7

When I send a message on protonmail, does my IP address show up in the header or any other place? Will I need a VPN to be completely anonymous?

Anders
  • 64,406
  • 24
  • 178
  • 215
nichole
  • 81
  • 1
  • 1
  • 2

3 Answers3

4

No. No user IP information is included in the message, ever. Source: I work for ProtonMail and am deeply familiar with this code.

Bart Butler
  • 51
  • 2
  • Simply answering "No. I've seen the code" is of little usefulness. Can you provide anything to help support your answer? Traces, examples? – schroeder Dec 24 '17 at 08:48
  • 1
    1. Send a message from a ProtonMail account to an external account that you control 2. Check the headers for any client-identifying information. You will not find any such information. – Bart Butler Dec 28 '17 at 01:30
  • @BartButler Is this "still" the case for ProtonMail? To other safety mechanisms such as VPN or TOR, just a basic ProtonMail email sent from a web browser will not reveal IP address and thus you cannot even tell which country it is being sent from, correct? – Mary Jane May 08 '19 at 12:31
  • Yes, it's still true. There's no reason to provide this information and every reason not to. – Bart Butler May 10 '19 at 23:08
  • Bart, Thanks. You might want to comment here and/or urge Rob Braxman Tech to correct their information: https://www.youtube.com/watch?v=IWMZ17Iyu3o. ALSO: IMO, protonmail should enforce TLS but IT DOES NOT, per https://ssl-tools.net/mailservers/protonmail.com - which also notes some less serious problems with Protonmail. – WHO's NoToOldRx4CovidIsMurder Jul 28 '21 at 18:00
  • That evaluation looks faulty. Try this one: https://www.hardenize.com/report/protonmail.com. Also we can't require TLS for email delivery, too many mail servers still don't support it. But we always use it if available or required via DANE or MTA-STS. – Bart Butler Jul 29 '21 at 22:26
2

Just run it through TOR and you will not have to worry about IP leakage. Almost all email message servers will leak whatever IP you provide them. To get security and anonymity, you need both encryption and some sort of anonymizing service that you can trust. I certainly would err on the side of caution and perhaps use a VPN and a bridge with TOR if you are this concerned about IP leakage.

DeepS1X
  • 321
  • 1
  • 5
1

The simple answer is NO. The easiest way to test is send an email from Protonmail to a Gmail account. Then go into Gmail, open the message, click the 3-dot menu in the message and choose "show original". There you can see all of the meta/header/etc. The only IP address you will see is the IP of the Protonmail mail server in Switzerland. You can Ctrl+F to search for your IP... you will not find it. Protonmail would have to deliberately add code to attach your IP to the header. I don't believe that would work with their business model.

Max762
  • 11
  • 1