Migrate ProtonMail to Outlook: Bridge + outlook.com IMAP

People mix this one up with the Office 365 migration constantly, so let's be specific. This guide moves a ProtonMail mailbox to a consumer outlook.com, hotmail.com, or live.com mailbox — the kind you sign up for free at outlook.com, optionally with a Microsoft 365 Personal or Family subscription attached for extra storage. It is not for Microsoft 365 Business tenants. The mechanics are similar but the endpoints, quotas, and admin model are different. If you're moving to a business tenant, stop here and use the Office 365 walkthrough instead.

Why this migration looks the way it does#

Consumer Outlook (outlook.com) accepts standard IMAP connections on outlook.office365.com:993 — yes, the same host as the business tenant, but with consumer credentials. You don't get the admin tooling, you don't get tenant-wide IMAP policies, and you don't get migration endpoints in the M365 admin center. What you do get is a 15 GB free quota (50 GB with Microsoft 365 Personal or Family), a reasonable IMAP implementation, and app-password support.

On the ProtonMail side, the story is the same as every ProtonMail migration: there is no public IMAP. ProtonMail's API isn't IMAP, so you have to run ProtonMail Bridge on the workstation that's executing the migration. Bridge decrypts the mailbox locally and exposes IMAP on 127.0.0.1:1143. Anything that wants to read your ProtonMail mail in IMAP form has to be running on that same machine.

That means this migration runs entirely on your local workstation. Bridge on one side, Mailbox Taxi in the middle, outlook.com over TLS on the other side. No cloud-to-cloud option exists.

Before you start#

Five prerequisites:

• A paid ProtonMail plan that includes Bridge access.
• ProtonMail Bridge installed and signed in on the workstation you'll run the migration from.
• An outlook.com mailbox provisioned and accessible.
• An app password generated for that outlook.com account.
• Storage headroom on the outlook.com side. If your ProtonMail mailbox is bigger than 15 GB and the destination is on the free tier, you'll hit the quota part way through.

If you can't pin down the destination size, do a rough audit first. ProtonMail's web UI shows used storage in the bottom-left corner — note that, then check the outlook.com side at account.microsoft.com → Storage.

Step-by-step migration#

1. Install ProtonMail Bridge and complete the initial sync

   Download Bridge from proton.me/mail/bridge. Install it on the workstation you'll run Mailbox Taxi on — they have to be the same machine. Sign in with your Proton credentials and 2FA code if you have it on. Bridge will do an initial sync that, on large mailboxes, can take 30–90 minutes. The Bridge UI shows progress; wait for "Connected" or "Up to date" before continuing.

2. Copy the Bridge IMAP credentials

   Open Bridge, click your account name, and look for the Mailbox configuration view. You need four values:

   • Username — usually your-address@proton.me.
   • Password — the Bridge-generated random 16-character string. This is not your Proton account password.
   • Host — 127.0.0.1.
   • Port — 1143 (IMAP with STARTTLS).

   Copy them into a password manager or keep the Bridge window open while you configure Mailbox Taxi.

3. Enable IMAP and generate an app password on outlook.com

   Sign in to outlook.com with the destination account. Click the settings gear → View all Outlook settings → Mail → Sync email and confirm POP and IMAP options are visible (consumer Outlook enables IMAP by default, but worth checking).

   Then go to account.microsoft.com, sign in as the same user, and open Security → Advanced security options. If you don't have 2-step verification turned on, turn it on now — without it, you can't generate app passwords. Scroll to App passwords, create a new one, and copy the 16-character password Microsoft generates. Name it "Mailbox Taxi import" or similar.

   For more on app passwords and where they apply, the app password glossary entry covers the auth model in detail.

4. Configure the migration in Mailbox Taxi

   In Mailbox Taxi, create a new job. Source: ProtonMail. Host 127.0.0.1, port 1143, STARTTLS. Username and password from Bridge. Test the connection. If you see AUTHENTICATIONFAILED, the most common cause is using your Proton account password instead of the Bridge-generated one — go back to Bridge and recopy.

   Destination: Outlook. Host outlook.office365.com, port 993, SSL/TLS. Username is the full outlook.com address. Password is the app password from the previous step. Test that too.

5. Map ProtonMail labels to Outlook folders

   Mailbox Taxi scans both sides and proposes a folder map. ProtonMail's Inbox, Sent, Drafts, Archive, Spam, and Trash map to their Outlook counterparts. Custom ProtonMail labels become custom Outlook folders.

