# Proton Pass — Password Management

Proton Pass by Proton AG holds a panel rating of 2/5 from 6 AI judges (category median 2/5), as of 2026-10-15. Provenance: UK / wider Europe; sovereignty: not determined.

- Vendor: Proton AG (https://proton.me/pass)
- Category: [Password Management](https://whats-best.ai/software/password-management.md)
- Provenance (editorial classification): UK / wider Europe
- Canonical page: https://whats-best.ai/software/password-management/proton-pass
- Alternatives: https://whats-best.ai/software/password-management/proton-pass/alternatives ([markdown](https://whats-best.ai/software/password-management/proton-pass/alternatives.md))
- Data as of: 2026-10-21 · evaluated 2026-10-15 · oldest source captured 2026-10-01

**AI-generated.** Every score, rationale and verdict here is written by a panel of AI judges from public evidence — an analysis, not a hands-on test. Every fact quotes the vendor page it was read from. No score can be bought. How scores are made: https://whats-best.ai/methodology

## At a glance

- Vendor: Proton AG
- Headquarters: Not stated on the vendor’s pages as of 13 Oct 2026
- Data hosting: Not stated on the vendor’s pages as of 13 Oct 2026
- Free plan: Yes, per the vendor’s own page [S1]

## The panel's verdict

Proton Pass is Proton AG's end-to-end encrypted password manager; the company is based in Plan-les-Ouates (Geneva), Switzerland and presents itself as outside US and EU jurisdiction. The highest scores come on security architecture and identity integration, at 5 to 6, with sharing and access control close behind at 4 to 6: the captured pages name 256-bit AES-GCM and OpenPGP on Curve25519, state that usernames, web addresses and notes are all encrypted, document open-source clients and a public bug bounty, and lay out SCIM provisioning for Okta and Microsoft Entra step by step, including Create Users and Deactivate Users actions. Pricing transparency scores a flat 2, the low point: the pricing page publishes four tiers and seat bands such as 3 to 30 users, but no price figure appears in the captured pages, and the business trial is requested by contacting the sales team. Sovereignty draws the widest spread, 1 to 3: judges credit the Swiss positioning and the no-permanent-IP-logs default, but weigh unequally the unconfirmed vault data residency, subprocessors, and data-processing agreement covering metadata and logs.

**Speaks for it:**
- Encryption is specific and named — 256-bit AES-GCM with a 32-byte vault key, OpenPGP on Curve25519 — extended to usernames, web addresses and notes, not just the password field
- Open-source clients and a public bug bounty are documented on the security pages
- SCIM provisioning is documented step by step for Okta and Microsoft Entra, with groups and Create Users and Deactivate Users actions
- Sharing covers single items and whole vaults, with secure links offering expiry and view limits, revocation at any time, and emergency access on paid plans
- Administrators can enforce policies — required 2FA, sharing outside the organization, export, vault creation, password-generator rules — and view organization-wide sign-in events with location, ISP and device

**Held against it:**
- No price figure appears in the captured pricing pages, so an annual invoice cannot be computed from what is published
- We found no public information on independent audits with named firms and dates, published penetration tests, or disclosed incident history
- We found no public information on where vault data and metadata are hosted, on subprocessors and their locations, or on a data-processing agreement
- We found no public information on log export, an event API, SIEM integration, retention periods, or records of who viewed or copied a shared credential
- We found no public information on a self-hosted option, a selectable data region, offline access during a vendor outage, or a status page with incident history

**Best for:**
- You need end-to-end encryption that covers usernames, web addresses and notes, backed by open-source clients and a public bug bounty
- You run Okta or Microsoft Entra and want documented SCIM joiner-leaver automation with Create Users and Deactivate Users actions
- You want admin-enforceable policies — required 2FA, sharing outside the organization, export, vault creation — with organization-wide visibility of sign-in events
- You are migrating between password managers: import guides cover more than a dozen named competitors, including 1Password, Bitwarden and KeePass, and export includes a PGP-encrypted JSON archive

**Avoid if:**
- You must compute an annual cost from published prices before purchase — ask the vendor: the public pages we read do not show it
- You require an EU-jurisdiction vendor — the company presents itself as Swiss and outside US and EU jurisdiction
- Your audits depend on exportable logs, stated retention periods, or records of who viewed a shared credential — the captured pages show organization-wide sign-in events with location, ISP and device, and we found no public information on log export, SIEM integration or retention

## Scores by judge and criterion

Scores out of 5, each judge scoring independently against the published rubric (v1). "n/r" = not rated: the vendor publishes no price.

