Chrome Web Store
104Versions
1Code reviewed

No malware found

In code review (v1.37.2)

Our reviewer read version 1.37.2 — the most recent version we have reviewed — and found no malicious behaviour. The version shown here has not been individually reviewed yet.

What our analysis found

Proton Pass: Free Password Manager, used by 2,000,000 people, showed no malicious code in Extension Auditor's review. Its permissions mean it can inject scripts into pages and can observe network requests. It comes from a trusted publisher and was last updated in October 2026.

Analyst notes

This is Proton Pass, a legitimate password manager by Proton, a trusted privacy-focused company. The source code uses standard open-source libraries for encryption (OpenPGP, Argon2), form detection (Fathom-based), and autofill, with network requests going exclusively to Proton's own domains. Permissions like scripting, webRequest, and clipboard are required for password management features. There is a minor manifest permission discrepancy (offscreen, webNavigation, optional not fully reflected in the CWS summary), but this does not indicate malice and is likely a listing oversight. The ML model gave a low risk score (0.00), and publisher reputation is high.

Proton Pass: Free Password Manager

Proton Pass: Free Password Manager Chrome extension security report

ID: ghmbeldphafepmbegfdlkpapadhbakde

Supported Languages

🇺🇸English

Extension Info & Metadata

Status
Active
Version
1.42.0
Size
8.02 MB
Rating
4.8/5
Reviews
6,700
Users
2,000,000
Type
Extension
Updated
Oct 9, 2026
Category
Workflow & planning
Price
Free
Featured
Yes
Visibility
Listed
Mature
No
By Google
No
Trusted
Yes
This publisherTrack record
4extensions
1 no longer listed
Scanned by Extension Auditor — Low RiskDevelopers: embed this badge to link to this report.

Publisher Contextual Analysis

Trusted
Author
Proton AG
Country
CH
MX records exist
Yes
Domain exists
Yes
Is disposable
No
Is role-based
Yes
Mailbox exists
Yes
Address
Rte de la Galaise 32 Plan-les-Ouates 1228 CH
Website
Visit
Extensions
4
Active
3
Obsolete
1
Listed
4
Unlisted
0
Users
4,132,555

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Screenshots & videos

Screenshot 1
Screenshot 2
Screenshot 3
Screenshot 4
Screenshot 5

Install growth

Item
Type
Severity
Description
scripting
Permission
Critical
This permission allows injection and execution of JavaScript on any webpage. Rated Critical because it can modify page content, steal sensitive data, and inject malicious code into any site the extension has access to.
webRequest
Permission
Critical
This permission enables the extension to monitor and analyze all web requests made by the browser. Rated Critical because it can observe all network traffic including sensitive data, track browsing behavior, and gather authentication tokens.
https://*/*
Host
Critical
Broad host access — the extension can read/modify content on every website.
http://*/*
Host
Critical
Broad host access — the extension can read/modify content on every website.
offscreen
Permission
High
This permission creates hidden browser documents with full DOM access. Rated High because it can run background operations invisibly, potentially executing malicious code without user awareness.
webNavigation
Permission
High
This permission enables monitoring of all browser navigation events and transitions. Rated High because it can track every page visit, navigation method, and browsing pattern, potentially exposing sensitive browsing behavior and user activities.
Contextual Risk Factors
Risk Factor
High
The following context increases the overall risk: • 10% increase: Early script execution enables pre-emptive content manipulation • 25% increase: Unsafe code evaluation capabilities increase attack surface
Unsafe WebAssembly Execution
Risk Factor
High
This extension's CSP allows "wasm-unsafe-eval".
activeTab
Permission
Medium
This permission grants temporary access to the current tab. Rated Medium because it can access current page content when invoked, though limited to user-initiated actions.
storage
Permission
Medium
This permission allows storing data locally in the browser. Rated Medium because it can persist sensitive user data, track user activities over time, and potentially store malicious payloads.
unlimitedStorage
Permission
Medium
This permission removes storage quota restrictions. Rated Medium because it can store large amounts of user data without limits, potentially impacting browser performance and storing extensive tracking data.
Early Content Script Execution
Risk Factor
Medium
This extension runs content scripts at document_start.
alarms
Permission
Low
This permission schedules periodic tasks. Rated Low because it can only trigger events at specified times without access to sensitive data.

About this extension

Free and fully encrypted password manager to keep your logins and passwords safe.

