Twelve logins in an old Bitwarden vault hadn't been touched in months, and every one of them still worked. That's the kind of audit that gets you serious about secure sharing instead of just secure storage: it's not enough for a password manager to hold a client's login, it needs a system for who can see it, how long they keep seeing it, and what happens the day the contract ends. I run marketing operations at a mid-size B2B SaaS company, which means client onboarding logins nobody else wants to think about end up on my desk by default, and Proton Pass is where I finally built a real system around them.
None of that happened because I'm naturally organized. It happened because a year of handing out logins the sloppy way finally caught up with me: a shared spreadsheet here, a quick text there, whatever got a freelancer working fastest. Four years of building client vaults across half a dozen tools has taught me the sloppy way always catches up eventually, usually right when a contractor's access should have been cut off weeks earlier.
Why Autofill Never Solved the Sharing Problem
For a while my fix was relying on Chrome's built-in autofill for every work account I touched, on the theory that if the browser remembered it, I didn't have to. It solved exactly one problem, my own forgetfulness. It did nothing for the actual sharing problem: autofill lives on one device, tied to one browser profile, with no way to hand a single login to a freelancer without handing over the whole profile or reading the password out loud on a call. A friend of mine who plays pickleball at Pharr Tennis Center asked me recently why she couldn't just keep using her phone's saved passwords for the league's shared booking account, and the honest answer is, she can, right up until someone needs access who isn't her.
Underneath the sharing problem sits a quieter one, which is whether the vault provider itself can see what's inside. Proton Pass runs on zero-knowledge encryption, meaning Proton can't read the contents of a vault even if it wanted to, and the company operates under Switzerland's Swiss Federal Act on Data Protection (FADP), one of the stricter privacy regimes a vault provider can sit under. I won't pretend I've read the statute end to end, but knowing the provider itself is locked out matters more to me than any feature list.
The actual encryption spec is AES-GCM 256-bit, and that's about as deep as I go before my eyes glaze over. What matters practically is simpler: nobody at Proton, no support rep, no engineer, can open a client's vault and hand it to anyone, including themselves.
Build One Vault Per Client at Onboarding, Not Later
What actually stuck was treating every client relationship like its own container from day one. I sketched the first version of that structure walking the Barton Creek Greenbelt trailhead on a lunch break, which says more about how much this had taken over my head than about the trail itself. Proton Pass lets you create a vault per client, and the habit that matters is doing it during onboarding, before a single login gets typed into anything shared. Name the vault after the client, not "Marketing" or "General," so there's no ambiguity later about what belongs where. On the plan I use, the vault limit sits at twenty, which covers a full roster of active accounts without forcing me to double up on anyone.
None of that structure matters if the master password guarding it is weak, so that's the one piece I don't get casual about, even though the real how-to for building a strong one belongs in its own writeup. Inside each client vault, permissions come down to two roles, viewer or editor, and I default everyone to viewer unless they're my direct deputy. Two-factor codes and passkeys attach to the vault itself rather than to any one person's memory, which matters more than people expect once a client asks exactly who can get in. I've gone deeper on where that permission model actually holds up in Is Proton Pass Secure Enough for My Marketing Operations Vaults?, if you want the fuller argument.
What Belongs Inside a Client Vault, and What Doesn't
Every vault raises the same question eventually: what actually needs to live inside it. A freelance copywriter doesn't need a client's billing login just because they share a vault with the CRM access they do need, so the discipline is auditing contents the same day the vault gets built, not six months later when someone's left and you're guessing what they could see. Secure notes work the same way logins do here, encrypted and shared on the same permission basis, which is useful for anything a client considers sensitive beyond a plain username and password.
Handing Off Access Without Losing the Trail
Share links look convenient right up until you rely on one for longer than a single afternoon. An hour-long expiration sounds tidy, but once a link gets clicked and the password lands in someone's personal browser or their own separate vault, the trail disappears: there's no record of when it was last used, and revoking it does nothing to the copy that already escaped. A shared vault behaves differently. I can see the last time a contractor opened it, and when a contract ends on a Friday, access gets cut that Friday, not at the end of a billing cycle out of convenience. That's the real test of any sharing method: can you take it away cleanly, the same day you decide to.
Most of this only matters because a client's inbox can get spoofed by a domain that's off by a single character, the exact trick that started me down this whole path, and it's most of what I unpack in Reducing My Digital Footprint After a Near Phishing Marketing Attack. Once a vault is actually set up right, the bigger risk shifts to what happens when the relationship ends. Exporting or migrating a vault cleanly matters more than people plan for, so portability is worth checking before you're stuck with it. I keep an emergency-kit style backup for account recovery, the kind of thing you set up once and hope never to need, and I let Proton's breach alerts run in the background instead of checking every login by hand.
The Small Features That Do More Than the Big Ones
The feature I undersold for the longest time is the hide-my-email alias, which generates a throwaway address for every new tool a client onboards instead of handing out their real admin inbox. When one alias eventually started catching spam, I knew exactly which tool had leaked it instead of wondering whether the client's main inbox was the problem. I deleted the alias, blocked the sender, and moved on without touching another password.
There's a travel mode setting too, built for hiding vaults you don't need while crossing a border, and I'll only mention it in passing here since the actual walkthrough belongs in its own piece. Small settings like that add up faster than any headline feature does, mostly because nobody remembers to use the headline feature under pressure.
If you're still deciding whether the day-to-day extension experience is worth the switch, Proton Pass Browser Extension Review for Busy Marketing Operations covers what it's actually like jumping between client vaults thirty tabs at a time. None of this makes me feel invincible about client data, and I don't think any tool should. It just means the twelve stale logins that started this whole audit got fixed in an afternoon instead of turning into the next spreadsheet nobody wants to explain to a client.