| Criterion | The CISO | The Identity Engineer | The Compliance Auditor | The SME Owner | The DevOps Engineer | The Skeptic |
| --- | --- | --- | --- | --- | --- | --- |
| Encryption model & independent audits | 2.5/5 | 3/5 | 3/5 | 3/5 | 3/5 | 2.5/5 |
| Sharing, roles & recovery | 3/5 | 2.5/5 | 3/5 | 2/5 | 3/5 | 3/5 |
| SSO, directory sync & provisioning | 2.5/5 | 3/5 | 3/5 | 2.5/5 | 3/5 | 2.5/5 |
| Audit logs, policies & reporting | 2.5/5 | 2.5/5 | 2/5 | 2.5/5 | 2/5 | 2.5/5 |
| Hosting choice, offline access & export | 2/5 | 2.5/5 | 2/5 | 2/5 | 2/5 | 2/5 |
| European sovereignty | 1/5 | 1/5 | 0.5/5 | 1.5/5 | 1.5/5 | 1.5/5 |
| Pricing transparency | 1/5 | 1/5 | 1/5 | 1/5 | 1/5 | 1/5 |
| **Weighted verdict** | **2.5/5** | **2.5/5** | **2/5** | **2/5** | **2.5/5** | **2/5** |

### The judges

- **The CISO** (v1.0): Answers to the board for the day the vault vendor is breached. Wants a whitepaper that says which fields are encrypted and which are not, audits by named firms with dates, a bug bounty, and an incident history written down rather than discovered in the press.
- **The Identity Engineer** (v1.0): Runs Entra ID for two thousand staff and owns the joiner-mover-leaver process. Wants SCIM that suspends a leaver's vault the moment the account is disabled, an SSO unlock whose key model is documented, and FIDO2 keys and passkeys supported for the vault itself.
- **The Compliance Auditor** (v1.0): Prepares the ISO 27001 and NIS2 evidence and has to show who could see the firewall admin password last March. Wants event logs that cover views and copies, export to the SIEM, enforceable policies, and the contracting entity, hosting and subprocessors named.
- **The SME Owner** (v1.0): Runs a forty-person company where the shared passwords currently live in an Excel file. Wants shared vaults the team actually uses, a way back in when someone forgets the master password, credentials handed over when someone leaves, and a per-user price with SSO not hidden two tiers up.
- **The DevOps Engineer** (v1.0): Would rather run the vault in the company's own data centre than trust another SaaS with root credentials. Wants a documented self-hosted deployment with backup and high availability, open-source code to read, a CLI and API for pipelines, and an export that loses nothing.
- **The Skeptic** (v1.0): Has read the breach post-mortems. Reads "zero knowledge" next to unencrypted URLs and item names, "independently audited" with no report, "SSO unlock" where the vendor holds half the key, and "admin recovery" that means the vendor can decrypt — and treats a missing incident history as an answer.

## European sovereignty — proven facts

Built only from facts on the vendor's own pages; a dimension we could not prove is left open, never scored as zero. Headline: not determined.

| Dimension | Finding | Points | Source |
|---|---|---|---|
| Legal entity | Not determined | — | — |
| Ownership | Not determined | — | — |
| Data residency | Not determined | — | — |
| Subprocessors | Not determined | — | — |

## Key facts

Each fact is the vendor's own statement, cited to the source page it was read from ([S*n*] → Sources).

**Compliance**
- DPA: GDPR personal data processed on user's behalf · yes [S4]
- GDPR representative: yes · yes · Proton Europe sàrl, rue de Grünewald 94, L-1912 Luxembourg [S3]
- Independent audit: yes · yes [S5]

**Data**
- Analytics: Self-developed analytics, anonymized, stored locally, no IP retention [S3]
- Card retention: name · last 4 digits · no · yes [S3]
- Inactive account notice: recovery email · 30 · 15 · 7 [S4]
- Inactive paid exempt: yes [S4]
- Ip logging: no [S3]
- Rights: access · edit · delete · export [S3]
- Support no profiling: no · no [S3]

**Hosting**
- Jurisdiction: Schweiz [S1]
- Jurisdiction: Switzerland [S1]
- Jurisdiction switzerland: Switzerland · yes [S5]

