Attachments are automatically encrypted and decrypted within your ProtonMail inbox, just as your messages are. You don’t need to do anything further to ensure they are encrypted.
Attachments (including those sent to or received from non-Protonmail email accounts) are stored encrypted on our servers and cannot be decrypted by anyone except you, by using the correct mailbox password.
Attachments sent to a ProtonMail account from a non-ProtonMail account may still exist unencrypted within the sender’s Sent folder, however. The safest way to protect your attachments is to make sure the person you are communicating with also has a ProtonMail account. (You can sign up for one here; it’s free.)
Download encrypted attachments
When you receive a message with an attachment, the name of the attachment appears at the bottom of the email. You can decrypt stored attachments immediately within your browser by clicking the download icon, which will save the attachment to your device.
To download all attachments at once, click Download all. This will download all the attachments in a .zip file, which you can extract on your device to access the unencrypted files.
This will bring up the encrypted attachment as an in-browser preview, rather than download the file to your device.
You can use the arrow buttons at the top of the preview to scroll through all the files in that email, or click the download icon to download the image you are currently viewing. Click the cross in the top-right corner to close the preview pane.
Encrypt attachments for non-ProtonMail users
The Encrypt for Outside Users feature also supports end-to-end encryption of attachments. Attachments sent within an end-to-end encrypted message are saved in the password protected link of the encrypted message.