Pass Quick Access, native quick access for Proton Pass on macOS

01 Features

Built for muscle memory.

Everything happens from the keyboard, over whatever you're working in. No window switching, no waiting for an Electron app to wake up.

Search that matches Proton Pass

The same substring, diacritic-insensitive, multi-word matching as the official client, across titles, usernames, emails, URLs, notes and custom fields. Ranked by relevance, so a hit in the title comes before one buried in a URL or note.

Ready when you are

The rows from the last read are kept in a file sealed with a key that never leaves this Mac's Keychain, so the panel and System AutoFill answer straight away instead of reading every vault first, and the vaults are re-read behind you. No secret is in that file, and neither are notes or custom fields.

Fill or copy

Type the login straight into the app you came from, in any browser, or copy the username, password or one-time code. Each shown only when the item has it; choose fill, copy, or both. Or let macOS ask the app instead, through System AutoFill.

Knows the page you're on

Open the panel over a browser and the item for the current tab is picked for you; when several match a site, the list narrows to those. Safari and Chromium work out of the box; Firefox, Zen and web apps are opt-in.

Open in browser

Jump straight to the item's site, with a chooser when an item has several URLs.

Optional Touch ID lock

Guard casual access with Touch ID and a configurable timeout, falling back to your Mac password.

Stays signed in

When your Proton session expires, the panel signs you back in through Proton's web login instead of dead-ending, then reloads itself and the SSH agent. Save an access token to reconnect without the browser, reusing your next Touch ID.

Resume where you left off

Reopen within 30 seconds and land back on the same item, to grab another field.

Private by default

Items show a locally generated monogram. Opt in to favicons with a clear notice, never fetched for local or private addresses.

02 Security model

It's a password tool. So it earns the trust.

The app never reimplements Proton's crypto or auth. It drives the official, Proton-maintained pass-cli and is careful never to be the weaker link.

Secrets are never persisted or indexed

The index holds only titles, URLs, usernames and whether a password or code exists, never the values. Its rows are kept between launches in a file sealed with a Keychain key bound to this Mac, without notes, custom fields or any secret. AutoFill’s optional suggestion list saves a website, a username and an item reference, never a secret, and is off until you turn it on.

Read fresh, cleared fast

Passwords and codes are read from pass-cli at the moment you copy, marked concealed on the pasteboard, and cleared after 30 seconds.

Authentication lives in pass-cli

The app holds no Proton credentials and relies entirely on the CLI's existing session.

Hardened runtime

Signed release builds use the hardened runtime without get-task-allow, so other processes can't attach. What reaches the disk is non-secret metadata, sealed with a key that never leaves this Mac's Keychain.

Updates you trigger, verified before they install

It checks one static file (the appcast on GitHub Pages) at launch and every two hours, with no account data, just a fetch you'll see on the network. New versions never install on their own: you click Update, and each download is checked against a pinned EdDSA key first.

03 System AutoFill

Let macOS do the asking.

Pass Quick Access can answer the password menu built into macOS, the one Safari and native apps already show. The app holds the login, macOS puts it in the field. Proton Pass doesn’t offer this on the Mac, so until now the only way to get your logins into that menu was to keep them somewhere else.

The macOS password menu offering a Proton Pass login through Pass Quick Access — macOS asks, Pass Quick Access answers

Nothing is typed any more

Filling used to mean synthesising keystrokes into whatever had focus, which needs Accessibility access and a guess about which field you meant. Here the system asks for the credential and fills the field itself. No keystrokes, no guessing, no Accessibility permission, and it reaches native apps and not only browsers.

Still read just in time

The bundled extension is sandboxed and reads nothing itself. It asks the app, and only the app ever runs pass-cli, so a password is fetched at the moment you pick it. Both ends check the other’s code signature before a word is exchanged.

One-time codes too

On macOS 15 and later the system asks for verification codes the same way, and the extension answers those as well. Not passkeys: providing one means holding the private key and signing the challenge, and pass-cli exposes neither, so the app stays out of that menu rather than failing in it.

Your logins named in the menu, if you ask

For a row to carry your username before you’ve picked this app, macOS needs a list of them. That’s off by default and has its own switch, because it is the one thing the app writes outside its own storage: turning it on saves each login’s website and username, never a password or a code, into the password database macOS manages. Off, AutoFill still works; you pick Pass Quick Access and search.

