Proton Pass: the privacy-first password manager worth a look

Tool of the Week

Proton Pass is a password manager from the team behind Proton Mail, built around the same end-to-end encryption approach the company uses across its other products.

What it does: stores and autofills passwords and passkeys, generates two-factor authentication codes inside the same app so you're not juggling a separate authenticator, and includes email aliasing so you can hand out a disposable address instead of your real one when signing up for something new.

Why aliasing is the genuinely distinctive feature

Most password managers store credentials. Proton Pass also gives you disposable addresses, and that capability comes from Proton's acquisition of SimpleLogin, a dedicated aliasing service, rather than being bolted on.

An alias is a real, working address that forwards to your actual inbox, so you can reply from it and disable it independently without touching your primary account.

The practical value is containment. When you sign up with a unique alias per service, a breach at one company exposes an address used nowhere else, so credential-stuffing attempts against your other accounts fail at the username. You also learn immediately who leaked or sold your details, because the spam arrives at an address only one company ever had.

Given that stolen credential collections circulate continuously, as the 24 billion credential leak showed, limiting the blast radius of any single breach is worth more than a stronger master password.

Passkeys, and why a manager still matters

Proton Pass stores passkeys alongside passwords, which is the right call during a long transition. Passkeys are genuinely more resistant to phishing because the credential is bound to the site, but they are not a finished story: support is patchy, recovery flows vary, and malware has already learned to steal the login method that was meant to be unstealable.

So a manager that holds both, and syncs passkeys across your devices rather than trapping them in one platform's ecosystem, is the pragmatic position.

How it compares

Bitwarden is the honest value comparison, and its free tier is more generous. 1Password remains the most refined experience, particularly for shared family and team vaults where its permissions model is better developed. Proton Pass wins specifically when you want aliasing included and are already inside the Proton ecosystem, where a single subscription covering mail, VPN, storage and passwords is cheaper than assembling the same stack from separate vendors.

Who it's for: if you already use Proton Mail or Proton VPN and want one account managing your whole privacy stack, or if you specifically want built-in email aliasing without paying for a separate service, Proton Pass earns its place.

Switching is the hard part, and it is mostly mechanical

The reason people stay on a worse password manager is migration friction, so it is worth being concrete about what moving actually involves.

Every major manager exports to CSV and imports from the others, and Proton Pass has direct importers for the common ones. The export step is the risky moment: a plaintext CSV of every credential you own sitting in your downloads folder is the single most dangerous file on your machine. Do it, import it, then delete it properly and empty the trash.

What does not transfer cleanly is the detail. Two-factor seeds often need re-adding by hand, because many managers will not export them. Passkeys generally cannot be migrated at all and must be re-registered per site. Attachments and secure notes transfer inconsistently.

Do not delete the old vault

Keep the previous manager installed and populated for a month. Autofill failures surface gradually, usually on the one site you need urgently, and having the old vault available turns a crisis into an inconvenience. Cancel the old subscription only once you have gone a few weeks without reaching for it.

The genuinely important habit, whichever tool you land on, is a periodic encrypted export stored somewhere you control. A password manager is a single point of failure for your entire digital life, and account lockout is a more common disaster than a breach.

The jurisdiction and structure question

Proton's pitch rests partly on being Swiss, outside US and EU disclosure regimes, and the company is now held by a non-profit foundation rather than conventional shareholders. That structure is a reasonable signal about long-term incentives, since it makes an acquisition that changes the privacy posture harder.

Be precise about what encryption protects, though. End-to-end encryption means Proton cannot read your vault, which is the important guarantee. It does not make you immune to a compromised device, a phishing page you type your master password into, or losing access if you forget your recovery details. The 2022 breach of a major competitor, where attackers took encrypted vaults that could then be attacked offline, is the reminder: your master password strength is doing real work.

Honest caveat: built-in two-factor codes and unlimited aliases need the paid Pass Plus plan; the free tier caps you at 10 aliases. If you're already happy with Bitwarden or 1Password and don't specifically want the Proton ecosystem, there's no urgent reason to switch. No affiliate programme is currently listed for Proton Pass in our records, so this is a recommendation with no commission attached.

Whichever manager you pick, the two habits that matter more than the choice are a long unique master password you have never used elsewhere, and an exported encrypted backup stored somewhere you control, following the same logic as the 3-2-1 backup rule. It is also worth checking which of your addresses already appear in known breaches, which our Have I Been Pwned guide covers.

Key takeaways

• Proton Pass combines password and passkey storage, built-in two-factor codes, and email aliasing in one end-to-end encrypted app.
• Aliasing is the real differentiator, inherited from Proton's SimpleLogin acquisition. A unique address per service contains breaches and identifies who leaked your data.
• It stores passkeys as well as passwords, which is the pragmatic choice while passkey support and recovery remain uneven.
• Bitwarden is better value at about $1.65/month; 1Password is more polished from about $2.99/month; Proton Pass Plus is about $2.99/month billed yearly.
• Swiss jurisdiction and non-profit foundation ownership are genuine signals about incentives rather than marketing.
• End-to-end encryption protects the vault from Proton, not from a compromised device or a phishing page. Master password strength still carries real weight.
• The free tier works on unlimited devices but caps aliases at 10 and leaves out built-in two-factor codes.