Proton Bridge Setup Guide: Use Thunderbird, Apple Mail, and Outlook With End-to-End Encryption

Last updated: 2026-06-15

Bottom Line First

Proton Bridge works by running a local IMAP/SMTP proxy on your machine. Your email client talks to 127.0.0.1 on private ports, Bridge decrypts/re-encrypts on the fly using your Proton keys, and your messages never leave your device unencrypted. Once configured, it is invisible — email just works in your client of choice.

The three things that trip people up every time:

The Bridge password is not your Proton account password. Bridge generates a separate credential. Use that one in your client.
The Bridge TLS certificate is self-signed. You must explicitly trust it, or your client will refuse the connection.
Bridge must be running. If it is not in your system tray, your email client will time out.

Get those three right and the rest is just clicking through account setup screens.

Install and Unlock Proton Bridge

Download Bridge from proton.me/mail/bridge and install it normally for your OS. On Linux, Bridge ships as a .deb, .rpm, or an AppImage.

On first launch, sign in with your Proton account credentials (email + password + 2FA if enabled). Bridge will sync your mailbox metadata — this can take a few minutes on large accounts.

Once signed in, Bridge sits in your system tray. Click the tray icon and open the main window. You will see:

Your email address listed as a connected account
A Bridge password (a generated string, not your Proton password) — copy this now
IMAP port: 1143
SMTP port: 1025
Host: 127.0.0.1

Keep this window open while you configure your client. You will need the Bridge password repeatedly.

If you have a paid Proton account and want the best privacy stack for your whole workflow, Proton Unlimited bundles Mail, VPN, Drive, and Pass under one subscription — the Bridge feature is included.

Affiliate Disclosure: This article may contain affiliate links. If you make a purchase through these links, we may earn a small commission at no extra cost to you. We only recommend products we genuinely believe in. This helps support our work and allows us to continue providing free content.

Trust the Bridge Certificate (Do This First)

Bridge uses a locally generated TLS certificate to secure the connection between your email client and itself. Because it is self-signed, your OS does not trust it by default.

macOS:

In Bridge, go to Settings → TLS certificates → Export
Save the .pem file to your Desktop
Double-click the file — Keychain Access opens
Find the certificate (named "ProtonMail Bridge CA"), double-click it
Expand Trust, set When using this certificate to Always Trust
Close and enter your macOS password to save

Windows:

Bridge → Settings → TLS certificates → Export
Double-click the exported .crt file → Install Certificate
Choose Local Machine → Place all certificates in the following store
Browse → Trusted Root Certification Authorities → OK → Finish

Linux:

Most clients on Linux let you accept the self-signed certificate during account setup without a system-level install. If your client rejects it, copy the exported .pem to /usr/local/share/ca-certificates/proton-bridge.crt and run sudo update-ca-certificates.

Skipping this step is the #1 cause of "SSL handshake failed" and "connection refused" errors.

Configure Thunderbird

Thunderbird has the smoothest Bridge integration because it lets you set every IMAP/SMTP parameter manually without fighting autoconfiguration.

Add the account:

Open Thunderbird → Edit → Account Settings → Account Actions → Add Mail Account
Enter your name, your full Proton email address, and the Bridge password (not your Proton password)
Click Configure Manually — do not let Thunderbird autodiscover

IMAP settings:

| Field | Value |

|---|---|

| Server | 127.0.0.1 |

| Port | 1143 |

| Connection security | SSL/TLS |

| Authentication | Normal password |

| Username | your@proton.me |

SMTP settings:

| Field | Value |

|---|---|

| Server | 127.0.0.1 |

| Port | 1025 |

| Connection security | SSL/TLS |

| Authentication | Normal password |

| Username | your@proton.me |

Click Done. Thunderbird will test the connection. If you get a certificate warning dialog, review the certificate and click Confirm Security Exception.

Your Proton inbox should begin populating within 30 seconds. Initial sync of a large inbox can take 10–30 minutes.

Thunderbird tip: Go to Account Settings → Synchronization & Storage and enable Keep messages for this account on this computer if you want offline access. Proton Bridge streams messages on demand by default.

Configure Apple Mail

Apple Mail's account wizard aggressively tries to autodiscover settings. You need to force it into manual mode.

Open Mail → Settings (⌘,) → Accounts → (+)
Select Other Mail Account → Continue
Enter your name, Proton email address, and Bridge password → Sign In
Mail will fail to autodiscover — this is expected. It will show manual fields.

