# Proton Pass privacy rating

End-to-end encrypted password manager from Proton with apps for desktop, mobile and browsers, built-in email aliases and a TOTP authenticator. The apps are open source.

## Summary

Proton Pass scores 80 out of 100 (grade B) on the password managers criteria. It meets 7 of 11 criteria: no ads or data sales, independent audit, transparency report, tells users about requests, TLS configuration, end-to-end encrypted vault and full export. It partly meets open source, no trackers or telemetry, security headers and local or self-hosted option. It is based in Switzerland: Not in the Five, Nine or Fourteen Eyes; GDPR-style data protection law. Automated tests: SSL Labs grade A+ and Mozilla HTTP Observatory grade B+.

- Website: https://proton.me/pass
- Source code: https://github.com/protonpass/android-pass
- License: GPL-3.0
- Jurisdiction: Switzerland. Not in the Five, Nine or Fourteen Eyes. GDPR-style data protection law.
- Home page trackers: none found
- Category: [Password managers](https://privacyratings.com/password-managers/)
- Also rated: [Proton Mail](https://privacyratings.com/email-providers/protonmail/) (Email providers), [Proton Authenticator](https://privacyratings.com/two-factor-authentication/proton-authenticator/) (Two-factor authentication), [Proton VPN](https://privacyratings.com/vpns/protonvpn/) (VPN providers), [Proton Calendar](https://privacyratings.com/calendars/proton-calendar/) (Calendars), [Proton Docs](https://privacyratings.com/office-suites/proton-docs/) (Office suites), [Lumo](https://privacyratings.com/ai-assistants/lumo/) (AI assistants), [Proton Drive](https://privacyratings.com/cloud-storage/proton-drive/) (Encrypted cloud storage)
- Grade: B (80/100)

## Criteria

| Criterion | Answer | Note | Evidence |
| --- | --- | --- | --- |
| Open source | Partial | Apps are GPL-3.0. The server is not open source. | https://github.com/protonpass/android-pass/blob/main/LICENSE |
| No trackers or telemetry | Partial | No third-party analytics, but Proton apps share usage statistics and crash reports by default, and these can be turned off in settings. | https://proton.me/support/share-usage-statistics |
| No ads or data sales | Yes | Funded by paid plans. | https://proton.me/pass/pricing |
| Independent audit | Yes | Full report from Recurity Labs covering the browser extensions, mobile and desktop apps and CLI. | https://drive.proton.me/urls/T9BGC6B11W#seHd3zMpGo5j |
| Transparency report | Yes | Publishes yearly counts of legal orders received, contested and complied with. | https://proton.me/legal/transparency |
| Tells users about requests | Yes | Users are notified of data requests unless Swiss law or a court order temporarily prohibits it. | https://proton.me/legal/law-enforcement |
| TLS configuration | Yes | Grade A+ | https://www.ssllabs.com/ssltest/analyze.html?d=proton.me&hideResults=on |
| Security headers | Partial | Grade B+ (80/100+) | https://developer.mozilla.org/en-US/observatory/analyze?host=proton.me |
| Modern web standards | Not tested yet | Not tested yet. |  |
| End-to-end encrypted vault | Yes | Vault data is end-to-end encrypted on the device before it is synced. | https://proton.me/pass/security |
| Local or self-hosted option | Partial | Vaults are stored only in Proton's cloud. Data can be exported. | https://proton.me/support/pass-export |
| Full export | Yes | Exports to JSON in a ZIP file, optionally PGP-encrypted, or to CSV. | https://proton.me/support/pass-export |

Source: https://privacyratings.com/password-managers/protonpass/
Edit: https://github.com/privacyratings/privacyratings.com/edit/main/ratings/password-managers/protonpass.md