# ADR 004: Proton Pass as the primary password manager

- HTML version: https://robbiepalmer.me/projects/personal-digital-infrastructure/adrs/004-proton-pass-primary-password-manager
- Project: Personal Digital Infrastructure (https://robbiepalmer.me/projects/personal-digital-infrastructure.md)
- Status: Accepted
- Date: 2026-10-21
- Supersedes: personal-digital-infrastructure:001-proton-pass-trial
- Initiatives: Digital Twins for Everyday Life (https://robbiepalmer.me/initiatives/digital-twins-for-everyday-life.md)

# Context

[ADR 001](/projects/personal-digital-infrastructure/adrs/001-proton-pass-trial)
kept Dashlane authoritative while Proton Pass was tested against the daily
paths that matter. The trial has now covered real use rather than a feature
comparison.

Proton Pass filled credentials in an Android application and in Chrome after
Chrome was configured to use Android's selected autofill service. It also
filled browser logins through the Brave extension and retrieved credentials
through the signed-in Ubuntu desktop application. A supervised agent could use
the desktop GUI. A later `pass-cli` 2.5.0 attempt completed browser
authentication and identified the account, but Proton rejected CLI access on
the Free plan and forced logout. Proton lists the
[CLI as a Pass Plus feature](https://proton.me/pass/pricing), so the CLI has not
failed on an entitled account. It remains untested there.

Two separate Proton Free accounts kept their Personal vaults private while a
shared vault propagated edits, revocation, reinvitation, browser autofill, and
Android autofill. The shared vault now contains the household Netflix login.

The production Dashlane CSV export contained 337 rows: 306 logins, 17 Secure
Notes, 11 personal-information records, and 3 payment records. Proton Pass
contains exactly 337 imported items in the Personal vault, plus the one
pre-existing Shared item. Manual checks found the imported values intact. A
separate encrypted-export test preserved the tested login, URL, note, password,
username, and TOTP fields through a round trip. No passkeys existed to migrate.
The TOTP round trip used a synthetic test field. Live codes remain in Authy and
Google Authenticator. The test worked on Free because that plan displays codes
for the [first three 2FA items](https://proton.me/support/pass-family-user-guide).
Paid Pass removes that limit.

The trial has not yet covered macOS, a clean-device recovery drill, hardware
security keys, or emergency access. Those checks affect recovery quality and
the timing of Dashlane cancellation. They no longer block choosing the primary
password manager because the production import, everyday autofill paths,
encrypted export, partner separation, and rollback copy all work.

# Decision

Use Proton Pass as the canonical store for personal passwords, Secure Notes,
payment details, and future passkeys. Stop treating Dashlane as the write
target. Keep its encrypted backup and subscription only through a short
rollback period while recovery and remaining-device checks finish.

Move live TOTP seeds in a separate follow-up. Start with Proton Authenticator
because it is free, imports Google Authenticator directly, and keeps the second
factor outside the password vault. Proton Pass is the convenience option: it
stores a login and its TOTP seed together and can autofill both, but Free only
displays codes for the first three such items. Paid Pass removes that limit.
Keep the Proton account's own TOTP in a separate authenticator, as Proton
requires. Verify each account and store its recovery codes before removing the
old copy.

Each person keeps a separate Proton account and private Personal vault. Put
household credentials in the Shared vault only when both people need them.
Removing someone requires removing their vault membership as well as any plan
membership.

Keep scoped automation tokens, service accounts, and deployment credentials in
Doppler. A supervised agent may retrieve an interactive credential through the
Proton Pass GUI when no scoped token exists. The Free plan does not include the
CLI or agent access tokens. Do not depend on either paid path until sign-in,
expiry, revocation, and audit behaviour pass a later test.

Use the two Free accounts during cutover. If both people need paid Pass
features, choose Pass Family rather than two Pass Plus subscriptions. Do not
buy Proton Unlimited or Duo for the password manager alone. Reconsider those
bundles only when Mail, Drive, or VPN has independent value.

# Alternatives

## Keep Dashlane as the primary password manager

Dashlane already has reliable autofill, but it lacks the tested Ubuntu desktop
and supervised-agent path and costs more than the likely household Proton Pass
option. The Proton trial has now passed the workflows that justified keeping
Dashlane authoritative.

## Keep both managers authoritative

Indefinite dual entry creates ambiguous ownership and stale passwords. Retain
Dashlane only as a time-limited rollback source, not as a second system of
record.

## Buy a broader Proton bundle now

Unlimited and Duo may become good portfolio choices if Proton Mail, Drive, or
VPN also wins its own evaluation. Buying either bundle now would turn unrelated
extras into the reason for choosing a password manager that already works on
Free.

# Consequences

New and changed interactive credentials go into Proton Pass. The imported
Dashlane vault and encrypted rollback backup cover the transition, and the
plaintext CSV transfer file has been deleted.

Chrome on Android must remain configured to use another autofill service or it
will route login fields to Google's password manager instead of Proton Pass.
The Free plan rejected CLI access after successful authentication. This is a
plan limit rather than a failed CLI login. GUI access is the supported agent
path until the paid CLI and access-token paths are tested.

Google Authenticator can export codes for direct import into the free
[Proton Authenticator](https://proton.me/support/import-2fa-codes). Proton
describes Pass as the convenient, autofilling choice and Authenticator as the
[more separated security choice](https://proton.me/blog/authenticator-app).
Authy does not
[support token export](https://help.twilio.com/articles/19753420684059-Export-or-Import-Tokens-in-the-Authy-app),
so each Authy-protected account must have 2FA disabled and re-enabled against
the chosen Proton app. Keep both old apps until every replacement code has
passed a sign-in test.

Dashlane cannot be cancelled until the recovery follow-up proves a clean-device
login, independent recovery material, hardware-key behaviour, and the remaining
devices used in practice. The final cutover must reconcile any credentials
changed during the overlap, take a fresh encrypted rollback export, and then
remove Dashlane autofill and extensions.

---

Markdown index of this site: https://robbiepalmer.me/llms.txt