Feature Request: Automated Batch Password Reset During Security Incident
Problem Statement
In the event of a suspected vault compromise, changing the master password alone doesn't protect previously saved credentials. Users face a critical window of vulnerability where attackers could use stored passwords before individual account changes are made. Manually resetting hundreds of passwords across different services is time-consuming and error-prone during an emergency.
Proposed Solution: Password Reset Sequences (PRS)
Enable a batch password reset function within Proton Pass that automatically navigates users through password reset flows for all vault entries. This would execute as an automated sequence for each account:
Navigate to the target website's login page
Auto-fill username and current password
Log in and navigate to the account's password reset page
Fill in current password (if required)
Generate and populate a new strong password using existing rules
Save the updated credentials back to Proton Pass
Update vault history with the old password before overwrite
Technical Requirements
URL Sequence Storage: Per-site reset flow URLs stored as metadata on each vault entry
Validation Mechanism: Crowd-sourced verification of reset URLs (upvoting system) to prevent phishing risks
Password Policy Mapping: Store per-site password requirements (length, characters, etc.) to generate compliant new passwords
Cloud Sync: PRS templates available across all licensed user devices
Fallback Mode: Allow manual recording/resetting if no PRS exists for a particular service
Community Contribution Model
Encourage users to create and share validated reset sequences:
Display indicator when a working PRS is available for an account (similar to rich icon downloads)
Reward high-quality submissions with reputation or credit toward premium features
Version tracking for websites that change their reset workflows
Security Benefits
Rapid incident response: Reduce time from breach detection to credential protection
Comprehensive coverage: Ensure all stored credentials are rotated, not just the master password
Audit trail: Maintain password history during rotation for rollback if needed
Phishing prevention: Validated community URLs reduce risk of malicious reset pages
Implementation Feasibility
Given Proton Pass's existing autofill capabilities, extension infrastructure, and form-filling technology, this builds directly on proven functionality. The core challenge is workflow automation and URL sequence management rather than novel technology.