Migrate ProtonMail to Gmail: Bridge-Based IMAP Walkthrough

ProtonMail's encryption model is exactly what makes a migration off it harder than any other consumer provider. There is no plain IMAP endpoint at proton.me. The only way to copy your mail to Gmail is to install ProtonMail Bridge on your local machine, let it decrypt your mailbox in memory, and pipe the decrypted IMAP stream to a migration tool that can authenticate against both Bridge and Gmail. This walkthrough covers exactly that path — Bridge setup, Gmail app passwords, label mapping, throttling, and the verification you should do before you trust the result.

Before you start#

You need four things lined up before you touch a single message. Skipping any of them is how migrations stall halfway through at 2am.

• A paid ProtonMail plan. Bridge is gated behind Mail Plus, Proton Unlimited, Proton Business, or Visionary. Free Proton accounts have no IMAP path at all, full stop.
• A Gmail or Google Workspace destination with IMAP enabled and either an app password (if 2-Step Verification is on) or a workspace service account if you're moving multiple users.
• A machine you can leave running. Bridge has to stay open and unlocked for the duration of the migration. A laptop that sleeps will pause your job and possibly drop the IMAP socket mid-folder.
• Disk headroom equal to roughly 1.2x the size of your ProtonMail mailbox. Bridge caches decrypted message bodies on disk while serving IMAP, and Mailbox Taxi keeps a small local index for resumability.

How ProtonMail Bridge changes the picture#

Bridge is a small daemon that runs on your desktop. When it starts, it authenticates against the Proton API, pulls your encrypted messages, decrypts them locally using your account keys, and re-exposes them as a standard IMAP server bound to 127.0.0.1. Everything stays on your machine: the plaintext never leaves the loopback interface until your migration tool reads it and pushes it over TLS to Gmail.

That architecture has three practical consequences for this migration:

First, throughput is bounded by Bridge, not by Gmail. Bridge pulls messages over the Proton API on its own schedule and caches them locally. You'll often see Mailbox Taxi sitting idle waiting for Bridge to surface the next batch, especially on the first pass through a large folder.

Second, the IMAP credentials Bridge gives you are not your ProtonMail password. Bridge generates a random per-application password the first time you connect. You'll see something like imapclient@proton.me and a 16-character bridge-generated password in the Bridge UI. That's what goes into Mailbox Taxi.

Third, Bridge runs on localhost on a non-standard port. The IMAP endpoint is 127.0.0.1:1143 by default, with STARTTLS, not implicit TLS. If you set this to port 993 with SSL/TLS instead of STARTTLS, the connection will fail with STARTTLS handshake failed or simply hang at the banner.

Step-by-step migration#

1. Install ProtonMail Bridge and sign in

   Download Bridge from proton.me/mail/bridge on the same machine you'll run Mailbox Taxi on. Install it, launch it, and sign in with your Proton account credentials plus your two-factor code if you have 2FA on. Bridge will spend a few minutes doing an initial sync — wait for the status indicator to show "Connected" before you go further. If you have a large mailbox, the initial sync can take 30–60 minutes. Don't quit Bridge during this phase.

2. Copy the Bridge IMAP credentials

   In Bridge, click your account name and look for the Mailbox configuration panel. You'll see four fields you need: the username (usually your-address@proton.me), the bridge-generated password (a random 16-character string), the host (127.0.0.1), and the IMAP port (1143). Note that the SMTP credentials shown in the same panel are for a different purpose — you only need the IMAP ones for migration. Keep this window open or copy the values into a password manager.

3. Prepare the Gmail destination

   On the Gmail side, sign in and open Settings → See all settings → Forwarding and POP/IMAP, then enable IMAP access. If the destination account has 2-Step Verification enabled (it should), generate an app password at myaccount.google.com/apppasswords. Pick "Mail" as the app and "Other" as the device, name it something obvious like "Mailbox Taxi import", and copy the 16-character password Google generates. That's what Mailbox Taxi will use as the destination password, not your Google account password.

   For Google Workspace destinations migrating multiple ProtonMail users at once, an admin can instead set up domain-wide delegation with a service account — but for single-user migrations, app passwords are simpler and equally reliable.

4. Add both endpoints to Mailbox Taxi

   In Mailbox Taxi, create a new migration job. For the source, pick ProtonMail. Mailbox Taxi will pre-fill 127.0.0.1 and port 1143 with STARTTLS — confirm those, then paste in your Bridge username and the bridge-generated password. Click Test connection. You should see "Connected" within a couple of seconds; if you get AUTHENTICATIONFAILED, you copied the Proton account password instead of the Bridge-generated one.

   For the destination, pick Gmail. The host is imap.gmail.com, port 993, SSL/TLS. Username is the full Gmail address. Password is the app password from the previous step. Test that connection too.

5. Map ProtonMail labels to Gmail labels

   Mailbox Taxi will scan both sides and propose a folder map. ProtonMail's standard folders (Inbox, Sent, Drafts, Archive, Spam, Trash) map cleanly to Gmail's system labels. Custom labels from ProtonMail come across as Gmail labels with the same name.

