Reusing passwords is the number-one way one leaked website turns into a dozen hacked accounts. A password manager fixes that — it generates a long, random password for every login and fills them in for you. Proton Pass is free, open-source and end-to-end encrypted. Here's how to set it up.
What you'll do
- Install Proton Pass and the browser extension
- Import the passwords you already have
- Let it generate strong, unique passwords from now on
- Lock it down with a strong master password and 2FA
About ten minutes — then it works quietly in the background.
Why a password manager?
Nobody can remember a unique 16-character password for every site — so most people reuse a few. A manager remembers them for you, so every account gets its own strong password. It's the biggest single improvement you can make to your everyday security.
Set it up, step by step
1
Install Proton Pass
Get the app for your phone and the browser extension for your computer from proton.me/pass. The extension is what makes autofill effortless. It's free and works on every major browser and platform.
You can use it with your existing Proton account, or create one in a couple of taps.
2
Import your existing passwords
Bring over the logins you already have so everything lives in one place. In Proton Pass open Settings → Import and pick your source — your browser (Chrome, Safari, Firefox, Edge) or another manager (1Password, LastPass, Bitwarden and more).
After importing, delete the passwords saved in your browser so they aren't left sitting there unencrypted.
3
Let it create strong passwords
From now on, when you sign up or change a password, let Proton Pass generate a long, random one and save it. Next time you log in, the extension fills it automatically — you never type or remember it.
Work through your most important accounts first (email, banking) and replace any reused passwords with fresh generated ones.
4
Lock down your vault
Your vault is only as safe as the account protecting it. Set a strong, unique master password and turn on two-factor authentication on your Proton account.
- Use an authenticator app for that second step, not SMS
- Set an account recovery method so you're never locked out
Don't lose your master password
Proton Pass is end-to-end encrypted, which means not even Proton can read or reset your vault. If you forget your master password without a recovery method set, your saved logins can't be recovered — so set up account recovery now.
Frequently asked questions
Is Proton Pass free?
Yes — the free plan covers unlimited logins and devices. Paid plans add extras like more vaults and built-in email aliases, but you don't need them for the core protection.
How is it secure?
Your vault is end-to-end encrypted, so everything is scrambled on your device before it's stored. Only you, with your master password, can unlock it — not even Proton can see inside.
Can I import from Chrome or another manager?
Yes. Proton Pass imports from all major browsers and from managers like 1Password, LastPass and Bitwarden via Settings → Import.
Does autofill work on my phone?
Yes. Install the app and turn on Proton Pass as your autofill provider in your phone's settings, and it fills logins across your apps and browser.
How is this different from Proton Authenticator?
Proton Pass stores your passwords (and can store 2FA codes too). Proton Authenticator is a dedicated app just for two-factor codes. Many people use Pass for passwords and keep their second factor separate in Authenticator.
What to do next
Put it to work
Use your new manager to give every important account a strong, unique password — starting with your email, the key to everything else.
Secure your Gmail accountAdd a second factor
Pair strong passwords with app-based two-factor, so a leaked password alone can never get someone in.
Set up Proton AuthenticatorWas this guide helpful?
Know someone who needs this? Send them the guide.
JD
Written by
Jordan DicksonFounder, CyberSecurityGuides
Founder of CyberSecurityGuides, writing practical, jargon-free guides that help everyday people recover from and protect against online attacks.
Reviewed by CSG Security Engineers