Proton Pass stores logins, payment cards, secure notes, email aliases and two-factor secrets in encrypted vaults. Each vault has its own encryption key and can separate personal material from a shared collection. A login can contain website addresses, a username, password, TOTP secret and custom fields. Proton Pass changes saved vault items; it does not change the account or password at the website those items describe.
Vault visibility controls search and filling
Hiding a vault removes its items from search and autofill until the user makes the vault visible again. The credentials remain stored, but an apparently missing login can simply belong to a hidden vault. Restoring visibility returns those items to the ordinary lookup path.
The desktop application separates vault navigation, item lists and details. Under the documented plan conditions, locally cached data can remain readable without a network connection. Offline access does not send a changed password to its website or prove that another device has synchronized the latest vault state.
Sharing grants roles over a complete vault
A shared vault can give an invited participant view, edit or administrator access. View access permits reading the shared items, edit access permits changes, and administrator access controls membership or higher-level vault actions. Moving a credential into that vault changes who can reach it.
A participant can copy a viewed password outside Proton Pass. Removing access later does not erase copies already retained by the recipient. The vault role controls the encrypted shared collection, not every action a human can take after viewing a secret.
Email aliases forward without exposing the mailbox
An alias receives mail at a generated address and forwards it to a selected mailbox. The sender sees the alias instead of the destination mailbox address. Proton Pass can manage those aliases beside login records, but the alias address itself cannot be edited after creation.
Deleting an alias enters a recovery path only for the available recovery window. Permanently deleting it, clearing it from Alias Trash or letting that window expire removes the route back to that address. Messages sent afterward cannot reach a mailbox through an alias that no longer exists.
SimpleLogin aliases can synchronize into Proton Pass. Once that synchronization starts, the documented workflow does not allow it to disconnect. This makes the decision broader than importing a static list that can later be separated.
Import and export create migration copies
Proton Pass imports supported password-manager data and can export an account backup. Import does not update the corresponding accounts on the web, and duplicate or outdated records can enter the vault with the source data. An exported backup becomes another sensitive object outside the live vault. Its storage and deletion need the same care as the credentials it contains.
