Proton Pass Data Export: Encrypted, But Not From Your Phone
The only password manager here offering a PGP-encrypted archive, in a standard other tools can read. The catch: export does not work on mobile at all.
Exit score: 25 / 30
How hard Proton Pass makes it to leave with your data intact, scored against 6 criteria from the vendor's own published documentation. How we score.
| Criterion | Score | What the documentation says |
|---|---|---|
| Self-service | 3/5 | No request or admin gate, but a hard platform restriction: "You cannot export data using the Proton Pass mobile apps." Export requires the browser extension, web app or Windows app. |
| Format openness | 5/5 | The best format position of any password manager here. A PGP-encrypted ZIP containing JSON - PGP is an open standard and JSON is structured, so the archive is both safe to store and machine-readable. Only Bitwarden matches it here. |
| Completeness | 3/5 | JSON can represent nested item types that CSV cannot, which is structurally promising. But the documentation does not enumerate what is included, so completeness is inferred from the format rather than stated. |
| Not paywalled | 5/5 | No plan tier is named as a requirement. Consistent with Proton's stated position on data portability, and export appears available to free accounts. |
| Documentation clarity | 4/5 | States the three formats and the platform restriction plainly, which is more than most manage. Deducted for not listing which item types travel in each format. |
| Caps and expiry | 5/5 | No item limits, size ceilings, throttles or expiry windows are documented anywhere in the export article. |
What comes out
- A PGP-encrypted ZIP containing JSON - safe to store and structured enough to parse.
- An unencrypted ZIP, for when the destination cannot handle PGP.
- A CSV, for importing into password managers that expect a flat file.
- Structured nested data, which JSON can carry and CSV cannot.
What stays behind
- Any export at all, if you only use Proton Pass on a phone - the mobile apps cannot export.
- Certainty about item coverage, since the documentation does not enumerate what each format holds.
- Vault sharing configuration and group membership, which are account state rather than item content.
- Anything the receiving product cannot parse from Proton's JSON schema, which is specific to Proton.
Only Bitwarden scores higher among password managers, and Proton Pass gets close on the strength of one design decision that most of the category has not made.
Proton Pass will give you an encrypted export in a format other tools can read.
A PGP-encrypted ZIP containing JSON. Not a proprietary blob that only Proton understands, and not a plaintext file that anyone understands. An open encryption standard wrapped around structured data — which is exactly what an export of a password vault should be, and only Bitwarden offers anything comparable.
Why the encryption matters more than it sounds
Every other password manager report on this site spends most of its length on the same problem: the export is a readable list of every credential you own, and you must destroy it quickly.
That problem does not exist here, if you choose the encrypted format.
You can export your Proton Pass vault, put the file on an external disk, and leave it there for five years. It is not a liability sitting in a folder. It is a backup, in the ordinary sense that every other kind of software takes for granted and password managers usually cannot offer.
Contrast NordPass, whose only documented format is CSV, so the plaintext moment is unavoidable. Or Dashlane, which offers an encrypted DASH file — but a proprietary one, useful as a backup and not as a migration.
Proton's archive is both. Bitwarden's password-protected JSON is the other export on this site that manages the same trick.
JSON over CSV
There is a second, quieter advantage in the format choice.
A password vault is not a flat table. A login has a username, a password, a URL, sometimes several URLs, a note, a two-factor secret, custom fields, a history. A CSV row can hold a fixed set of columns; anything that does not fit gets dropped or mangled.
JSON can represent nesting. So the structural ceiling on what can travel is higher here than in any CSV-only export, even before you ask what Proton actually puts in it.
We say structural ceiling deliberately. The documentation does not enumerate which item types are included, so we have scored completeness at 3 rather than assuming the format's capability equals the export's contents. Format allows; it does not guarantee.
The mobile block
Now the deduction, and it is a real one:
"You cannot export data using the Proton Pass mobile apps."
Export works from the browser extension, the web app and the Windows app. Not iOS. Not Android.
Think about who that affects. Password managers are, for an enormous number of people, a phone application — you installed it to stop reusing passwords, it autofills on your phone, and you may genuinely never have opened it on a computer. For that user, their vault is currently not exportable at all until they find a desktop.