Incoming Mail Server (IMAP):

Mail server: 127.0.0.1
Port: 1143
Use SSL: On
Username: your full Proton email address
Password: Bridge password

Outgoing Mail Server (SMTP):

SMTP server: 127.0.0.1
Port: 1025
Use SSL: On
Authentication: Password
Username: your full Proton email address
Password: Bridge password

Click Sign In. If macOS shows a certificate trust warning, click Connect — it will reference the certificate you already added to Keychain in the earlier step.

Known Apple Mail issue: Apple Mail sometimes overrides SMTP port 1025 back to 587 after saving. After setup, go to Settings → Accounts → [your account] → Server Settings and verify the SMTP port is still 1025. If it reverted, change it back and quit and relaunch Mail.

Configure Outlook

Outlook (Microsoft 365, standalone 2019/2021, or the new Outlook for Mac) has two code paths depending on which version you are using. The new Outlook for Mac (2023+) does not support manual IMAP configuration at all — use the classic Outlook or Thunderbird on Mac instead.

Outlook for Windows (classic):

File → Add Account → Advanced options → Let me set up my account manually → Connect
Choose IMAP

Incoming server:

| Field | Value |

|---|---|

| Server | 127.0.0.1 |

| Port | 1143 |

| Encryption | SSL/TLS |

Outgoing server:

| Field | Value |

|---|---|

| Server | 127.0.0.1 |

| Port | 1025 |

| Encryption | SSL/TLS |

When prompted for credentials, use your Proton email as the username and the Bridge password.

Outlook may display an "Unable to verify account" warning about the certificate. Click Yes to proceed — it is referencing the Bridge self-signed cert you already trusted at the system level.

Outlook on Mac (classic, pre-2023):

Tools → Accounts → (+) → New Account → Add a non-Microsoft account
Enter your email → IMAP/POP at the bottom
Fill in the same 127.0.0.1 / port 1143 / 1025 settings above
Click Add Account

Multi-Account and Split-Mode Setup

If your Proton account has aliases (e.g., you@proton.me and you@pm.me), Bridge handles them all under the same connection. Both addresses appear in the From selector in your client — no extra configuration needed.

If you are on Proton Business with multiple separate accounts, Bridge lists each one in its account panel with its own Bridge password. Add each as a separate account in your email client using the same steps above.

Split mode (Bridge → Settings → Split mode) creates separate IMAP/SMTP credentials per Proton account instead of a combined inbox. Use this if you want each account to live in a completely separate client profile.

Troubleshooting the Most Common Failures

"Authentication failed" on first connect

You used your Proton account password instead of the Bridge password. Go back to the Bridge window, copy the generated password, and update your email client credential.

Email client shows "Connection refused"

Bridge is not running. Check your system tray. On macOS, Bridge can be ejected accidentally — relaunch it from Applications. On Linux, check systemctl status protonmail-bridge or restart the AppImage.

Emails not sending — stuck in Outbox

SMTP port mismatch is the usual culprit. Verify port 1025, not 587 or 465. Also confirm SSL/TLS is selected (not STARTTLS).

Certificate errors persist after trusting the cert

On macOS, quit and relaunch both Mail (or Thunderbird) and Bridge after adding the cert to Keychain. The trust change is not picked up until both applications restart.

Slow initial sync

Normal. Bridge indexes and decrypts locally on first run. A 5 GB inbox can take 1–2 hours. Do not interrupt it — let Bridge finish before testing send/receive.

The Tradeoff Worth Knowing

Proton Bridge delivers genuine end-to-end encryption in a familiar client. But it is a local process, not a cloud relay. That means:

Email works only on devices where Bridge is installed and running
Mobile access still requires the Proton Mail app (Bridge is desktop-only)
If your machine is off or asleep, new mail queues on Proton's servers until Bridge comes back online

For most users, that is an acceptable trade for the convenience of Thunderbird or Outlook. For mobile-first users, the Proton Mail app is the simpler path.

Set It and Forget It

Once Bridge is configured and auto-start is enabled (Bridge → Settings → Start on login), you will never think about it again. Your client checks mail, Bridge handles the crypto, and you get end-to-end encryption with zero workflow change.

Want the full privacy stack? Proton Unlimited includes Bridge, Proton VPN, encrypted Drive, and the Proton Pass password manager in one plan.

Stay sharp on privacy tools. Join the PrivateAI letter — practical guides on encrypted workflows, no vendor fluff, unsubscribe any time.

Subscribe to PrivateAI →