Securing Proton Pass: two-step login, extra password and locking

Your vault is only as safe as the way you log in. In this article you put three locks on Proton Pass:

• Two-step login on your Proton account. Then your password alone is not enough to log in.
• Optionally, an extra password just for Proton Pass.
• A PIN, fingerprint or face and automatic locking on your devices.

What two-step verification is and which type is the safest, you can read in the lesson Two-step verification: codes, apps and text messages of the Safe online course. Proton calls it Two-factor authentication.

Which methods can you choose?

Proton does not offer a code by text message or email as a second step.

How to turn on an authenticator app

1. Log in at account.proton.me. You do this in your browser, not in the Proton Pass app.
2. Go to Settings, then All settings, and choose Account and password on the left.
3. Under Two-factor authentication, turn on the switch next to Authenticator app and enter your password.
4. Scan the QR code with your authenticator app. If scanning does not work, choose Enter key manually.
5. Enter the six-digit code from the app and confirm.
6. Proton shows your recovery codes. Write them down or print them and keep them with your recovery phrase.

Want the codes on two phones? Then scan the same QR code with both phones straight away.

Adding a security key

1. Go to Account and password again and, under Two-factor authentication, turn on the switch next to Security key.
2. Enter your password, and the code from your app if you already use one.
3. Insert your key into the computer and continue. If you want to use Windows Hello, Touch ID or Face ID, tick Allow platform authenticators. For a separate key, leave it unticked.
4. Touch the button on your key when your browser asks for it, and give the key a name.
5. Repeat this with a second key. Keep that one in a different place.

Not working in Safari? Quit Safari completely and try again, or use a different browser.

Lost your phone or key?

• Use your second phone or second key.
• Or choose Use recovery code when logging in and enter one of your recovery codes. Each code works only once.
• Are you still logged in somewhere? Then in Account and password, choose Lost access to your 2FA device?. With your recovery phrase or a code by email or text message, you then turn off two-factor authentication. After that, set it up again.

Do not store the code for Proton in Proton Pass

Proton itself warns: do not use Proton Pass for the codes of your own Proton account. Otherwise you need your vault to open your vault. Use a separate authenticator app for this. For your other accounts, Proton Pass can store the codes just fine (see Two-step verification codes (TOTP) in your manager).

An extra password for Proton Pass

By default, you open Proton Pass with the password of your Proton account. If you also use that account for mail or files, you can give Proton Pass a lock of its own. The extra password must be at least 8 characters long.

1. In the extension: open the menu with the three lines, choose Settings and the Security tab. Next to the extra password, choose Set extra password.
2. On your phone: go to Profile, tap your account, then the three dots and Manage account. Tap Set extra password.
3. Type the password twice and confirm. You are then logged out on all your devices. Log in again with your Proton password and your extra password.

Please note: If you forget the extra password, you can no longer get into Proton Pass. You can only turn it off if you know it. Write it down and keep it with your recovery phrase.

PIN, fingerprint and automatic locking

Let Proton Pass lock itself when you step away. Then nobody can get to your vault if your laptop or phone is left open.

• In the extension and the web app: go to Settings and the Security tab. Under Unlock with, choose PIN code and pick a six-digit PIN. Under Auto-lock after, set how quickly Proton Pass locks. After three wrong PINs, you have to log in again with your password.
• In the program on your computer: go to Settings and Security and choose a method under Unlock with. Biometrics only works on Windows with a paid plan.
• On Android: go to Profile. Under Unlock with, choose Biometrics or PIN code, and under Auto-lock choose a time, from Immediately to after 4 hours.
• On iPhone and iPad: go to Profile and turn on Face ID or Touch ID. Under Auto-lock, choose how quickly the app locks.

Tip: On your laptop, choose a short time, for example 15 minutes. On your phone, Immediately works fine: you open the app with your face or finger anyway.

Checking your recovery options

In your account settings, go to Recovery. This is where you arrange how you get back in if you forget your password:

• Recovery phrase: twelve words. With it you get back both your password and your vault. If you did not save it when you created your account, choose Generate recovery phrase.
• Recovery email address and Recovery phone number: with these you set a new password, but your saved passwords then stay locked.
• Recovery file: a file that lets you open your data again after setting a new password.

At the very least, turn on the recovery phrase and a recovery email address that is not with Proton. What exactly you can do if you forget your password, you can read in Forgot your master password? What you can still do.