You never send your password to their servers, they use the "secure remote password protocol" : https://en.wikipedia.org/wiki/Secure_Remote_Password_protoco...

They explain what they do here : https://proton.me/blog/encrypted-email-authentication