Proton Pass is adding folders for organizing saved items, URL matching to control password autofill, and alerts for passwords found in known breaches. Proton says the features are reaching users gradually over the next few days, with access for all users to follow soon. Folder creation requires an eligible paid subscription, while people on free plans can use folders inside vaults shared with them by paid subscribers.
The eligible personal subscriptions are Proton Pass Family, Proton Unlimited and Proton Pass Plus; business subscriptions also qualify. Proton Pass Professional and Proton Workspace are among the supported business options. Pass Essentials users face the same folder creation restriction as free users, so receiving a shared folder does not give either group permission to create their own.
Folders let users group items inside a vault and build a hierarchy with subfolders, giving them another way to separate credentials without adding vaults. Users can move saved items between vaults or folders by dragging them, and narrow searches or filters to a folder and the subfolders beneath it. Sharing remains controlled at the vault level for now, and Proton lists folder sharing on its roadmap.
The URL matching controls let users limit autofill to a particular host, cover a parent domain and its subdomains, or turn it off for a chosen URL. More advanced matching accepts regular expressions and wildcard patterns for users who need more specific rules. Users can also select the fields Proton Pass fills, giving them control over which information goes into a form as well as where autofill operates.
For password protection, Proton Pass checks a password's fingerprint against fingerprints associated with known breaches that security researchers have published. A matching fingerprint triggers an alert so the user can replace the affected password. Proton says this comparison runs on the user's device and does not give its staff access to passwords or other contents of a vault.
The compromised password check expands protection checks that already flag reused or weak passwords and email addresses exposed in breaches.
