Proton Pass beats expectations in independent security audit
Password manager Proton Pass has passed a security audit by an external security firm with flying colors.
Sign in page. Photo by Jakub Porzycki/NurPhoto via Getty Images
Password manager Proton Pass has passed a security audit by an external security firm with flying colors.
Recurity Labs tested the browser extensions, mobile apps, desktop apps, and Command Line Interface (CLI) for Proton Pass.
The security consultancy agency examined Proton’s password manager between January and April 2026 and found that Proton Pass’s overall security to be “well above par.”
“As an overall verdict, while numerous issues were identified in the course of this assessment, the majority of the observations are of low impact, and the sole medium severity issue has already been mitigated, allowing us to rate the solution’s overall security posture as well above par,” Recurity Labs’ report says.
Check if your data has been leaked
The firm found no remote exploits and couldn’t identify any encryption bypasses, such as shortcuts, backdoors, or weak keys, that could circumvent encryption layers.
“The absence of a specific exploitation path identified for certain findings as part of this assessment must not be interpreted as proof that none exist, particularly in light of future development and potential changes to execution context. Mitigation is therefore still recommended,” the report continues.
Researchers did come up with several recommendations that focused on strengthening practices, like how secrets are managed in memory while the app is running, runtime security hardening, and implementation practices outside the core threat model.
Proton says it takes the findings seriously and has implemented fixes for these vulnerabilities.
“Security audits are primarily an opportunity to test and improve our implementations. We’re grateful to the auditors at Recurity for helping us identify several areas for improvement beyond the core security requirements,” Son Nguyen Kim, developer at Proton, says in a statement.
Proton has over 100 million people using its services like Proton VPN, ProtonMail, and Proton Drive. The company offers a strict no-log policy, end-to-end encryption, and zero-access encryption, meaning that not even Proton itself can access your data.
Proton claims to have over 6,000 VPN servers in approximately 100 countries.
Unlock exclusive Cybernews content on YouTube.