# Proton Pass Proton Pass is [[Proton]]'s password manager: end-to-end encrypted, zero-knowledge, open source, audited. It launched in 2023 after Proton acquired SimpleLogin, which is why email aliasing is a first-class feature rather than an add-on. It is the piece of the Proton suite that competes most directly with 1Password and Bitwarden, and the piece that gained the most in 2026 with the CLI. ## Features - **Logins, notes, cards, identities, and passkeys**, organised in vaults. Passkeys work across every platform and sync - **Hide-my-email aliases**: generate a unique address per site, forwarded to your real inbox, disposable when the site starts spamming. Custom domains for aliases on paid tiers. This is the SimpleLogin engine - **Built-in 2FA authenticator** (TOTP) inside the item, autofilled along with the password. (Proton Authenticator is a separate app if you want codes out of the password manager) - **Sharing**: share a vault or a single item with other Proton users, or a secure link with an expiry and view count for anyone - **Pass Monitor**: weak, reused, and missing-2FA passwords, plus dark-web monitoring of your addresses and aliases - **File attachments** on items - **Proton Sentinel** account protection on higher tiers - Password health alerts on every tier ## Platforms Browser extensions for Chrome, Firefox, Edge, Brave, and Safari; native apps for iOS and Android; desktop apps for Windows, macOS, and Linux; a web app; and a CLI. On [[Arch Linux]] the desktop app is in the AUR as `proton-pass-bin` (or `proton-pass`, built from source). ## The CLI `pass-cli` shipped in June 2026 and is the reason I started taking Proton Pass seriously for machine use, not only browser use. It brings secrets into scripts, deployments, and CI without pasting them into shell history or `.env` files. ```bash curl -fsSL https://proton.me/download/pass-cli/install.sh | bash # Linux/macOS pass-cli login # web-based auth by default (prints a URL); the only flow for SSO or hardware keys pass-cli login --interactive [email protected] # terminal auth; env vars PROTON_PASS_PASSWORD / _TOTP / _EXTRA_PASSWORD for automation pass-cli test # session valid? pass-cli info pass-cli vault list pass-cli item list|get|create|delete pass-cli update # self-update (stable or beta track; not via Homebrew installs) ``` Secrets are addressed by URI: `pass://<vault>/<item>/<field>`. Two injection modes: - **Environment**: run a command with `pass://` references resolved into env vars, so the secret exists only in the child process - **Templates**: a file with `pass://` placeholders rendered to a config file at deploy time Credential resolution for automation goes env var → file (`PROTON_PASS_PASSWORD_FILE` etc.) → interactive prompt, which is the right order for CI. Homebrew installs can't switch tracks or self-update. ## Where it fits for me The alias engine is the underrated part. Every newsletter, SaaS trial, and store gets its own address; when one leaks I know exactly who leaked it, and I turn it off. Combined with [[Proton Mail]] the aliases land in the same inbox with the same encryption. The CLI closes the gap with 1Password's `op` for scripts, which was the reason I kept a foot in that ecosystem. Not fully closed: no `op inject`-style agent integration across every tool yet, and the SSO/hardware-key login only works through the browser flow. ## References - Website: https://proton.me/pass - CLI docs: https://protonpass.github.io/pass-cli/ - CLI source: https://github.com/protonpass/pass-cli - CLI announcement: https://proton.me/blog/proton-pass-cli - Source (apps): https://github.com/protonpass - AUR: https://aur.archlinux.org/packages/proton-pass-bin ## Related - [[Proton]] - [[Proton Mail]] - [[Proton Drive]] - [[Proton VPN]] - [[Arch Linux]] - [[Omarchy]] - [[Data Ownership]]