Proton Pass
Proton Pass stores passwords, passkeys, credit card details and private notes, and syncs them across devices. It’s made by Proton, based in Switzerland.
Criminals have used its name in fake downloads or scams, so get it only from proton.me.
What it is
People use Proton Pass to keep login details together, generate passwords and share selected items. The Mac app manages your saved items. Separate browser extensions save and fill logins on websites.
The app can read the information you store or import into it. Its optional autotype feature needs Accessibility permission to type login details into other apps. Proton says saved information is encrypted before syncing and that it cannot read your vault contents.
Proton publishes the app’s source code and independent security audit results. A 2026 audit covered its desktop apps, mobile apps, browser extensions and command-line tool. Proton reported that desktop memory-handling issues found during the audit were fixed.
Who makes it
Proton is a Swiss privacy software company founded in 2014, with the nonprofit Proton Foundation as its primary shareholder. Its legal name is Proton AG. Its website is proton.me.
Is it the real one?
Every Mac app carries a signature from the developer who made it. Apple checks who the developer is before handing out the certificate, and macOS refuses to open an app whose signature has been tampered with.
HARD hasn’t yet recorded the signature on a real copy of Proton Pass. Its Mac app shows who signed the copy you have.
Its bundle ID, the name macOS knows it by, is me.proton.pass.electron. Download it only from proton.me, not from an ad or a link someone sends you.
Fakes. In September 2026, ScanMalware reported search-result poisoning using fake download and sign-in pages that impersonated several password managers, including Proton Pass.
What it connects to
In normal use, Proton Pass talks to these places on the internet. A firewall that asks before apps connect, like the one in HARD’s Mac app, will show them.
| Address | Why |
|---|---|
pass.proton.me | Pass access and data syncing. |
pass-api.proton.me | Pass service and data syncing. |
account.proton.me | Proton account access. |
account-api.proton.me | Proton account services. |
What it can see
macOS asks you before an app can use these. You can change them any time in System Settings → Privacy & Security.
| Permission | What it’s for |
|---|---|
| Accessibility | Optional autotype uses this to enter usernames and passwords into fields in other apps. |
Security record
Problems with Proton Pass or Proton in the last three years, newest first. Keeping the app up to date covers the ones that were fixed.
| When | What happened | Source |
|---|---|---|
| Proton reported that an independent audit found desktop memory-handling issues, which were fixed and checked again during a retest. | ↗ | |
| A researcher disclosed a browser-extension flaw that could trick users into releasing saved information with a click; Proton fixed it in version 1.31.6. | ↗ |
References
- Proton Pass desktop build configuration github.com
- About Proton proton.me
- Download Proton Pass for macOS proton.me
- How to use the Proton Pass desktop app proton.me
- How to set up the Proton Pass macOS app proton.me
- How to use autotype in Proton Pass proton.me
- Proton Pass security proton.me
- Proton Pass desktop updater source github.com
- Proton Pass desktop changelog github.com
- How to deploy Proton Pass behind a company firewall proton.me
- Proton’s password manager passes audit by top security firm proton.me
- DOM-based Extension Clickjacking: Your Password Manager Data at Risk marektoth.com
- Proton Pass is protected against clickjacking attacks proton.me
- Fake VPN-client and password-manager look-alikes from one search-poisoning operator scanmalware.com