Proton Drive provides zero‑knowledge encryption for files, folders

Proton Drive encrypts far more than the file body. File contents are split into blocks of up to 4 MB each, and each block is signed with a hash so it cannot be tampered with or reordered.

This article explores the topic comprehensively, examining encryption options, best practices, and considerations for additional file-level security. Proton Drive automatically encrypts files using end-to-end encryption.

Files containing sensitive information, such as medical records, passports, or bank statements, should always be encrypted to safeguard your privacy and security. With Proton Drive, every file you upload is automatically encrypted by default.

Users gain access to the payload by encrypting and decrypting the session key using asymmetric encryption. Files and folders are arranged in a tree structure. Therefore, there is a recurring pattern where a file or folder’s asymmetric key ...

To secure each file or folder (what we call the “payload”), Proton Drive first uses a symmetric key to encrypt the payload on your device. Unlike the PGP key pairs described earlier, with symmetric key cryptography, the same key can both ...

Proton Drive relies on a concept called zero-knowledge proof architecture. When you drop a file into your Proton Drive folder, the application encrypts the file locally on your computer or phone.

You do not have to take "zero-knowledge" on faith. For Proton Drive, three things support the claim: Open-source apps. Proton publishes the source for its client applications, so the encryption can be inspected rather than assumed.

Proton claims it doesn’t share that information with third parties, and given that the entire service is built around not being able to read your data in the first place, that claim tracks with how the rest of the product works. Proton Drive now bundles Proton Docs and, more recently, Proton Sheets, both end-to-end encrypted and built for real-time collaboration.

The encryption keys are derived from your password and never transmitted to Proton. That is what people mean by "zero-access" or "zero-knowledge" encryption — Proton literally cannot read your files, even under subpoena.