For Windows users, sysadmins, and privacy-conscious power users who rely on browser extensions and desktop vaults every day, these features address some of the biggest functional gaps between Proton's relatively young credential manager and entrenched veterans like Bitwarden or 1Password. However, before you start mapping out a color-coded taxonomy for your logins, there is a catch: creating folders is locked behind select paid subscriptions, and independent folder sharing hasn't arrived just yet.
Here is a full breakdown of how the new features work, why Proton had to rework its underlying cryptography to make folders happen, and what the new autofill controls mean for your daily security hygiene.
Vault Organization Gets Granular with Nested Folders
Until now, Proton Pass relied entirely on separate "vaults" to group credentials. While vaults are great for broad separation—like keeping your personal banking logins away from a shared family or work vault—they are a blunt instrument when you are storing hundreds or thousands of items. Creating a whole new vault just to group five streaming services or a handful of test-server credentials quickly turns the sidebar into a cluttered mess.
With the October 2026 rollout, Proton Pass now supports folders and nested subfolders inside vaults. According to Proton's announcement, the implementation includes several quality-of-life mechanics designed for heavy credential libraries:
- Nested Hierarchies: You can create folders and subfolders to build out detailed directory trees—organizing items by project, department, client, or year.
- Drag-and-Drop Support: Items can be dragged and dropped directly across both folders and separate vaults.
- Scoped Search and Filtering: Rather than searching your entire credential database at once, you can filter and search specifically within a selected folder and its nested subfolders.
The Cryptography Prerequisite and Sharing Limits
Why did something as seemingly basic as a folder take until late 2026 to arrive? As Proton noted in its April 2026 spring and summer roadmap, building folders inside an end-to-end encrypted architecture required reworking the underlying cryptography model that protects credentials inside Proton Pass.
That architectural work is also why folder permissions currently have an important boundary. Right now, you cannot share an individual folder or subfolder independently. Instead, folders simply inherit the sharing settings of the parent vault that contains them. Proton confirmed in its autumn and winter 2026 roadmap that standalone folder and subfolder sharing—operating just like vault and single-item sharing—is in development for a future release.
Which Plans Actually Get Folders?
Unlike competing password managers such as Bitwarden and LastPass, which allow free-tier users to organize their vaults with folders, Proton has made folder creation a premium perk. And notably, not even every paid tier makes the cut.
| Account Tier / Plan | Can Create Folders & Subfolders? | Can View & Use Folders in Shared Vaults? |
|---|---|---|
| Proton Free | No | Yes (if shared by a paid user) |
| Proton Pass Essentials | No | Yes (if shared by a paid user) |
| Proton Pass Plus | Yes | Yes |
| Proton Pass Family | Yes | Yes |
| Proton Unlimited | Yes | Yes |
| Proton Pass Professional | Yes | Yes |
| VPN and Pass Professional | Yes | Yes |
| Proton Workspace | Yes | Yes |
As reported by Neowin, Proton's individual Pass Plus plan is priced at $4.99 per month, Proton Unlimited at $12.99 per month, and Proton Workspace Standard at $14.99 per user per month, though users on Free or Pass Essentials accounts are restricted to interacting with folders inside vaults that a qualifying paid subscriber has shared with them.
Section Summary: Proton Pass now lets users build nested folders, drag and drop items between folders and vaults, and search within specific folder trees. However, folder creation requires a qualifying paid plan (excluding Free and Pass Essentials), and folders currently inherit their parent vault's sharing rules rather than supporting standalone folder sharing.
Custom URL Matching: Taming Aggressive Autofill
If you work in IT administration, web development, or self-hosted homelabbing, default password manager autofill rules can be a persistent headache. When you host multiple services on different subdomains—say, mail.example.com, git.example.com, and admin.example.com—a naive password manager will happily offer every single example.com login on every single page. Worse, overly broad matching rules can expose credentials if an untrusted user controls a single subdomain on a shared domain platform.