Turn on Answer macOS AutoFill in Settings → Autofill → System.
In System Settings → General → AutoFill & Passwords, turn Pass Quick Access on under “AutoFill from”. Turn Apple’s own Passwords off there too if you’d rather not be offered both.
Click the key icon in any password field and pick Pass Quick Access. Your logins for that site come first, the rest of the vault below.

Where it works: Safari and native apps. Chrome, Firefox and the other browsers don’t use the system provider, so there you still summon the panel with the hotkey and let the app type, exactly as before. The two live side by side; turning one on takes nothing away from the other.

Two Touch ID prompts? macOS has its own Use Touch ID for autofilling passwords under Touch ID & Password, on by default, and it asks in addition to this app’s optional lock. Turn off whichever of the two you’d rather not answer; both are yours to set.

To turn it off use System Settings → General → AutoFill & Passwords, not the app. macOS owns that switch and gives no way to flip it from the inside.

Heads up on macOS 27.0: some sign-in forms crash Safari when a password manager fills them, 1Password included. It is a defect in Safari’s own form filling rather than in any extension, it has been reported to Apple, and nothing a credential provider sends can prevent it.

04 SSH agent

Your SSH keys, gated by Touch ID.

Just like 1Password's SSH agent: it serves the SSH keys you keep in Proton Pass to git and ssh, and asks for Touch ID before every signature, naming the app that's asking. The private keys never leave pass-cli; the app only adds the native confirmation.

SSH key signature request with a Touch ID prompt

Turn on Enable SSH agent in Settings → SSH. The app starts the upstream pass-cli agent for you.
Click Configure ~/.ssh/config automatically, it adds IdentityAgent ~/.ssh/pass-quick-access-agent.sock.
Use git and ssh as usual. Each signature pops a Touch ID prompt; approve once and you're through.

Tip: the config entry covers ssh and git. For tools that read the SSH_AUTH_SOCK environment variable instead of ~/.ssh/config (like ssh-add or some GUI clients), also turn on Set SSH_AUTH_SOCK for new programs, it publishes the proxy to your login session for programs launched afterwards.

Coming from 1Password?

Same workflow. Move your SSH keys into Proton Pass and let the app write the ~/.ssh/config entry for you (step 2). Then just remove 1Password's own IdentityAgent line and turn off its agent. One gotcha shared by every agent: an explicit on-disk IdentityFile for a host wins over the agent, so drop those lines for the hosts you want served from Proton Pass.

07 Get it

Get it running.

Grab the latest pre-built app, or build it from source. Either way you'll need macOS 14+ and pass-cli 2.5 or later, installed and logged in.

Download for macOS

Unzip it, drag it to Applications, open it. From then on the app tells you when there's a new version, and installs it only when you say so. If you'd like to support the project you can sponsor it, or sign up for Proton with my referral link: you get 2 weeks of a paid plan, and I get a small reward if you subscribe.

Terminal

# Build from source
# needs xcodegen too
git clone https://github.com/bsramin/pass-quick-access
cd pass-quick-access
xcodegen generate
xcodebuild -scheme PassQuickAccess \
  -destination 'platform=macOS' \
  -derivedDataPath build build
open build/Build/Products/Debug/PassQuickAccess.app

Download View on GitHub Sponsor Proton referral

Also by the author

Nexion. One window for you and your AI agents.

Same instinct as this app, on a much bigger surface. Pass Quick Access spares you one trip to another window; Nexion spares you the other four. Terminal, browser, files, Git and Canvas sit together in one native macOS window, so your coding agent keeps working while you stay exactly where you are.

Same author, same principles: Swift and SwiftUI, no Electron, keyboard first. And the Touch ID prompt from the SSH agent above appears right there, in the terminal you never left.

Visit nexion.one

GPU terminal, powered by Ghostty, with splits and a real login shell.
Built-in browser with isolated profiles, so work and personal logins coexist.
Git in the window: diffs, staging, commits, branches and PRs.
Your AI agents, Claude Code, Codex, Gemini and more, one click from the title bar.
Edit right there: a Monaco editor with 34 languages, so a quick fix doesn't need another app.
Your workspace in your pocket: pair an iPhone or iPad over your own network and drive the same terminals and web tabs from your hand.

Your logins,
one keystroke away.