Password managers
Proton Pass privacy rating
End-to-end encrypted password manager from Proton with apps for desktop, mobile and browsers, built-in email aliases and a TOTP authenticator. The apps are open source.
Summary
Proton Pass scores 80 out of 100 (grade B) on the password managers criteria. It meets 7 of 11 criteria: no ads or data sales, independent audit, transparency report, tells users about requests, TLS configuration, end-to-end encrypted vault and full export. It partly meets open source, no trackers or telemetry, security headers and local or self-hosted option. It is based in Switzerland: Not in the Five, Nine or Fourteen Eyes; GDPR-style data protection law. Automated tests: SSL Labs grade A+ and Mozilla HTTP Observatory grade B+.
Score 80 out of 100. How scoring works
Criteria
-
Partial
Open source Weight 3 of 3
Is all the source code needed to run the product public?
Apps are GPL-3.0. The server is not open source.
-
Partial
No trackers or telemetry Weight 3 of 3
Are the website and apps free of third-party trackers, with any analytics anonymous and any telemetry off by default?
No third-party analytics, but Proton apps share usage statistics and crash reports by default, and these can be turned off in settings.
-
Yes
No ads or data sales Weight 2 of 3
Is the product funded without advertising, ad targeting or selling user data?
Funded by paid plans.
-
Yes
Independent audit Weight 2 of 3
Has an independent security or privacy audit been published within the last three years?
Full report from Recurity Labs covering the browser extensions, mobile and desktop apps and CLI.
-
Yes
Transparency report Weight 2 of 3
Does the provider regularly publish how many government and legal requests it receives and how it responds?
Publishes yearly counts of legal orders received, contested and complied with.
-
Yes
Tells users about requests Weight 1 of 3
Does the provider promise to tell users about requests for their data, unless a court forbids it?
Users are notified of data requests unless Swiss law or a court order temporarily prohibits it.
-
Yes
End-to-end encrypted vault Weight 3 of 3
Is the vault encrypted on the device before it is synced, with a key the provider does not hold?
Vault data is end-to-end encrypted on the device before it is synced.
-
Partial
Local or self-hosted option Weight 2 of 3
Can the vault be kept locally or on your own server?
Vaults are stored only in Proton's cloud. Data can be exported.
-
Yes
Full export Weight 1 of 3
Can every item be exported in an open format?
Exports to JSON in a ZIP file, optionally PGP-encrypted, or to CSV.
Automated tests
-
Yes
TLS configuration Weight 2 of 3
Does the website pass the Qualys SSL Labs test with a grade of A or better?
Grade A+
-
Partial
Security headers Weight 1 of 3
Does the website pass the Mozilla HTTP Observatory test with a grade of A or better?
Grade B+ (80/100+)
-
Not tested yet
Modern web standards Weight 1 of 3
Does the website score 90% or higher on the Internet.nl website test?
Not tested yet.