**Integrations**
- Import: yes [S1]
- Import: yes · browser · bestehende Passwort-Manager [S1]
- Import 1password: yes [S13]
- Import bitwarden: yes [S13]
- Import brave: yes [S13]
- Import chrome: yes [S13]
- Import dashlane: yes [S13]
- Import dropbox: yes [S13]
- Import edge: yes [S13]
- Import enpass: yes [S13]
- Import firefox: yes [S13]
- Import keepass: yes [S13]
- Import keeper: yes [S13]
- Import lastpass: yes [S13]
- Import nordpass: yes [S13]
- Import roboform: yes [S13]
- Import safari: yes [S13]
- Platforms: Android · Windows · macOS · Linux · yes · Chrome · Firefox · Safari · Edge · Brave [S1]
- SCIM entra id: Microsoft Entra · Proton Pass for Business · SCIM · yes [S10]

**Legal**
- Company: Proton AG · Route de la Galaise 32, 1228 Plan-les-Ouates, Geneva, Switzerland [S10]
- Company: Proton AG · Route de la Galaise 32, 1228 Plan-les-Ouates, Geneva, Switzerland [S14]
- Company address: Proton AG · Route de la Galaise 32, 1228 Plan-les-Ouates, Geneva, Switzerland [S12]
- Company details: Proton AG · Route de la Galaise 32, 1228 Plan-les-Ouates, Geneva, Switzerland [S9]
- Disclosure: Disclosure only via binding requests from competent Swiss authorities [S3]
- E2e decryption: no [S3]
- Entity: Proton AG · Route de la Galaise 32, 1228 Plan-les-Ouates, Geneva, Switzerland [S1]
- Entity: Proton AG · Route de la Galaise 32, 1228 Plan-les-Ouates, Geneva, Switzerland [S2]
- Entity: Proton AG · Route de la Galaise 32, 1228 Plan-les-Ouates, Geneva, Switzerland · Switzerland [S3]
- Entity: Proton AG · Route de la Galaise 32, 1228 Plan-les-Ouates, Geneva, Switzerland [S5]
- Entity: Proton AG · Route de la Galaise 32, 1228 Plan-les-Ouates, Geneva, Switzerland [S6]
- Entity: Route de la Galaise 32, 1228 Plan-les-Ouates, Geneva, Switzerland · Proton AG · non-profit Proton Foundation · Switzerland [S4]
- Entity: Proton AG · Route de la Galaise 32, 1228 Plan-les-Ouates, Geneva, Switzerland [S7]
- Entity: Proton AG · Route de la Galaise 32, 1228 Plan-les-Ouates, Geneva, Switzerland [S8]
- Entity: Proton AG · Route de la Galaise 32, 1228 Plan-les-Ouates, Geneva, Switzerland [S1]
- Governing law: competent courts of the Canton of Geneva · Switzerland [S4]
- Policy version: 2026-05-12 [S3]

**Pricing**
- Billing cycles: yes · monthly · yearly · bi-yearly [S4]
- Business free trial: business users · specified at sign-up · yes · yes [S4]
- Business tax treatment: business plans only · yes [S4]
- Credit expiry: yes · 24 [S4]
- Free: 0 [S1]
- Free features: yes · 10 · yes · yes [S1]
- Free price: Proton Free · 0 · EUR · no [S1]
- Money back: 30 [S1]
- Money back: 30 [S1]
- Money back guarantee: 30 · money-back guarantee [S2]
- Pass essentials features: Essentials includes unlimited logins/notes/credit cards, apps, sharing, 2FA authenticator, dark web monitoring, password health, passkeys, hide-my-email aliases [S2]
- Pass plus billing period: 35.88 · EUR · 12 [S1]
- Pass plus features: yes · yes · yes · yes · yes · yes [S1]
- Pass plus total: 35.88 · EUR · 12 [S1]
- Pass professional features: Professional adds SSO/SCIM, activity logs, enterprise policies, file attachment, SIEM integration, CLI, group sharing, SSH agent [S2]
- Plus upgrade scope: Proton Pass Plus allows sharing more vaults with more people and single items [S7]
- Referral program: credits and/or features at Proton's discretion [S4]
- Refund policy: full refund · once per user, direct Proton purchase only, not cash/bank transfer · 30 [S4]
- Tax treatment: Taxes may apply (prices exclude tax where applicable) [S2]
- Unlimited: Proton Pass · Proton Mail · Proton Calendar · Proton VPN · Proton Drive · 9.99 · 23 · 12.99 [S1]
- Unlimited billing period: 119.88 · EUR · 12 [S1]
- Unlimited total: 119.88 · EUR · 12 [S1]
- Vpn pass dedicated server: Dedicated server and IP · 39.99 [S2]

