Migrate Gmail to ProtonMail: Bridge and IMAP Guide

ProtonMail's privacy posture is its appeal: messages encrypted at rest with keys only the user holds, Swiss jurisdiction, and a transparent threat model. The same architecture that delivers the privacy also makes IMAP-based migration into ProtonMail unusual. You can't just point a tool at imap.proton.me and authenticate — ProtonMail doesn't expose direct IMAP to the internet because its servers don't hold your decryption keys. The standard path uses ProtonMail Bridge, a local daemon that holds your keys and exposes an IMAP interface on 127.0.0.1. This guide walks both Bridge-based IMAP transfer and ProtonMail's built-in Easy Switch importer, with the trade-offs between them.

Why ProtonMail is different as a destination#

Most providers store mail in a form they can decrypt server-side. Gmail, Outlook.com, iCloud, Fastmail — all hold the bytes in a state where the provider could (technically) read them, encrypt-at-rest notwithstanding. That property makes IMAP straightforward: client connects with TLS, provider decrypts the stored bytes server-side, returns plaintext over the encrypted channel.

ProtonMail doesn't hold the keys to your stored mail. The keys live in your account password, which never reaches Proton's servers in a usable form. The web client decrypts in your browser; the mobile clients decrypt on-device; everything sees plaintext only after the local decryption step.

This means a normal IMAP migration can't append messages directly to ProtonMail's servers — the bytes need to be encrypted with your keys before they're stored, and only software that holds those keys can do that encryption.

Proton's answer is two-layered:

1. ProtonMail Bridge — a local daemon you install on your computer. It signs in to your Proton account, decrypts and re-encrypts as needed, and exposes a local IMAP server on 127.0.0.1. Any standard IMAP client (Thunderbird, Mailbox Taxi, Mac Mail, Outlook desktop) can connect to Bridge, and Bridge handles the encryption with Proton's servers behind the scenes.
2. Easy Switch — Proton's web-based import tool that authenticates with your source provider via OAuth, runs entirely in Proton's infrastructure, and handles common providers (Gmail, Yahoo, Outlook.com, IMAP) without requiring Bridge.

Each has a place. Bridge gives you full IMAP control and works with any tool. Easy Switch is simpler for small mailboxes but has less visibility and fewer mapping controls.

Pick your path#

Use Easy Switch when:

• Mailbox is under 3GB
• You don't have heavy label structure
• You're on a free Proton plan (which doesn't include Bridge)
• You're okay with limited visibility into per-message failures

Use Bridge + IMAP when:

• Mailbox is over 3GB
• You have complex labels and want explicit mapping
• You want per-folder progress and resumability
• You have a paid Proton plan that includes Bridge

This guide covers both, with most depth on the Bridge route.

Pre-flight checklist#

For either path:

• Active Gmail account with IMAP on and 2-Step Verification enabled
• Google app password generated
• Active ProtonMail account
• For Bridge: paid Proton plan (Plus, Unlimited, Family, or Business)
• For Easy Switch: any plan works
• Estimate of Gmail mailbox size from mail.google.com (bottom of inbox view)
• ProtonMail quota with headroom (Plus is 15GB; Unlimited is 500GB; Family and Business have per-user quotas)

Path A: Easy Switch (simpler, less control)#

1. Sign in to mail.proton.me
2. Click your profile picture, then Settings
3. Open Easy Switch
4. Click Import from Google
5. Authenticate with Gmail OAuth
6. Choose what to import: mail, contacts, calendar
7. For mail, decide whether to include the Gmail All Mail label or just specific labels
8. Start the import

Easy Switch runs in Proton's infrastructure. You don't need to leave your computer on or maintain a connection. It does have caps — historically, mailboxes over a few GB have hit timeouts or stalls. If Easy Switch fails or stalls, switch to the Bridge path.

Path B: Bridge + IMAP (more control, paid plan required)#

Step 1: Install ProtonMail Bridge#

1. From your Proton account dashboard, download Bridge for your OS
2. Install it (the installer is signed; allow it through Gatekeeper / SmartScreen)
3. Launch Bridge and sign in with your Proton credentials
4. Complete 2FA if enabled
5. Bridge generates a per-account IMAP password (different from your Proton password)
6. Note the displayed IMAP credentials: 127.0.0.1:1143 (or similar), username, and the Bridge-generated password

The Bridge will keep running in your system tray. While it's running, any IMAP client can connect to its local endpoint and treat it like a normal mail server.

Step 2: Generate Gmail app password#

1. Open myaccount.google.com, Security
2. Enable 2-Step Verification if not already on
3. App passwords (visible after 2SV)
4. Generate a new app password named Mailbox Taxi
5. Copy the 16-character password

Background on app-specific passwords across providers lives in our app-specific password reference.