It is not a policy designed to trap anyone, and the workaround is straightforward if you own a laptop. But "get to a computer first" is a real barrier, it is unstated anywhere in the mobile app itself, and it costs Proton two points on self-service that the rest of the report would otherwise have earned back.
Using this properly
Export the encrypted ZIP and keep it. This is the one password manager backup on this site that is safe to store, so store it. External disk, or a cloud folder — the encryption is the point.
Then test the decryption. Immediately, while you still have the account. An encrypted archive you cannot open is worse than no archive, because you will believe you are covered. Decrypt it once, look inside, confirm the JSON is there.
Keep the passphrase somewhere other than Proton Pass. This is the obvious trap and people fall into it constantly: an encrypted export of your vault, protected by a secret stored in the vault you are leaving. Write it down on paper if necessary.
Use CSV only in the moment. If your destination cannot read Proton's JSON — and many will not — export a CSV, import it, delete it, empty the trash, all in one sitting. Then rotate your handful of critical passwords.
The verdict
25 out of 30. Second only to Bitwarden among password managers, and held back by a platform restriction rather than a data one.
Full marks on format, on caps and on tier availability. What it loses is on self-service — because a phone-only user cannot do this at all — and on completeness, because the documentation describes the container better than the contents.
Both of those are fixable without changing anything structural, which is more than can be said for most low scores on this site. Proton has built the right thing and described it incompletely; that is a far better position than the reverse.
For the one product here that scores higher, see Bitwarden at 29, which offers an encrypted export and no platform restriction. For the closest alternative on score, see Dashlane at 24, exportable from anywhere but with no open encrypted format. For where these products sit as purchases, our family password manager guide covers the buying decision.
Before you cancel
- Get to a desktop before you plan anything. The mobile apps cannot export and there is no workaround on the phone.
- Choose the PGP-encrypted ZIP for anything you intend to keep, and store the passphrase somewhere that is not the vault you are leaving.
- Use CSV only for the moment of import, and delete it the same session.
- Test that you can actually decrypt the PGP archive before you rely on it - an encrypted backup you cannot open is not a backup.
- Import into your destination and verify secure notes and card items arrived; the documentation does not confirm they travel.
- Keep the encrypted archive after migrating. It is the only format here that is safe to leave on a disk.
- Rotate your most critical passwords if you passed through CSV at any point.
What we could not verify
- Which item types are included in each of the three formats.
- Whether file attachments stored in Proton Pass are included in the archive.
- Whether items in shared vaults export for a member or only for the vault owner.
- Which PGP key the encrypted archive is encrypted to, and how it is recovered if the account is closed.
These are open questions, not criticisms. Where a vendor does not publish an answer we leave it unscored rather than guessing, and the score is calculated only from what is documented.
Questions people ask
How do you export data from Proton Pass?
From the browser extension, the web app or the Windows app - not the mobile apps. Three formats are offered: a PGP-encrypted ZIP containing JSON, an unencrypted ZIP, and a CSV. The encrypted ZIP is the one to choose for anything you intend to keep.
Why can I not export Proton Pass from my phone?
Proton states directly that you cannot export data using the Proton Pass mobile apps. For a product a great many people use exclusively on a phone, that is a genuine obstacle - you need access to a desktop browser or the Windows app before you can take anything out.
What is the PGP-encrypted export and why does it matter?
A ZIP archive containing JSON, encrypted with PGP - an open standard that plenty of tools can decrypt. It means you can keep a backup of your entire vault on a disk without that backup being a readable list of your passwords. Only Bitwarden, with its password-protected JSON, offers anything equivalent here.
Should I export Proton Pass as CSV or JSON?
JSON inside the encrypted ZIP for storage, CSV only if your destination requires it. JSON represents nested structure that a flat CSV row cannot, so it is likelier to carry item types beyond simple logins - and the encrypted wrapper removes the plaintext risk entirely.
Is Proton Pass export available on the free plan?
No plan restriction is named in the export documentation, and export appears available to free accounts. That is consistent with Proton's stated position on portability, though it is worth confirming in the product before you depend on it.
Where this information comes from
Product details change often. Each item below links to the primary source we checked, so you can confirm anything that matters to your decision.
Vendors change their export tooling without announcing it. If something here no longer matches what you see in the product, tell us and we will re-check it.