**Product**
- Account creation: no [S3]
- Activity monitor: Activity monitor dashboard shows Sentinel security events [S12]
- Admin panel policies location: Admin panel → Proton Pass → Policies [S11]
- AI scribe: writing assistant · Proton Scribe [S4]
- Alias management: paid plans only, expandable by upgrade or purchase [S4]
- Alternative routing: bypasses censorship blocks via third-party networks; data remains encrypted [S3]
- Authentication logs: yes · yes · yes [S3]
- Authentication security location: Admin panel → Organization → Authentication security [S11]
- Autofill: Autofill für Anmeldeformulare auf Websites und in Apps [S1]
- Automatic updates on change: yes [S7]
- Breach notifications: yes [S1]
- Bug bounty: yes [S5]
- Business account monitor: Business account monitor tool lets admins enable, view and manage security events org-wide [S12]
- Business trial: yes [S1]
- Calendar e2ee: All Calendar events and contacts automatically end-to-end encrypted [S6]
- Calendar invite verification: Calendar invites cryptographically verified [S6]
- Cloud storage: 2 GB · 10 GB · 1 TB · 10 GB [S2]
- Compliance GDPR HIPAA: GDPR and HIPAA compliance support in all plans [S2]
- Compliance reporting: yes · yes [S1]
- Compliance reporting: yes · yes [S1]
- Core pass features: All plans: unlimited devices, unlimited passwords/credit cards/notes, password import, apps, autosync, unlimited aliases, generator, autosave/autofill, 2FA authenticator, secure link sharing, passkeys, biometric unlock, dark web monitoring… [S2]
- Cross platform access: yes [S7]
- Dark web monitor: scans for breached personal data associated with Account [S3]
- Decrypt tools: GPG4Win [S14]
- Dedicated account manager: For teams of 20 users and more · Included · For teams of 20 users and more [S2]
- Detailed events fields: Location · ISP · Device [S12]
- Drive client side encryption: Files encrypted on device before upload; not accessible even by Proton [S6]
- Drive file sharing: End-to-end encrypted file sharing via secure shareable links [S6]
- Drive open source: Proton Drive is open-source encrypted cloud storage [S6]
- E2e encrypted sharing: password sharing with end-to-end encryption [S7]
- E2e encryption: End-to-end encryption; data never accessible to Proton, only user can decrypt [S5]
- E2ee scope: End-to-end encryption applied to messages, files, and events [S6]
- Encryption: yes [S1]
- Encryption: password manager · Proton Pass · yes [S1]
- Encryption access: No technical means to access encrypted emails, files, calendar events, passwords, or notes [S3]
- End to end encryption: yes [S2]
- Enforce 2FA: Enforce 2FA included in all plans [S2]
- Essentials user limit: 3 to 30 users · 3 users and more · Unlimited · 3 users and more [S2]
- Export formats: zip_pgp_encrypted_json · unencrypted_zip · csv [S14]
- Export platforms: browser extensions · web app · Windows app [S14]
- Free features: 10 · yes · yes · yes · yes [S1]
- Free multi person sharing: yes [S7]
- Import platforms: browser extensions · web app · Windows app [S14]
- Linux builtin pgp: built-in PGP support [S14]
- Mail attachments e2ee: Email attachments automatically encrypted and decrypted [S6]
- Mail e2ee nonproton: yes · yes [S6]
- Mail storage: 10 GB · 1 TB [S2]
- Mail zero access: Proton Mail uses zero-access encryption for all message contents [S6]
- Meet participants: 50 · 50 · 100 · 50 [S2]
- Metadata encryption: E2E encryption applied to all fields including usernames, web addresses, and notes; metadata not accessible to Proton [S5]
- Minimum age: 13 · yes [S4]
- No location tracking: yes [S3]
- Onboarding training: For teams of 20 users and more · Included · For teams of 20 users and more [S2]
- Open source: yes [S2]
- Open source: yes [S5]
- Open source: yes [S7]
- Openpgp ecc: Curve25519 · OpenPGP · yes [S5]
- Pass monitor: password health · dark web monitoring breach alerts · inactive 2FA detection [S5]
- Pass plus features: yes · unlimited · yes · yes · yes · yes · yes [S1]
- Passkeys: yes [S1]
- Passkeys: yes [S5]
- Passkeys: yes [S1]
- Pgp import supported: yes [S14]
- Platforms: Android · Windows · macOS · Linux · yes [S1]
- Policies roadmap: yes [S11]
- Policy 2FA: email reminders · require 2FA for administrators · require 2FA for everyone · no [S11]
- Policy data export: members can only export vaults they created · yes [S11]
- Policy individual item sharing: Allow individual item sharing policy is toggleable [S11]
- Policy password generator rules: min/max characters · numbers · special characters · uppercase letters · memorable passwords [S11]
- Policy sharing outside org: Allow sharing outside the organization policy; when off, members can only share vaults within the organization [S11]
- Policy vault creation: Allow all users to create vaults or require admins create all vaults [S11]

