ProtOSINT is a nice and easy-to-use Python tool that provides investigators with three important capabilities. The first capability allows the investigator to test the validity of a single ProtonMail account, providing a clear true or false response. The second capability requires the investigator to input the first and last name of a target in addition to a series of Pseudos; the tool then returns a series of possible accounts which match the inputted details and indicates whether the accounts are active and when they were created. The final capability that this tool provides is the ability for the investigator to identify whether an IP address is currently affiliated with a ProtonVPN.

The one downside to this tool is that it does not always give you the creation time of the ProtonMail account itself. The timestamp returned by ProtonMail API is the time and date when the primary PGP key for the email was created. That said, it is very easy to install and deploy – more importantly, it does not require much user input.