The password manager where only your team holds the keys
Proton Pass zero-access security architecture makes your credentials mathematically inaccessible to anyone — a claim independently verified by external auditors. Your passwords can’t be obtained in any circumstance, not even under legal compulsion.
Trusted by over 100,000 businesses and 100 million people worldwide
Enterprise password management from the same team that built Proton Mail — the world’s largest end-to-end encrypted email service. Proton Pass protects the credentials of organizations in healthcare, finance, legal, and government.
Centralising credentials doesn’t create a single point of failure. It eliminates dozens of them.
Unlike conventional password managers, which encrypt your data but retain the ability to decrypt it, Proton has no mechanism to access your vault.
Proton Pass is built on zero-access architecture so your credentials are encrypted on your device before they ever reach our servers.
We don’t hold keys, store plaintext, and have the ability to see your data — not even under legal pressure. In the unlikely event that an attacker accesses Proton’s servers, they’d only find ciphertext they can’t decrypt.
Built to secure your data at every layer
Data is encrypted before it leaves your device
Every item is encrypted on your device using 256-bit AES-GCM before it reaches Proton’s servers. The encryption key never leaves your device. Proton does not hold it, cannot retrieve it, and has no mechanism to decrypt your vault — even under legal compulsion.
Data is encrypted at rest and in transit
Vault sharing uses OpenPGP with ECC (Curve25519) — an open standard audited and battle-tested for over 25 years. Each vault entry is encrypted independently. There is no single master key that unlocks everything.
Password management features for Business
Enterprise password management from the same team that built Proton Mail — the world’s largest end-to-end encrypted email service. Proton Pass protects the credentials of organizations in healthcare, finance, legal, and government.
Multi-factor authentication
Every Proton Pass account supports TOTP authenticators, FIDO2 hardware security keys, passkeys, biometric unlock (fingerprint and Face ID), PIN code, and Extra Password — an additional vault password on top of the Proton account login.
Admin-enforced 2FA policy
2FA enforcement is set at the organisation level by the admin. Once enabled, it applies consistently across every account — no individual opt-outs, no deferrals that quietly become permanent, and no exceptions that introduce gaps in your security posture.
Proton Sentinel
Proton Sentinel protects against account takeover across 100+ million accounts using AI-powered threat detection, supported by 24/7 human analyst review. Suspicious login attempts are flagged and blocked — not just rate-limited.
Independently verified by external security auditors
Proton Pass is open-source and independently verifiable. All our claims can be — and have been — verified by third-party security experts.
Firm | Period | Scope / Finding |
|---|---|---|
Cure53 (Germany) | May–June 2023 | All Pass mobile apps, browser extensions, and API. |
Recurity Labs (ISO 27001-certified) | Jan–Apr 2026 | Browser extensions, mobile and desktop apps, CLI. Finding: “overall security posture well above par — no remote exploits or encryption bypasses identified.” |
Don’t take our word for it: Your security team can audit the Proton Pass encryption implementation and our client apps at github.com/protonpass(new window).
Compliance certifications
These certifications verify how Proton operates as an organization — separate from, and in addition to, the cryptographic audits above.
ISO 27001 certified
Proton is ISO 27001 certified. Credentials managed in Pass operate within a certified information security management framework.
SOC 2 Type II
SOC 2 Type II attestation completed July 2025, independently verified by Schellman. Covers security, availability, and confidentiality of Proton’s infrastructure and controls — not a point-in-time snapshot.
What happens if a government demands your data?
Proton is headquartered in Geneva, Switzerland.
Your data is stored on servers located in Germany, Switzerland and Norway and subject to GDPR and the Swiss Federal Act on Data Protection (FADP) — one of the strongest data protection regimes in the world.
Swiss law prohibits Proton from complying with foreign surveillance orders without due process in Swiss courts.
Start protecting your credentials today
