Skip to content
CUNICULA

Proton Pass

End-to-end encrypted password and identity manager from Proton AG with encrypted vault fields and metadata, open-source clients, passkeys, sharing and hide-my-email aliases.

proton.me

End-to-end encrypted password and identity manager from Proton AG with encrypted vault fields and metadata, open-source clients, passkeys, sharing and hide-my-email aliases.

Common usePassword and passkey storagePrivacy ToolsOperator dataUnknown
Identity checksZero KYCNo document check recorded · identity exposure level 0/4
Evidence and riskPartial evidenceCautionSome material claims still need confirmation.; those sources show trade-offs worth reading.
Last reviewedReviewed 25 Oct 2026KYC checked 25 Oct 2026 · verified jurisdiction · Source → official siteHow to cite this pageSource coveragePartial evidenceRecorded riskCaution
Evidence and facts

Evidence and facts

CUNICULA SCORE 4.0
37/100Limited evidencePrivacy 12/25 · Control 0/20 · Transparency 0/20 · Security 17/25 · Accountability 8/10 · Cap 69 · Method
JURISDICTIONCH
CAUTIONVault contents and vault metadata are end-to-end encrypted. Account and payment records remain. Alias addresses are readable, and alias functions use SimpleLogin's contracted cloud servers.
AUDITED BYCure53
OPERATOR DATAUnknown
SOURCE COVERAGE
Partial evidenceINDEPENDENT AUDIT1/7Reviewed 25 Oct 2026 · Source → official site
LAST CHECKED2026-10-25
LAST UPDATED2026-10-25

Specs

DOCUMENT CHECKNone recorded
IDENTITY EXPOSURELevel 0/4
KYC TRIGGERSA Proton account is required. Captcha, email or SMS checks may be requested. Payment options vary by platform; Bitcoin requires upgrading an existing free account.
FEEFree plan; paid prices vary by billing cycle and current offer.
NETWORKSWeb, Browser extensions, Windows, macOS, Linux, Android, iOS, CLI
CATEGORIESPrivacy Tools
COMMON USESPassword and passkey storage, Email aliases, Cross-device password management
FEATURESEnd-to-end encrypted vaults, Encrypted metadata, Open-source apps, Independent Cure53 audit, Passkeys, Hide-my-email aliases, Secure vault and item sharing, Dark web monitoring, +2 more
TORNot listed
REGIONSGlobal availability
Review analysis, source material, related services, and history

Analysis

OVERVIEW

Vault items and vault metadata are end-to-end encrypted. The apps are open source, Cure53 has audited them, and the product combines passwords, passkeys, aliases, and sharing.

LIMITS

Vault contents and vault metadata are end-to-end encrypted. Account and payment records remain. Alias addresses are readable, and alias functions use SimpleLogin's contracted cloud servers.

USEFUL FOR

Password and passkey storage with built-in email aliases across browser, desktop, and mobile apps.

Corporate identity

Registry-sourced, not audited. The facts below come from cited web research rather than a direct registry query. Each claim links its own source.

LEGAL ENTITY
Proton AGsource ↗
INCORPORATED IN
Switzerlandsource ↗
REGISTERED ADDRESS
Route de la Galaise 32, 1228 Plan-les-Ouates, Geneva, Switzerlandsource ↗
Registry research · reviewed 2026-08-08

Ownership chain

Who owns the operator, read from the public register. Each step says what kind of evidence it rests on: a registry record can be checked, a company statement cannot.

  1. OPERATORProton AGCHE-354.686.492 · Switzerland
  2. PRINCIPAL SHAREHOLDERFondation ProtonCHE-418.863.304 · SwitzerlandCOMPANY STATEMENT

    As Proton's primary shareholder, the foundation exercises its control to ensure that Proton does not deviate from our mission. No change of control of Proton can occur without the consent of the Foundation.

    Both entities are registry-confirmed, but the shareholding between them is not. Swiss law does not require a company to publish its shareholders, so this edge rests on Proton's own account of its governance and cannot be checked against Zefix.

    Proton Foundation governance page ↗

The chain stops here because the register stops, not because the top was reached. Swiss and Swedish companies do not publish their shareholders, and a Czech joint-stock company does not list its own. Nothing above the last step should be assumed either way.

SAME OPERATOR

Proton AG also runs 3 other services shown here. Comparing them compares products, not independent companies.

WHAT IT USED TO BE
  • Proton Technologies AGrenamed 2021-09-30REGISTRY RECORD

    Renamed by the same legal person, not a new company. The Swiss Official Gazette entry of 18.10.2021 reads 'Nouvelle raison sociale: Proton AG', with the statutes modified on 30.09.2021. The UID is unchanged either side of the rename, which is what proves it is one entity.

  • ProtonVPN AGabsorbed 2020-06-30REGISTRY RECORD

    Recorded on both sides of the register: Proton AG lists ProtonVPN AG under companies taken over, and the ProtonVPN AG record names Proton AG as the entity that took it over. The VPN product has had no separate company since.

We wrote about this

Frequently Asked Questions

Is identity verification required?

No identity verification is recorded for typical use. A Proton account is required. Captcha, email or SMS checks may be requested. Payment options vary by platform; Bitcoin requires upgrading an existing free account.

Which payment methods are accepted?

Accepted payment methods: Web, Browser extensions, Windows, macOS, Linux, Android, iOS, CLI.

Where is it available?

Recorded availability: GLOBAL.

Is the operator based in a Five Eyes country?

No. The recorded jurisdiction is CH, which is not a Five Eyes country. This is jurisdiction context and does not by itself establish that a service is safer or less safe.

How are identity, operator, and evidence fields reported?

Identity exposure is level 0 of 4. Hosted operator data has not been established. Jurisdiction is shown as context, not a safety verdict. Source coverage is partial evidence, last reviewed 2026-10-25, and recorded risk is caution.

Which payment networks are supported?

Accepted networks: Web, Browser extensions, Windows, macOS, Linux, Android, iOS, CLI.

Related Services

Sources and history

Terms and privacy policy

No changes to the documents we watch since we started checking on 9 Aug 2026. Last checked 9 Aug 2026.

Evidence basis: Claims on this page are linked to published sources for comparison, not certification, audit, endorsement, or recommendation; read the methodology and coverage map before relying on an entry.