   A few mappings deserve attention. ProtonMail's All Mail is virtual — don't map it to Gmail's All Mail or you'll create duplicates. Spam and Trash are usually worth excluding unless you have a compliance reason to keep them. Any label name with a slash (/) in it will be interpreted by Gmail as a nested label, which may or may not be what you want.

6. Run a dry-run on a single folder

   Pick one small label — Drafts is good, or a project folder with 50–200 messages — and migrate just that one. Watch the progress, then open Gmail and confirm the messages arrived, the dates are preserved, attachments open, and any HTML or inline images render. This is the moment to catch character-encoding issues, missing attachments, or an authentication problem before you commit to a multi-hour run.

7. Run the full migration

   Once the dry-run looks right, kick off the full job. Mailbox Taxi will work through your folders in parallel up to its connection limit (Gmail tolerates 4–6 concurrent IMAP connections per account; Bridge is happiest at 2–3). Expect 90–180 minutes per gigabyte through Bridge, with most of the time spent decrypting and surfacing messages, not uploading them. Leave the machine awake — sleep will pause the job.

8. Verify and switch over

   When the job completes, compare folder counts side by side. Spot-check at least 20 random messages: open the original in ProtonMail and the copy in Gmail and confirm subject, date, sender, attachments, and inline images all match. Once you're satisfied, update your MX records (if you're moving the whole domain) or set up forwarding from ProtonMail to Gmail (if you're keeping ProtonMail around for incoming mail during a transition).

Gotchas specific to ProtonMail → Gmail#

A few quirks bite people on this specific pair more than others.

Custom from-addresses don't survive#

If you used ProtonMail's "Send as" feature with verified custom domains, those settings don't come across. The messages will still have the correct From header in the migrated copy, but you need to re-add and re-verify the send-as addresses in Gmail Settings → Accounts → Send mail as.

ProtonMail's Encrypted to External will look weird#

Messages you sent to non-Proton recipients via Encrypted to External show up in your ProtonMail Sent folder as the encrypted envelope, not the plaintext. They'll migrate to Gmail in that same encrypted-envelope form. There's no way to retrieve the plaintext — only the recipient ever had it.

Subfolder depth limits#

ProtonMail allows arbitrary label nesting. Gmail labels can nest, but very deep hierarchies (5+ levels) sometimes render awkwardly in the Gmail web UI. If you have deeply nested labels, consider flattening them in ProtonMail before you migrate.

Real errors you'll see and what they mean#

Bridge and Gmail both surface errors in standard IMAP language. Here are the ones that come up most.

• AUTHENTICATIONFAILED on the source side — almost always means you used your Proton account password instead of the Bridge-generated one. Re-copy from Bridge.
• AUTHENTICATIONFAILED on the Gmail side — you used your Google account password instead of an app password, or 2-Step Verification isn't enabled (you can't generate app passwords without it).
• STARTTLS handshake failed against Bridge — you probably set the source to SSL/TLS on port 993. Switch to STARTTLS on 1143.
• Too many simultaneous connections from Gmail — you have other IMAP clients (a phone, a desktop client) hitting the same Gmail account. Disconnect them for the duration of the migration.
• Folder UTF-7 conversion error — usually a ProtonMail label with an emoji or non-ASCII character. Rename it in ProtonMail to plain ASCII before migrating.
• Bridge restarting mid-job — Bridge does occasionally crash on very large mailboxes. Mailbox Taxi will pause and retry; if it gives up, restart Bridge and resume the job. Mailbox Taxi's resumable design means you won't re-upload messages it already finished.

If you hit a Bridge-specific connection problem, the fix ProtonMail Bridge connection guide walks through the most common Bridge failures. And if any of the IMAP terminology in this post is unfamiliar, the IMAP protocol glossary explains UID, APPEND, EXAMINE, and the other primitives Mailbox Taxi uses under the hood.

Communicating the change#

A ProtonMail → Gmail move is often a values shift, not just a technical one — people picked ProtonMail for privacy reasons and you're moving them off it. Address that head-on in whatever communication you send.

Tell users when the cutover window is, when they should stop sending mail from ProtonMail, when they can start in Gmail, and what happens to ProtonMail incoming mail after the cutover (forwarding, kept alive, or hard cutoff). Give them a single contact for questions during the window. If you're an MSP doing this for a client, write the comms in the client's voice, not yours.

If you're going the other direction later — migrating new mail back into ProtonMail for archive — the migrate Gmail to ProtonMail post covers that flow.

Post-migration checklist#

After the job completes and before you decommission ProtonMail:

• Confirm folder counts match on both sides for every label you care about.
• Open at least one message from each label in Gmail and confirm it renders.
• Re-create any ProtonMail filters as Gmail filters — they don't migrate.
• Re-add send-as addresses in Gmail for any custom domains.
• Export contacts and calendars from ProtonMail as vCard/ICS and import them into Google.
• Set up a forwarder from ProtonMail to Gmail for any incoming mail during the transition.
• Keep ProtonMail active for 30–60 days as a fallback before you cancel the subscription.