SMF·PROTON-PASS-PLUS
Can a prompt replace Proton Pass Plus?
Security & passwords — passwords, privacy and private networking
Exhibit tracking slip
Verdict
The vault half is well-trodden ground and this catalogue already says so. The alias half is not code at all. An alias only works if mail sent to it arrives, which means a domain with correct SPF, DKIM and DMARC records, a catch-all mailbox, and a reputation good enough that the forwarded copy is not silently dropped. You can set that up; what you cannot do is get Proton's shared alias domains, which is what makes the feature work for people who do not own a domain.
Exhibit A — The prompt
Received on31.07.2026Build a local password vault with per-site email alias management on a domain the user already controls.
Vault: a desktop application storing entries encrypted at rest. Derive the key from the master password with Argon2id using a per-vault random salt and parameters written into the vault header, so they can be raised later. Encrypt with an authenticated cipher from a maintained library — never assemble primitives by hand. Entries hold a title, username, password, TOTP secret, URL list, and notes, all inside the encrypted blob; only the entry count is visible without unlocking.
Vault behaviour: auto-lock on a timer and on system sleep, clear the clipboard a configurable number of seconds after a copy, generate passwords with a length and character-class policy, and support import from 1Password, Bitwarden and CSV. Export is always available, encrypted or plain, with a warning on the plain path.
Alias management, which is what distinguishes this build. The user configures one domain they own, with a catch-all mailbox already receiving mail for it — the tool never sends or receives mail itself. Generating an alias creates a random local part on that domain, stores it against the vault entry for that site, and records the date. The alias list shows which site each one belongs to, when it was created, and a free-text note on what it was used for. Marking an alias as burned writes it to a blocklist file the user can feed into their mail provider's filtering rules; the tool cannot stop the mail itself and must say so.
Setup guidance: the README must walk through the DNS records a catch-all needs (MX, SPF, DKIM, DMARC) and state plainly that if any of these are wrong, aliases will silently lose mail, which is worse than not having them.
Display a persistent notice that this build has had no independent security audit.
Out of scope: browser extension autofill, mobile apps, any sync service, running a mail server, and shared or hosted alias domains.Opening prefills the prompt — press enter to run it.
Exhibit B — What you lose
- B.1 aliases on Proton's shared domains, which need no domain of your own
- B.2 the mail infrastructure behind forwarding, and the deliverability that comes with it
- B.3 independent security audits of the client and the crypto
- B.4 account recovery if you lose the master password
Prior art
Exhibit C — Why people still pay: security assurance, infrastructure, and trust
Because an alias that stops delivering is a lost account, and running your own forwarding means your password resets depend on your own DNS and your own mail server staying up.
Questions
Can I import my Proton Pass vault?
Yes, Proton Pass exports to JSON and CSV, and passwords, notes and TOTP secrets map across. Aliases come across as records, but they stop forwarding the moment the subscription ends, so any alias on a Proton domain has to be replaced on each site by hand before you cancel.
Do I really need my own domain?
For the alias half, yes. Without one there is nowhere for the mail to arrive, and the tool degrades to a plain local vault, which the catalogue already covers better elsewhere. A cheap domain plus a mail provider with catch-all support is the minimum.
What does it cost to run?
A domain, roughly ten to fifteen dollars a year, plus a mailbox that supports catch-all, which many providers include. Against five dollars a month for Pass Plus, the arithmetic favours building it — until you count the evening spent getting DMARC right.
What is the one thing that does not survive the rebuild?
Aliases that just work. Proton runs the mail path, so an alias delivers on day one and still delivers in three years. Yours depends on your DNS, your provider and your renewals, and the failure mode is a password reset email that never arrives.
Related tools
Receipt