I've been a paid user for more than a year. I noticed this missing critical feature when I subscribed to the premium plan. I had mailed the Proton support back then, got no answer whatsoever. If they are this privacy-focused company as they claim to be, having this feature is mandatory. I hope they implement it soon.

I only realised that any alias can be used to login to any part of the Proton suite when I started using it more. I've kept my initial proton address completely safe, but to what end, I'm not sure now.
Even with 2 step authentication this seems odd.

It's kind of silly this still hasn't been addressed by a potential Google/Outlook alternative. Serious users don't want to have to use a silly SimpleLogin alias for their business emails. I want to be jsmith @ proton.me or johnsmith @ proton.me in my correspondence with clients, not jsmith.420bananastand @ aleeas.com

For those who support this feature, you can also support : https://protonmail.uservoice.com/forums/284483-proton-mail-calendar/suggestions/47611028-choose-which-alias-can-log-in-to-proton

With yet another data breach, this is becoming more and more critical

Critical feature as pointed out already, which currently prevents me from using protonmail the way that was intended

Presently, I can login with all my Proton aliases.
This potentially expands the attack surface for unauthorized logins.
When login to Proton account only with primary Proton email, this will be reduced.

This is such a glaring security issue and it's the only reason I haven't gone for a paid account. I love how smooth and integrated everything is in Proton and would love more features-- but the key one I want is security and I don't want to pay to increase the ease with which my entire account can be compromised if one of my potential alases gets leaked through a hack.

This would improve account security. Really critical. I use a custom domain address alongside my primary Proton Mail address (you can see Proton stuff in DNS MX record). Every time I give my own professional email address away, I increase a change that it will used to for trying to hack into my Proton account. Same goes with pm.me address. I come from Outlook and in Outlook it was possible to deny login for other mail address. I used to have a policy not to share my login address with anyone, so login account was never used as email address. I would very much like to see that same possibility with Proton. Some kind of proton user ID (not mail) would be the option for logins.

It would be very useful to have a separate “disable login” toggle (or the ability to mark an address as “login‑only off”) so the address can remain fully functional for email while never being usable for authentication. (Proton Unlimited user)

On January 6th, I received an email from Uservoice saying that this was under review. Is it still the case ? Apparently not…

Currently, when you create an email address using the identities settings page (part of the 15 address limit), you can sign in using this newly created address. It would be good if you could disable the ability to sign in with a specific address so that you can completely hide your account's primary address from everyone. I believe this would increase the security of your Proton account since your sign in email would only be known by yourself.

I have a website which I shut down two years ago due to a massive cyberattack which went on for three days. Every now and again, while I figure out what to do with it (it was a creative thing), I log on, and there are STILL people regularly trying drive-by attacks on all the previous usernames which the version of WordPress I was using back then allowed them to enumerate easily. I automatically divert them to people like the NSA and GCHQ on the off-chance that it catches out some eejits, but the fact remains that even 3-4 years after I effectively closed that account, people are still attempting on a very regular basis to log into my site based on accounts which have been released into the wild. It's fully protected, but my point is that they still try, and there is absolutely no reason to increase your attack surface tenfold for no benefit.

From a security view - this kinda of removes the benefits of alias email addresses. Should have been implemented long ago - but the team have been busy so hopefully they can address this ASAP. It shouldn't be a difficult change to make. Thanks Proton - sticking with you as your ironing out issues as best possible

This is a critical must have feature. My User Story: I have a Microsoft account and my original email was exposed in multple data breaches. First thing I did with my Outlook email when I started getting all the spam and fishing emails was to create a new alias that I would only use to login to my account; I disabled login ability on all other email alaises. After that I was also able to make the new email alias my primary alias for the account while at the same time having a different default email alias for actually sending/recieving emails. This way my login email would never be used for email or as a login email for any other account. On top of that the Microsoft account system allowed me to delete my original email alias completly which then eliminated all the spam. Same thing happened to my parents and I helped with the same fix. In the past my story may have been at outlier case but today it is common for people to recive notifications from a service provider stating that their information has been leaked and that the email was part of that leak. If you match the MIcrosft Account capabilities that woould be ideal: disable/enable login on any email alias, make any email alias the primary alias, make any alias the default to send/recieve email indepent of primary alias, ability to delete any alias (even the original alias when account was created without impacting account overall status.)
Kind Regards,
Proton Duo Paying Customer

I've just come here to point out how absolutely ludicrous a security hole this is, especially as I've spent over 5 hours this weekend contacting nearly 200 people about yet another data breach, one of which has recent credentials in it.

If I had the slightest idea when I signed up that all the additional emails could also be used to log in using the same password, then there was no way I would have done it in the first place. And no I didn't know about aliases or SimpleLogin or whatever because I had just signed up and it was 4 years ago.

Yes, obviously you need a strong password and 2FA, but as many other people have pointed out, how is it possibly not LESS safe having 15x as many attack vectors.

As everyone else has said, you should be able to use your default to log in and not give it out to anybody, thus considerably increasing the effort required to break in. As someone who signed up here off the back of three genuinely life-altering cybersecurity incidents, I am astonished that this hole is still there. It really is as bad as WordPress being able to be brute forced out of the box. Though I am heartened that they seem to have finally fixed that.

Just started subscription and created few aliases - then discovered that I can login with them, defeating the purpose.

I guess I will go back to paid Outlook subscription.

I really need this feature. Otherwise, I can’t use my Proton account the way I had planned.

Completely agree with recent comments. Long overdue. This was why I did not renew my Proton subscription. Hopefully Proton will see sense and go back to fixing the basics before launching new features.

Indeed, and this should reflect the username too. If the alias email for login is pmuv17c@protonmail.com then the username login should also switch to pmuv17c. That way, users can have a specific unused email solely for login.

It is important to use a login that is not associated with an (main)email address. This is an additional step in preventing password guessing.