Step 3: Configure source and destination#

Source (Gmail):

• Server: imap.gmail.com
• Port: 993, SSL on
• Username: full Gmail address
• Password: Google app password

Destination (ProtonMail Bridge):

• Server: 127.0.0.1
• Port: 1143 (or whatever Bridge displays — port may vary by Bridge version)
• SSL: STARTTLS (Bridge usually requires STARTTLS rather than direct TLS, but check the Bridge UI for current behaviour)
• Username: your Proton email address
• Password: the Bridge-generated IMAP password (NOT your Proton account password)

Step 4: Folder mapping#

Gmail's label structure exposed via IMAP:

• INBOX
• [Gmail]/Sent Mail
• [Gmail]/Drafts
• [Gmail]/Trash
• [Gmail]/Spam
• [Gmail]/All Mail (canonical store)
• [Gmail]/Starred
• [Gmail]/Important
• All your custom labels

ProtonMail's IMAP via Bridge exposes:

• INBOX
• Sent
• Drafts
• Trash
• Spam
• Archive
• Folders and labels you've created in Proton

Map explicitly:

• Gmail INBOX → Proton INBOX
• Gmail [Gmail]/Sent Mail → Proton Sent
• Gmail [Gmail]/Drafts → Proton Drafts
• Gmail [Gmail]/Trash → Proton Trash
• Gmail [Gmail]/Spam → Proton Spam
• Custom Gmail labels → Proton folders with matching names

If you've decided not to bring every label into Proton (Strategy B from our Gmail to Fastmail guide applies here too), deselect everything except [Gmail]/All Mail and map it to Archive.

Step 5: Pilot#

Pick [Gmail]/Sent Mail or a stable user label of 200 to 500 messages. Run that first.

Verify:

• Final count matches between Gmail and Proton (check via Proton web UI)
• Sort order in Proton matches Gmail (confirms INTERNALDATE preserved through Bridge)
• Read/unread flags carry over
• Three random messages open with attachments via Proton web
• Bridge log shows no STARTTLS handshake failed or OAuth2 token expired

Step 6: Run the full transfer#

Concurrency for this pair:

• Gmail source: 2 connections
• ProtonMail Bridge destination: 1 connection

That's right — 1 connection on the destination. Bridge is doing encryption on your local machine for every message, which is CPU-intensive. Multiple parallel IMAP connections to Bridge cause CPU contention and don't actually go faster. Single-threaded is the sweet spot.

Throughput: 400MB to 1GB per hour. Slower than other Gmail destinations because of Bridge's encryption overhead.

• 5GB Gmail: 5 to 12 hours
• 15GB Gmail: 15 to 30 hours, multi-session
• 50GB Gmail: plan across 3 to 5 days, or use Strategy B (All Mail only) to reduce duplicate work

Keep your machine plugged in and awake throughout. If Bridge crashes or your laptop sleeps, the IMAP connection drops and the run pauses. Mailbox Taxi resumes from the last checkpoint, but the interruption adds 5 to 10 minutes of overhead each time.

Step 7: Verify#

When complete:

1. Folder counts side by side, checked via Proton web UI
2. Spot-check by date — open messages from 2018, 2021, 2024 and confirm content
3. Test sending and receiving on Proton (via web, not just Bridge)
4. Confirm threading looks right in Proton's conversation view

If counts are off by more than a few per folder, run a delta sync.

Cut over#

If you're keeping the @gmail.com address but reading mail on Proton:

1. In Gmail, Settings, Forwarding and POP/IMAP
2. Add Proton as a forwarding address
3. Verify (Gmail emails a confirmation code)
4. Forward all incoming mail to Proton

Keep a copy in Gmail for the first 30 days as a safety net.

If you're moving a custom domain to Proton:

1. Add the domain in Proton Mail settings, Domain Names
2. Verify ownership via TXT record
3. Update MX records to Proton's servers
4. Set up SPF, DKIM, DMARC per Proton's instructions
5. Migrate any sub-addresses (catch-all, aliases) as separate configuration in Proton

Common failures#

AUTHENTICATIONFAILED on Gmail: 2SV is on and app password wasn't used. Generate a Google app password.

AUTHENTICATIONFAILED on Bridge: used the Proton account password instead of the Bridge-generated IMAP password. Open Bridge UI, copy the displayed password, use that.

Connection refused on 127.0.0.1:1143: Bridge isn't running, or it's running on a different port. Check Bridge's status icon and confirm port in its settings.

STARTTLS handshake failed to Bridge: Bridge's IMAP listener is sometimes finicky during the first few connections. Wait 30 seconds, retry. If persistent, restart Bridge.

OAuth2 token expired on Gmail: Gmail's misleading throttle error. Drop source concurrency to 1, wait 5 minutes.

Bridge CPU pegged at 100 percent: normal during encryption-heavy phases. If it stalls for more than 10 minutes, pause and resume — the bottleneck is your CPU, not Proton's servers.

Bridge logging out repeatedly: check for OS sleep/wake events; Bridge sometimes doesn't reconnect cleanly after the OS suspends. Disable sleep during migration.

After the migration#

• Update senders with your new address
• Auto-reply on Gmail for 30 to 60 days
• Keep Gmail forwarding active for 90 days
• Revoke the Google app password from myaccount.google.com
• Revoke the Bridge IMAP credentials if you're done with desktop access
• Export Gmail contacts before final shutdown
• Don't shut down Gmail for at least 6 months — recovery contacts, infrequent senders

If Proton isn't where the user wants to land, our Gmail to Fastmail guide covers an alternative privacy-focused destination. To go the other direction, see ProtonMail to Gmail. For broader operational sequencing, the complete email migration guide walks DNS, SPF, DKIM, and DMARC across any provider pair.