Read the publisher’s full description

Free and unlimited password manager to keep your login credentials safe and manage them directly in your browser. Get the password manager created by the former scientists who met at CERN behind Proton Mail, the world’s largest encrypted email provider. Proton Pass is open-source, end-to-end encrypted, and protected by Swiss privacy laws. Pass offers more than other free password managers and has no ads or data collection. You can use it for free forever on all your devices to create and store unlimited passwords, autofill logins, generate 2FA codes, create email aliases, secure your notes, and more. * Protect your logins and their metadata with battle-tested end-to-end encryption While many other password managers only encrypt your password, Proton Pass uses end-to-end encryption on all your stored login details (including your username, the website address, and more). * Audit Pass’s open-source code Like all other Proton services, Pass is open source and built on the principle of trust through transparency. As scientists, we know that transparency and peer review lead to better security. All Proton Pass apps are open source, meaning anyone can verify our security claims for themselves. * How can Proton Pass be free forever? We offer Pass for free because everyone deserves online privacy and security. This is possible thanks to our supportive community on paid plans. If you would like to support our work and get access to premium features, consider upgrading your plan. * Protect more than just your passwords. Join over 100 million people who have signed up for Proton’s privacy ecosystem, which includes Proton Mail, Proton Drive, Proton Calendar, Proton VPN, and more. Take back control of your privacy online with our encrypted email, calendar, file storage, and VPN. With Proton Pass, you can: - Store and auto-sync unlimited logins on unlimited devices: You can create, store, and manage your credentials from anywhere with our browser extension and apps for Android and iPhone. - Sign in faster with Proton Pass autofill: You no longer need to copy and paste your username and password. Easily and securely log in with Proton Pass autofill technology. - Avoid weak passwords: With our built-in secure password generator, you can easily generate strong, unique, and random passwords based on the security requirements for every website you sign up to. - Safely store encrypted notes: You can save private notes in Pass and access them on all your devices. - Create unique email addresses with hide-my-email aliases: Proton Pass helps you hide your personal email address with email aliases. Keep spam out of your inbox, avoid being tracked everywhere, and protect yourself from data breaches. - Make 2FA easy with our built-in authenticator: With Pass’s integrated 2FA authenticator, using 2FA is finally fast and convenient. Easily add a 2FA code for any website and use it when you log in. - Easily organize and share your sensitive data with vaults (paid feature): Manage your logins, secure notes, and email aliases with vaults. In the next version of Pass, you’ll be able to share vaults with your family, friends, or colleagues. - Quick offline access to your login data: Access your stored passwords and notes in Pass from wherever you are, even when you don’t have internet connection. - Secure your Pass account with additional security measures: Protect all your data with another layer of protection, either with TOTP or U2F/FIDO2 security keys. For more information, visit: https://proton.me/pass Learn more about Proton: https://proton.me

User reviews

Extension files

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No network indicators were extracted from this version.

Version
Size
Verdict
Findings
Permhash
1.42.0
Latest
8.02 MBNot scanned—
365eaa363168c333bb4a5ed506ae15c4efb5f839b02a3741eb215b40e3c4a3af
1.41.1
8.03 MBNot scanned—
365eaa363168c333bb4a5ed506ae15c4efb5f839b02a3741eb215b40e3c4a3af
1.41.0
8.03 MBNot scanned—
365eaa363168c333bb4a5ed506ae15c4efb5f839b02a3741eb215b40e3c4a3af
1.40.2
8.14 MBNot scanned—
365eaa363168c333bb4a5ed506ae15c4efb5f839b02a3741eb215b40e3c4a3af
1.40.1
8.14 MBNot scanned—
365eaa363168c333bb4a5ed506ae15c4efb5f839b02a3741eb215b40e3c4a3af
1.34.1
7.79 MBNot scanned—
365eaa363168c333bb4a5ed506ae15c4efb5f839b02a3741eb215b40e3c4a3af
1.34.2
7.80 MBNot scanned—
365eaa363168c333bb4a5ed506ae15c4efb5f839b02a3741eb215b40e3c4a3af
1.39.0
8.08 MBNot scanned—
365eaa363168c333bb4a5ed506ae15c4efb5f839b02a3741eb215b40e3c4a3af
1.38.2
7.66 MBNot scanned—
365eaa363168c333bb4a5ed506ae15c4efb5f839b02a3741eb215b40e3c4a3af
1.38.0
7.66 MBNot scanned—
365eaa363168c333bb4a5ed506ae15c4efb5f839b02a3741eb215b40e3c4a3af
Showing 1 to 10 of 110 rows
Rows per page:

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Popular in Workflow & Planning