Proton Pass now includes customizable URL matching rules that let you dictate exactly when and where an entry is allowed to autofill. According to Proton, users can configure both basic and advanced matching behaviors per login:
- Parent Domain and Subdomains: Useful for consumer services that bounce you between
login.service.comandaccount.service.comusing the same credential. - Exact Host Matching: Restricts autofill strictly to a specific hostname or subdomain so your admin portal credentials never pop up on a public-facing wiki hosted under the same root domain.
- Never Autofill: Completely disables automatic filling for a chosen URL, forcing manual retrieval when dealing with sensitive or quirky web forms.
- Wildcard Patterns and Regular Expressions (Regex): Built for advanced users and enterprise environments where internal tools follow predictable URL schemas or non-standard routing paths.
- Granular Field Selection: Lets you choose which specific form fields get populated automatically, preventing Proton Pass from accidentally stuffing sensitive data into the wrong input boxes on complex multi-field pages.
From a practical security standpoint, tightening your URL matching rules is a smart defensive habit. While strict host matching is not a magic bullet against every phishing technique, preventing your browser extension from volunteering credentials on unintended subdomains or loosely matched pages significantly reduces accidental exposure on complex corporate intranets.
Section Summary: Proton Pass now supports per-item URL matching controls—including exact host, parent domain, subdomain, regex, wildcard patterns, and a "never" toggle—alongside selective form-field autofill.
Local Compromised-Password Alerts
Password managers have offered breach checks for years, bolstered by services that catalog leaked credential dumps. Previously, Proton Pass offered weak and reused password checks to all users alongside dark-web email monitoring for paid subscribers inside its Pass Monitor dashboard. Now, Proton is adding dedicated compromised-password detection directly to its security checks.
Because Proton Pass is built around zero-knowledge encryption, the company cannot simply scan your plaintext passwords on its servers to see if they appear in a leak. Instead, Proton states that this verification runs locally on your device.
Here is how the process works based on Proton's disclosure:
- Proton Pass generates a cryptographic "fingerprint" (hash) of your saved password locally on your machine.
- The client compares that fingerprint against a list of password fingerprints compiled from known data breaches published by security researchers.
- If the local check detects a match, Proton Pass triggers an alert warning you that the password has appeared in a known breach so you can rotate it immediately.
- Throughout the entire check, Proton states that nobody at the company has access to your passwords or vault contents.
Looking ahead, Proton's autumn and winter 2026 roadmap notes that the company is also preparing "Pass Monitor v2," which will introduce a revamped interface and proactive notifications for weak, reused, and compromised passwords alongside breached email addresses.
One important caveat from an infosec perspective: a clean bill of health from a breach scanner does not prove a password is safe, as private or newly traded credential dumps may not yet be indexed in public researcher databases. Conversely, if an alert does fire, treat it as an immediate directive to generate a new, unique password—and enable two-factor authentication (2FA) on the affected account if you haven't already.
Section Summary: Compromised-password alerts now evaluate password fingerprints locally on your device against known breach lists without exposing vault contents to Proton's servers.
How This Fits Into Proton's 2026 Ecosystem Push
This October release effectively wraps up the major items from Proton Pass's spring and summer 2026 roadmap laid out back in April. Throughout the past several months, Proton has been steadily iterating on Pass to make it viable for developers and power users—such as shipping improved autofill and smoother 2FA verification in late July, as well as working on SSH key and agent capabilities for developer terminal workflows. Neowin also noted earlier additions from the spring and summer cycle, including browser extension offline access and biometric unlock support (such as Windows Hello, Touch ID, and Face ID) introduced in May and an SSH agent release in August.
According to Proton, folders, URL matching, and compromised-password alerts are rolling out gradually over a few days following the October 15 announcement and will reach all users shortly. If you don't see the folder options or per-URL autofill rules in your Windows desktop app or browser extension right away, keep your client updated as the staged deployment completes.