   Outlook follows the single-folder model — a message exists in exactly one folder. ProtonMail allows multi-label messages. When a message has multiple labels, Mailbox Taxi puts it in the first label's folder. If you want the rest preserved, use the "duplicate per label" option, but it bloats the destination.

   Exclude Spam and Trash unless you have a compliance reason to keep them — they're rarely worth the bytes and Outlook's spam filtering will re-quarantine most of the spam anyway.

6. Run a small dry-run first

   Pick one small folder — Drafts is good, or a small project label with 50–200 messages — and migrate only that. Open outlook.com, find the messages, and verify subjects, dates, senders, attachments, and HTML rendering all look right. If anything's off, fix it before the full run.

7. Run the full migration and verify

   Kick off the full job. Mailbox Taxi will run 2–4 connections in parallel — outlook.com's tolerance is similar to the business endpoint, around 4 concurrent IMAP connections. Expect 90–150 minutes per gigabyte. Bridge is the bottleneck as always.

   Leave the machine awake and keep Bridge running. If you see Too many simultaneous connections, Mailbox Taxi will back off automatically. Persistent throttling means you should lower concurrency.

   When the job finishes, compare folder counts on both sides and spot-check 20–30 random messages.

Gotchas specific to ProtonMail → outlook.com#

A few quirks that hit this exact pair.

outlook.com renames "Sent" and "Drafts" sometimes#

Depending on how the destination account was created, you may see folders called "Sent Items" and "Drafts" (UK English) or "Sent" and "Drafts" (US English). Mailbox Taxi handles the rename automatically, but if you're manually configuring the folder map, double-check the names on the destination side first.

Free-tier quota fills fast#

15 GB sounds like a lot until you migrate 10 years of ProtonMail into it. Watch the destination storage indicator during the migration. If you cross 80%, pause the job and either upgrade the destination plan or exclude older folders.

Microsoft's spam classifier is more aggressive than ProtonMail's#

Migrated messages occasionally get re-classified as spam by Outlook on first delivery. They land in the destination's Junk folder rather than Inbox even if they came from your ProtonMail Inbox. If users see this, they'll need to mark a few as "not junk" and the classifier will adjust.

Two-factor codes from old logins look like phishing#

This isn't a migration issue per se, but it surprises users: when you migrate a decade of email, you bring along hundreds of old 2FA code emails. Outlook's anti-phishing will flag many of them. It's harmless — the codes are long-expired — but tell users to expect the warnings.

Real errors you'll see and what they mean#

• AUTHENTICATIONFAILED on source — using the Proton account password instead of Bridge's. Copy the right one.
• AUTHENTICATIONFAILED on destination — using the Microsoft account password instead of the app password, or 2-step verification isn't enabled yet (so app passwords aren't generatable).
• STARTTLS handshake failed against Bridge — source configured for SSL/TLS on port 993 instead of STARTTLS on 1143.
• Too many simultaneous connections from outlook.com — back off concurrency.
• Folder UTF-7 conversion error — a ProtonMail label has emoji or non-ASCII characters. Rename it in ProtonMail before migrating.
• OAuth2 token expired — you somehow ended up in an OAuth flow on the destination; that's not the right path for outlook.com IMAP. Use app passwords instead.

If Bridge keeps dropping the connection, the fix ProtonMail Bridge connection guide covers the most common Bridge-side failures.

Communicating the change#

Consumer Outlook migrations are usually personal — one user moving their own mail — so the comms are simpler than a business move. But a few things to tell yourself or whoever you're doing this for:

• The cutover window: when ProtonMail stops being primary and outlook.com takes over.
• The forwarding plan: are you forwarding ProtonMail to outlook.com indefinitely, for a transition period, or not at all?
• Mobile setup: outlook.com on the iOS/Android Outlook app uses OAuth, not the app password you just generated. The app password is only for IMAP clients.
• What to do if a friend or family member sends mail to the old ProtonMail address.

Post-migration checklist#

After the job completes:

• Folder counts match for every label you care about.
• Spot-check messages render in the outlook.com web UI.
• Configure ProtonMail to forward to outlook.com for the transition window.
• Update mobile app accounts and signatures.
• Export ProtonMail contacts as vCard and import them to outlook.com.
• Export ProtonMail Calendar as ICS and import it to outlook.com calendar.
• Keep the ProtonMail subscription active for 30–60 days as a fallback.