Proton Pass may have security and access control issues. The app's behavior on mobile devices, in particular, poses a security risk. This risk becomes apparent if someone gains access to your home PC or mobile phone.

I use the "Proton Unlimited" plan.

The fact that Proton Pass, in plans like "Proton Unlimited," doesn't offer properly separated vaults or an additional layer of security—such as requiring a strong password for highly sensitive data, as implemented by Bitwarden—to distinguish between sensitive and non-sensitive information is a serious problem. This issue is exacerbated by the fact that the default configuration doesn't require an additional, strong password for the vault. Once Proton Mail is opened, access to the vault is unrestricted on both the PC and the app.

Even with an additional password and a browser setting to close the vault after a certain number of minutes, the mobile app remains highly insecure. This option simply isn't available on the app. Once opened, the vault remains open until the phone is restarted. In the ProtonPass app on my phone, I can force automatic vault closure under the "Security" option, but only if I also enable a PIN or biometric authentication. A PIN would need to be around 20 digits long to be comparable to a 16-digit password. Biometric authentication, on the other hand, is highly insecure because it can be coerced. Only Proton knows why this automatic locking feature isn't implemented for the strong password in the app.

Okay, one could use a shorter PIN, since the app requires the strong password after three incorrect attempts. Two-factor authentication (2FA) isn't suitable because these codes are also stored on the phone (meaning there aren't two independent devices).

No matter how you look at it, if all passwords are stored in a single vault and the app remains open after the initial unlock on the phone without any enforced lock, it undermines the security of a strong additional password.

Without automatic locking of the vault on my phone (without having to activate biometrics or a PIN), without a forced second password, and without separating truly sensitive data from the data I use daily to quickly log into websites or apps, this app poses a security risk I cannot accept. For this reason, I cannot use ProtonPass.

A solution to these vulnerabilities would be simple:

(a) Multiple vaults should be provided.

(b) An app lock should also be available for the additional password, without requiring biometrics or a PIN.

(c) The additional password and automatic vault locking should be the default setting.

I also make mistakes. If I overlooked something despite careful review, I apologize. My starting point for this criticism was that I copied my data from Bitwarden to ProtonPass and only realized after a few days that it was constantly exposed on my phone. ProtonPass was not locked. All my alarm bells went off. My workaround (besides the additional strong password) is an extra (strong) PIN on my phone. I doubt I'll stick with Proton Pass because I miss the extra layer of security Bitwarden provides.

Proton Support responded promptly. I notified them before posting this. However, their response is unsatisfactory. Ultimately, they simply stated that Proton Pass isn't suitable for my needs, without addressing the problems I outlined with the app.