Proton Pass

Proton Pass is the password manager from Proton, the Swiss company behind Proton Mail and Proton VPN. Items are kept in vaults and synced through your Proton account; Proton states that “All data stored in Proton Pass, including credentials, passwords and notes, are end-to-end encrypted and Proton does not possess the ability to decrypt end-to-end encrypted data.” The app’s code is open source.

What it does

From Proton’s support pages:

• Logins, passkeys, credit cards, notes and passwords in vaults, with a password generator and alerts for weak or reused passwords.
• Autofill, once you set Proton Pass as Android’s password manager. Cards can’t be filled in yet: “To use saved card details, you’ll need to copy your details from Proton Pass and then paste them into your checkout.”
• Passkeys on Android 14 and later.
• Hide-my-email aliases: “Hide-my-email aliases let you receive emails from websites without them knowing your primary email address.” Proton’s privacy policy notes that alias addresses “are not encrypted”, so that mail can be forwarded.

F-Droid’s build

F-Droid builds this version from Proton’s source and signs it itself. Compared with Proton’s own builds, from the code of this version:

• No Sentry. The crash-reporting library is left out of the F-Droid flavour; a comment in the code says “we cannot import it on fdroid in order not to include the Sentry SDK in the build.”
• Usage statistics are switched off for good, and so are the install-referrer, in-app update and in-app review components.
• No purchases inside the app.

F-Droid marks the app with two anti-features, in its words: “The backend is proprietary.” and “Relies on Proton’s servers.”

What goes online

The app syncs with Proton’s servers, as a password manager tied to an account does. From the code of this version, it also:

• Sends Proton’s technical metrics, from the observability component of Proton’s shared app libraries, which are switched on in this build; we found no setting for them.
• Checks your passwords against known breaches when you save a login and once a week, sending only the first 6 characters of each password’s SHA-1 hash to Proton’s credential-check server.
• Asks the websites saved in your logins for their app-link file (assetlinks.json), a minute after starting and then every 14 days. The setting describes it as establishing “website ownership verification between an Android app and a website”. Each of those sites sees a request from your phone. Enable Digital Asset Links in the settings turns this off.

Proton also says its apps can reach its servers through third-party DNS services when they detect that Proton is blocked.

About this file

• This is Proton Pass 1.41.4, whose changelog says only “Bug fixes and improvements.” F-Droid added it on 18 October 2026. It is F-Droid’s build, signed with F-Droid’s key, from the source code of that release.
• The 105.1 MB file runs on 64-bit ARM, 32-bit ARM and 64-bit x86, and needs Android 8.1 or later. It declares 14 permissions, among them the camera, the list of installed apps, and biometric unlock. Our scan found no trackers.
• Proton Pass is licensed under the GPL-3.0 or later.
• The app is translated into Brazilian Portuguese.
• The screenshots are Proton’s promotional images, from F-Droid; they show an older version of the app.

Flagged by F-Droid:

• NonFreeNet: Relies on or promotes a proprietary network service.
• TetheredNet: Uses a network service run by the developer.

CPU types in this build: arm64-v8a (64-bit ARM, almost every phone since 2017); armeabi-v7a (32-bit ARM, older and budget phones); x86_64 (64-bit Intel, emulators and Chromebooks).

Versions currently kept in the F-Droid repository. We host and check only the newest one. Full changelog.