**Support**
- General contact: contact@proton.me [S8]
- General contact: contact@proton.me [S14]
- Legal contact: legal@proton.me [S8]
- Legal contact: legal@proton.me [S14]
- Msp pilot billing doc: yes [S8]
- Partnerships contact: partners@proton.me [S8]
- SLA credit tiers: 10 · 99.95 · 99 · 30 · 99 [S4]
- SLA uptime: service credit on request · 99.95 [S4]
- Uptime: 99.95 [S2]
- Vpn business cancellation notice: Proton VPN Essentials · Proton VPN Business · Proton VPN Enterprise · 30 [S4]

45 more facts on the canonical page: https://whats-best.ai/software/password-management/proton-pass

## Questions

### Is Proton Pass European?

Yes, though not from the EU. whats-best.ai classifies Proton Pass as UK / wider Europe.

### Where does Proton Pass store data?

Not stated on the vendor’s pages as of 13 Oct 2026.

### Does Proton Pass have a free plan?

Yes. Proton Pass has a free plan, per [the vendor’s page captured 1 Oct 2026](https://whats-best.ai/evidence/7080).

### What are the best alternatives to Proton Pass?

As of 21 Oct 2026, the panel rates [Password Depot (3.5/5)](https://whats-best.ai/software/password-management/password-depot), [Keeper (3/5)](https://whats-best.ai/software/password-management/keeper) and [Passbolt (3/5)](https://whats-best.ai/software/password-management/passbolt) highest among the other 18 Password Management products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is [Password Depot](https://whats-best.ai/software/password-management/password-depot) (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: [how scores are made](https://whats-best.ai/methodology#ordering). The full list, with European products first: [Proton Pass alternatives](https://whats-best.ai/software/password-management/proton-pass/alternatives).

## What this page leaves out

- 15 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 12 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 10 subprocessors facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 3 data facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 2 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 2 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 2 support facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 1 compliance fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 2 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown.
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement.

## Sources

- [S1] Vendor homepage: https://proton.me/de/pass (checked 2026-10-13)
- [S2] Pricing page: https://proton.me/business/pass/pricing (checked 2026-10-13)
- [S3] Privacy policy: https://proton.me/legal/privacy (checked 2026-10-13)
- [S4] Terms of service: https://proton.me/legal/terms (checked 2026-10-13)
- [S5] Encryption model & independent audits — found from sitemap: https://proton.me/pass/security (checked 2026-10-13)
- [S6] Encryption model & independent audits — found from sitemap: https://proton.me/security/end-to-end-encryption (checked 2026-10-13)
- [S7] Sharing, roles & recovery — found from sitemap: https://proton.me/pass/password-sharing (checked 2026-10-13)
- [S8] Sharing, roles & recovery — found from sitemap: https://proton.me/support/pass-share-vault (checked 2026-10-13)
- [S9] SSO, directory sync & provisioning — found from sitemap: https://proton.me/support/pass-set-up-scim-okta (checked 2026-10-13)
- [S10] SSO, directory sync & provisioning — found from sitemap: https://proton.me/support/pass-set-up-scim-microsoft-entra (checked 2026-10-13)
- [S11] Audit logs, policies & reporting — found from sitemap: https://proton.me/support/pass-business-policies (checked 2026-10-13)
- [S12] Audit logs, policies & reporting — found from sitemap: https://proton.me/support/proton-pass-business-turn-on-sentinel (checked 2026-10-13)
- [S13] Hosting choice, offline access & export — found from sitemap: https://proton.me/support/pass/import-export-passwords (checked 2026-10-13)
- [S14] Hosting choice, offline access & export — found from sitemap: https://proton.me/support/pass-export (checked 2026-10-13)

---

Cite as: whats-best.ai, "Proton Pass — Password Management", AI panel analysis, as of 2026-10-21. https://whats-best.ai/software/password-management/proton-pass

Corrections: https://whats-best.ai/correct/669?target=page