never sent to Proton’s servers).
https://drive.proton.me/urls/RANDOMID#ENCRYPTIONKEYThe #ENCRYPTIONKEY part after the hash is processed client-side only. This is a well-established pattern for secure link sharing.
Integration with the Proton Ecosystem
Proton Drive integrates with:
- Proton Mail: Attach Drive files directly in emails. Large attachments are stored in Drive and linked rather than attached.
- Proton Pass: Passwords saved in Pass can include attached files (for backups of 2FA seeds, etc.).
- Proton Calendar: Share event attachments via Drive.
If you are already using Proton Mail, adopting Proton Drive adds strong cloud backup with no change to your trust model.
Proton Drive vs Cryptomator + Third-Party Cloud
Cryptomator is an open-source tool that encrypts files locally before syncing them to any cloud provider (Google Drive, Dropbox, iCloud, etc.).
| Feature | Proton Drive | Cryptomator + Google Drive |
|---|---|---|
| E2E encryption | Yes | Yes |
| File name encryption | Yes | Yes |
| Open source client | Yes | Yes |
| Server you trust | Proton | Google (encrypted, but Google infra) |
| Sharing with non-users | Yes (secure links) | Limited (share encrypted blobs) |
| Mobile sync | Native app | Third-party apps required |
| Cost | Proton subscription | Free (Google storage limits apply) |
| Audit | Third-party audited | Third-party audited |
Cryptomator is an excellent choice if you already pay for Google Drive storage or want flexibility in your cloud provider. Proton Drive is simpler, has better sharing features, and does not require trusting Google’s infrastructure at all. For users who want one provider to handle everything, Proton Drive wins on usability.
Practical Security Tips
- Use the Proton account recovery file, not SMS recovery. SMS recovery introduces a SIM-swap attack vector.
- Enable hardware 2FA with a FIDO2 key if possible. TOTP is acceptable; SMS is not.
- Do not store your Proton password in a browser. Use KeePassXC or Bitwarden.
- Verify the web app via Proton’s official certificate transparency logs if you are particularly security-conscious.
- Keep sensitive files offline if your threat model includes sophisticated adversaries — no cloud is immune to zero-day attacks on client-side code.
Proton Drive is one of the few consumer cloud storage products where “end-to-end encrypted” is technically accurate rather than marketing language. For privacy-conscious users who need cloud storage, it is a solid default.