ProtonMail provides security features that enable you to view login activity on your account. If you are concerned that someone has access to your account, you can follow the activity in your Authentication Logs. By default, the Authentication Logs are set to Basic. If you choose to change the settings for the Authentication Logs, you can do the following steps:
1. Navigate to Settings.
2. Go to the Security tab.
3. There are three options on the Authentication Logs page: Disable, Basic, and Advanced. If a change is made, you will be prompted to enter your login password to confirm the changes.
3.1. The Basic logs provide information about the event that has happened on your account, as well as the date and time of the event. The events can be “Login success”, for successfully logging in to your account, “Log out” for logging out of the account, and “Login failed” when a wrong password has been used.
3.2. The Advanced logs provide the same information as the Basic logs, with the addition of the IP address of where the event took place.
If you have Basic logs enabled, after enabling the Advanced logs you will see only two dashes instead of an IP address. This is because the IP addresses are not logged until you activate the Advanced logs.
When Authentication Logs are enabled on your account, you have the option to download the logs or to delete them.
To download the logs you can click the “Download” button, which will download a copy of the logs with the file name “logs.csv”. If you want to delete the logs you can click the “Wipe” button. To wipe the logs you will need to enter your login password in the popup window to confirm the changes.
If you want to disable the Authentication Logs, you can click on the “Disable” button. When you do, a popup window will appear, asking for your confirmation. Once you click the confirm button you will be prompted for the login password. Disabling the Authentication Logs also wipes the logs.