Proton

At Proton, we want you to be able to choose what happens to your personal information, which is why we’ve built a suite of encrypted services that put you in control. An integral part of giving you control is explaining exactly how our services work, including how they protect your information. This is the only way you can make an informed decision about who to entrust with the details of your life. 

Given the sensitive information you protect with your password manager, it’s crucial that you know exactly what’s happening inside it. Because Proton Pass is open source, anyone can inspect our code and ensure that the apps work as described.

You can find the source code for Proton Pass here:

Review the code for all Proton apps

Proton Pass has passed an independent security audit

While being open source means that anybody can audit our code, not everyone has the time, technical expertise, or interest to pore over our apps’ code. That’s why we also regularly commission and publish independent security audits for all our apps.

Proton Pass’s code underwent a security audit by the German security firm Cure53(new window) throughout May and June. We selected Cure53 to handle the Proton Pass audit because we wanted to ensure that Proton Pass received the most rigorous testing possible, and Cure53 has extensive experience investigating browser extensions and password managers. They tested all Proton Pass mobile apps, browser extensions, and our API.

Cure53 had this to say about Proton Pass, “Proton’s extensive and thorough security assessment by Cure53 showcased their commitment to maintaining a high-level of security. With a moderate number of findings and most security vulnerabilities limited in severity, the overall state of security across Proton’s applications and platforms is commendable”. 

These results reflect Proton’s deep security DNA and help validate many of the architectural decisions we made with Proton Pass. There are also password management-specific considerations that this audit helped raise to our attention. For instance, we missed a case where an attacker might control a subdomain on a domain where the user has an account and thus trick a user who isn’t paying attention into accidentally entering their credentials. 

All issues reported in the security audit have been resolved except for the medium severity issue PRO-01-003 WP1, which unfortunately cannot be resolved at this time due to a platform limitation in Android (the Android operating system doesn’t currently provide the information that would be required to solve this issue). You can read the Proton Pass audit report(new window) for yourself. You can also find the audit reports for all Proton services.  

Security you can trust and verify

As a company run by scientists (Proton was founded by scientists who met at CERN), we believe strongly in the scientific ethos of transparency and peer review. Proton’s security and privacy claims can be independently verified by others, and our open-source code allows our claims to be continually tested, verified, and even improved.

Instead of hiding vulnerabilities and relying on secrecy to maintain “security” like other companies, we subject all our services to rigorous public examination, allowing us to swiftly find and resolve any issues. 

For this reason, we also actively encourage the inspection and checking of Proton’s code through our public Bug Bounty Program.  If you have questions or comments about Proton Pass, its security audit, or our approach to open source, please share them with us! Join the conversation on Twitter(new window) and Reddit(new window).

Protect your passwords
Create a free account

Related articles

People and companies are generally subject to the laws of the country and city where they are located, and those laws can change when they move to a new place. However, the situation becomes more complicated when considering data, which can be subjec
Your online data is no longer just used for ads but also for training AI. Google uses publicly available information to train its AI models, raising concerns over whether AI is even compatible with data protection laws. People are worried companies
iPhone stores passwords in iCloud Keychain, Apple’s built-in password manager. It’s convenient but has some drawbacks. A major issue is that it doesn’t work well with other platforms, making it hard for Apple users to use their passwords and passkeys
There are many reasons you may need to share passwords, bank details, and other highly sensitive information. But we noticed that many people do this via messaging apps or other methods that put your data at risk. In response to the needs of our com
Large language models (LLMs) trained on public datasets can serve a wide range of purposes, from composing blog posts to programming. However, their true potential lies in contextualization, achieved by either fine-tuning the model or enriching its p
is Google Docs secure
Your online data is incredibly valuable, particularly to companies like Google that use it to make money through ads. This, along with Google’s numerous privacy violations, has led many to question the safety of their information and find alternative