Google Password Manager vs Proton Pass Comparison

• Pass Plus (individual, annual): $35.88/year
• Pass Family (up to 6 users, annual): $59.88/year

Source-code review and gray-box testing of the browser extensions, mobile and desktop apps, and CLI

Passwords are encrypted in transit and storage, but by default the key sits in your Google Account; on-device encryption, once set up, leaves the key with you only and cannot be removed. Passkeys are always end-to-end encrypted, unlocked with a screen lock or a Google Password Manager PIN.

Vault and item data are encrypted with 256-bit AES-GCM under 32-byte random keys; the user key is protected by a bcrypt hash of the account password. Authentication uses a hardened SRP implementation; sharing uses OpenPGP with ECC (Curve25519). Every field is encrypted client-side — usernames, URLs and notes included — so Proton cannot see which services you hold accounts with. Offline access on paid plans uses Argon2 for the local hash.

A feature of Google Accounts, Chrome and Android rather than a separate product; the data controller named in Google's privacy policy is Google LLC, Mountain View, California.

Proton AG, Geneva, Switzerland. Since June 2024 the primary shareholder is the non-profit Proton Foundation, which the founders endowed with Proton shares in an arrangement they describe as irrevocable. Proton began as a 2014 crowdfunding campaign.