Proton's official Export Tool dumps every message on the account into one flat directory of .eml and .json files, with no way to pick a single folder. Proton Mail Bridge exposes the mailbox over local IMAP instead, so any IMAP sync tool can pull just the folder you want. This guide uses mbsync (from the isync package) to make a one-way, incremental backup of one folder into a local Maildir.

Requirement: Proton Mail Bridge needs a paid Proton plan. For a full Bridge setup (headless service, systemd unit, Mutt/NeoMutt), see Proton Mail Bridge with Mutt and NeoMutt.

How it works¶

Proton servers ──► Proton Mail Bridge (127.0.0.1:1143, IMAP/STARTTLS) ──► mbsync ──► ~/Mail/proton/<Folder>/

Bridge decrypts mail locally and serves it as standard IMAP. Proton folders appear as Folders/<name> and labels as Labels/<name>. mbsync is configured to pull only, so it never changes or deletes anything on the Proton side.

1. Install Bridge and mbsync¶

Download the Bridge package for your distro from proton.me/mail/bridge, then install it alongside isync:

# Fedora / RHEL
sudo dnf install ./protonmail-bridge-*.rpm isync

# Debian / Ubuntu
sudo apt install ./protonmail-bridge_*.deb isync

2. Log in to Bridge¶

On a desktop, sign in through the Bridge app. On a headless machine, log in once through the CLI as the dedicated protonbridge user (see Headless install in Proton Mail Bridge with Mutt and NeoMutt for creating that user and its keychain):

sudo -u protonbridge -H protonmail-bridge --cli

>>> login        # Proton username, password, 2FA
>>> info         # IMAP host/port, username, and the Bridge password

Note the values from info. They are typically:

Bridge must be running whenever you sync. On a headless machine, run it as the proton-bridge systemd service described in the Bridge guide:

sudo systemctl enable --now proton-bridge
systemctl status proton-bridge

3. Store the Bridge password in pass¶

pass insert email/proton-bridge

mbsync will read it with PassCmd, so the password never sits in a config file.

4. Save Bridge's TLS certificate¶

Bridge uses a self-signed certificate. Save it so mbsync can verify the connection:

mkdir -p ~/.config/protonmail
openssl s_client -starttls imap -connect 127.0.0.1:1143 -showcerts </dev/null 2>/dev/null \
  | openssl x509 > ~/.config/protonmail/bridge-cert.pem

5. Find the exact folder name¶

List every mailbox Bridge exposes:

curl -k --ssl-reqd imap://127.0.0.1:1143/ \
  --user "[email protected]:$(pass show email/proton-bridge | head -n1)"

Look for your folder in the output, for example Folders/Receipts. The examples below use Receipts; substitute your own folder name.

6. Configure mbsync¶

Create ~/.mbsyncrc:

IMAPAccount proton
Host 127.0.0.1
Port 1143
User [email protected]
PassCmd "pass show email/proton-bridge | head -n1"
TLSType STARTTLS
CertificateFile ~/.config/protonmail/bridge-cert.pem

IMAPStore proton-remote
Account proton

MaildirStore proton-local
Path ~/Mail/proton/
Inbox ~/Mail/proton/INBOX
SubFolders Verbatim

Channel proton-onefolder
Far :proton-remote:"Folders/Receipts"
Near :proton-local:Receipts
Sync Pull
Create Near
Expunge None
SyncState *

What the channel options do:

• Sync Pull copies from Proton to local only; nothing is pushed back.
• Create Near creates the local Maildir if it doesn't exist.
• Expunge None never deletes messages on either side.
• SyncState * keeps sync state inside the Maildir so later runs are incremental.

On isync versions older than 1.5, use SSLType STARTTLS instead of TLSType STARTTLS.

7. Run the backup¶

mkdir -p ~/Mail/proton
mbsync -V proton-onefolder

Messages land as individual files under ~/Mail/proton/Receipts/{cur,new}. Later runs only fetch new mail.

8. Verify the backup¶

Compare message counts¶

Count messages on the Proton side:

curl -k --ssl-reqd imap://127.0.0.1:1143/ \
  --user "[email protected]:$(pass show email/proton-bridge | head -n1)" \
  -X 'STATUS "Folders/Receipts" (MESSAGES)'

Expected output looks like * STATUS "Folders/Receipts" (MESSAGES 412).

Count the local files:

find ~/Mail/proton/Receipts/{cur,new} -type f | wc -l

The two numbers should match.

Spot-check the contents¶

grep -h '^Subject:' ~/Mail/proton/Receipts/{cur,new}/* | head

Or browse the folder in a mail client:

neomutt -f ~/Mail/proton/Receipts

Subjects and bodies should be readable plain text, not PGP-encrypted blobs.

Confirm incremental sync¶

Run the channel again:

mbsync -V proton-onefolder

The summary should end with Near: +0, meaning nothing new was pulled. Move a test email into the folder in Proton and run it once more. You should see Near: +1, and the local file count should go up by one.

Confirm Proton was not changed¶

Re-run the STATUS command. The count should be unchanged, because Sync Pull and Expunge None never write to Proton.

9. Archive or schedule (optional)¶

Create a dated tarball of the folder:

tar czf receipts-$(date +%F).tar.gz -C ~/Mail/proton Receipts

To run the backup on a schedule, have a systemd user timer call mbsync proton-onefolder. Bridge must be running whenever the timer fires, so keep the proton-bridge service enabled.

Troubleshooting¶

For network-level detail, run:

mbsync -Dn proton-onefolder