ProtonBlog(new window)

At Proton, we want you to be able to choose what happens to your personal information, which is why we’ve built a suite of encrypted services that put you in control. An integral part of giving you control is explaining exactly how our services work, including how they protect your information. This is the only way you can make an informed decision about who to entrust with the details of your life. 

Given the sensitive information you protect with your password manager, it’s crucial that you know exactly what’s happening inside it. Because Proton Pass is open source, anyone can inspect our code and ensure that the apps work as described(new window).

You can find the source code for Proton Pass here:

Review the code for all Proton apps

Proton Pass has passed an independent security audit

While being open source means that anybody can audit our code, not everyone has the time, technical expertise, or interest to pore over our apps’ code. That’s why we also regularly commission and publish independent security audits for all our apps.

Proton Pass’s code underwent a security audit by the German security firm Cure53(new window) throughout May and June. We selected Cure53 to handle the Proton Pass audit because we wanted to ensure that Proton Pass received the most rigorous testing possible, and Cure53 has extensive experience investigating browser extensions and password managers. They tested all Proton Pass mobile apps, browser extensions, and our API.

Cure53 had this to say about Proton Pass, “Proton’s extensive and thorough security assessment by Cure53 showcased their commitment to maintaining a high-level of security. With a moderate number of findings and most security vulnerabilities limited in severity, the overall state of security across Proton’s applications and platforms is commendable”. 

These results reflect Proton’s deep security DNA and help validate many of the architectural decisions we made with Proton Pass. There are also password management-specific considerations that this audit helped raise to our attention. For instance, we missed a case where an attacker might control a subdomain on a domain where the user has an account and thus trick a user who isn’t paying attention into accidentally entering their credentials. 

All issues reported in the security audit have been resolved except for the medium severity issue PRO-01-003 WP1, which unfortunately cannot be resolved at this time due to a platform limitation in Android (the Android operating system doesn’t currently provide the information that would be required to solve this issue). You can read the Proton Pass audit report(new window) for yourself. You can also find the audit reports for all Proton services.

Security you can trust and verify

As a company run by scientists (Proton was founded by scientists who met at CERN), we believe strongly in the scientific ethos of transparency and peer review. Proton’s security and privacy claims can be independently verified by others, and our open-source code allows our claims to be continually tested, verified, and even improved.

Instead of hiding vulnerabilities and relying on secrecy to maintain “security” like other companies, we subject all our services to rigorous public examination, allowing us to swiftly find and resolve any issues. 

For this reason, we also actively encourage the inspection and checking of Proton’s code through our public Bug Bounty Program(new window).  If you have questions or comments about Proton Pass, its security audit, or our approach to open source, please share them with us! Join the conversation on Twitter(new window) and Reddit(new window).

Protect your passwords
Kostenloses Konto erstellen

Verwandte Artikel

chrome password manager
en
You likely know you should store and manage your passwords safely. However, even if you are using a password manager, there’s a chance the one you’re using isn’t as secure as it could be. In this article we go over the threats some password managers
sensitive information
en
We all have sensitive personal information we’d all rather not share, whether it’s documents, photographs, or even private video. This article covers how to handle sensitive information or records, and what you can do to keep private information priv
en
Social engineering is a common hacking tactic involving psychological manipulation used in cybersecurity attacks to access or steal confidential information. They then use this information to commit fraud, gain unauthorized access to systems, or, in
is whatsapp safe for sending private photos
en
WhatsApp is the world’s leading messaging app, trusted by billions of people around the globe to send and receive messages. However, is WhatsApp safe for sending private photos? Or are there better ways to share photos online privately? Let’s find ou
passwordless future
en
  • Grundlagen der Privatsphäre
With the advent of passkeys, plenty of people are predicting the end of passwords. Is the future passwordless, though? Or is there room for both types of authentication to exist side-by-side?  At Proton, we are optimistic about passkeys and have int
en
At Proton, we have always been highly disciplined, focusing on how to best sustain our mission over time. This job is incredibly difficult. Everything we create always takes longer and is more complex than it would be if we did it without focusing on