1. User Story

As a security-conscious Proton user with a unified subscription (including Mail, Calendar, Drive, and Pass),

I want the option to permanently and cryptographically split my Proton Pass credentials and identity from the rest of the Proton ecosystem,

So that even if my primary Proton account (Mail/Calendar) is fully compromised, or if its emergency recovery credentials and passphrases are abused, my Proton Pass vault remains entirely isolated, uncompromised, and inaccessible to the attacker.

1. Background & Strategic Rationale

Currently, the Proton ecosystem operates on a unified identity provider (Single Sign-On) and account recovery framework. While this provides convenience, it introduces a critical single point of failure (SPOF).

Proton currently offers local locks or secondary password options for Proton Pass, but these are ultimately bound to the same root account identity. If an attacker gains full administrative control over the primary Proton account, they can abuse emergency user credentials, recovery keys, or primary passphrase reset flows. Because the underlying identity is shared, these recovery mechanisms can bypass or override the secondary safeguards, exposing the user’s entire Proton Pass vault.

To achieve true zero-trust isolation, high-security users need the ability to execute a permanent credential split. This ensures that Proton Pass acts as a completely independent cryptographic entity with its own distinct identity, authentication database, and recovery lifecycle—while still preserving the commercial value of their unified subscription.

1. Core Architectural Approach: Permanent Separation

Rather than relying on a secondary application-level password that sits on top of a shared account, Proton should implement a backend-enforced, permanent decoupling of the identity database for Proton Pass.

[Unified Proton Account] ──(Permanent Split Rule)──► [Proton Mail/Calendar/Drive] (Credentials A)
└──► [Proton Pass Vault] (Credentials B)
* Billing Link Only (Tokenized)

How it works:

Cryptographic Decoupling: The user opts to split their identity. Their Proton Pass vault is migrated to a completely separate set of credentials (new username/email identifier and a unique, isolated master password). *user may optionally chose to use the same username/email but must use a different password.

Subscription Tokenization: To prevent users from having to pay twice, the billing engine links the two distinct accounts via a non-identifying cryptographic token. This verifies that "Credentials B" is entitled to the premium Proton Pass features paid for by "Credentials A," without sharing any authentication or recovery pathways.

No Recovery Overlap: The emergency recovery channels (recovery email, phone, recovery phrase, or PEM keys) for the primary Mail account have zero authority over the Proton Pass account.