The alleged bomb threat cited by Belarus as the reason why it diverted a plane to Minsk before arresting a journalist on board was sent after the plane was redirected, the email provider said.
Proton Technologies, which is headquartered in Geneva and says it is the world's largest secure email provider, said the sent time confirmed it came after the Ryanair passenger plane was diverted to Belarus.
The Athens-to-Vilnius flight carrying a wanted opposition activist was forced to land in Minsk on Sunday over a supposed bomb scare.
"Due to our encryption, we can't access/verify the message contents," ProtonMail said on Twitter.
"However, we can see the sent time and can confirm it was after the plane was redirected.
"Based on the screenshots of the leaked email that were posted online, it was leaked by somebody with access to the receiving mail server in Belarus. The receiving mail server also has a copy of the email."
Belarusian President Alexander Lukashenko sparked outrage by sending a fighter jet to intercept the Ryanair flight. After landing in Minsk, dissident journalist Roman Protasevich and his girlfriend were arrested.
The Belarusian authorities claimed that Minsk had received a threatening email from a ProtonMail address purportedly from the Palestinian Islamist group Hamas claiming that a bomb was on board flight FR4978.
At around 0930 GMT on Sunday, the Boeing 737-800 plane entered Belarusian airspace and was contacted by Belarusian air traffic control.
According to the transcript of exchanges between the control tower and the plane, they informed the pilot of the threat at 0930 GMT and a minute later recommended landing in Minsk.
At 1015 GMT, the flight landed in Minsk National Airport.
According to Belarus, the email said: "We, Hamas soldiers, demand that Israel cease fire in the Gaza Strip. We demand that the European Union abandon its support for Israel in this war.
"A bomb has been planted onto this aircraft. If you don't meet our demands the bomb will explode on May 23 over Vilnius. Allahu Akbar."