Proton Pass vs 2FAS

Agent access

1. ai-native userPoint an agent at llms.txt or agent-oriented docs

   weight 2 · round to 2FAS
   Proton Pass—none0/10

   No llms.txt or agent-oriented docs found; probes explicitly return 404 for llms.txt and docs.md endpoints, and no evidence mentions agent-readable documentation formats.

   • [probe] “PROBE llms.txt: HTTP 404 at https://proton.me/llms.txt”
   • [probe] “PROBE docs-md: HTTP 404 at https://proton.me/support/pass.md”

   proof ↗⚑ flag

   2FAS✓fullprobed9/10

   Direct probe confirms a live llms.txt with an explicit 'For AI agents' section, plus modular per-section llms files, llms-full.txt, per-page .md mirrors, and Accept: text/markdown rendering — strong first-party agent-oriented docs infrastructure verified via runtime probes. Missing for 10: no independent/community corroboration of agents actually consuming these docs in practice.

   • [probe] “PROBE llms.txt: HTTP 200 at https://2fas.com/llms.txt # 2FAS — Password Manager and Authenticator > Local-first password manager (2FAS Pass…”
   • [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”
   • [probe] “PROBE runtime (recorded 2026-09-15): machine-readable pricing verified live at https://2fas.com/.well-known/pricing.md — '# 2FAS Pricing... …”

   proof ↗⚑ flag

2. ai-native userRun the product headlessly / in CI for automation

   weight 2 · round to Proton Pass
   Proton Pass~partialprobed6/10

   Proton Pass ships an official CLI documented as designed for scripts, deployments, and CI/CD pipelines, supporting CRUD on vaults and items — a clear headless/automation capability. However, evidence is limited to vendor blog docs with no independent/hands-on corroboration of CI usage, no details on authentication flow for non-interactive/headless environments, and no community validation of real-world CI deployment. Missing for 10: independent hands-on CI usage reports, details on non-interactive auth/session handling for automation, and broader ecosystem examples (e.g., GitHub Actions integration).

   • [claimed-docs] “enables you to securely retrieve secrets and other items across scripts, deployments, and continuous integration/ continuous delivery (CI/CD…”
   • [claimed-docs] “the CLI enables you to securely retrieve secrets and other items across scripts, deployments, and continuous integration/ continuous deliver…”
   • [claimed-docs] “View, create, update, and delete items including passwords, secure notes, credit cards, identities, WiFi entries, custom items, and stored S…”
   • [probe] “official CLI documented at https://proton.me/blog/proton-pass-cli”

   proof ↗⚑ flag

   2FAS—none0/10

   2FAS is a mobile authenticator/password manager with no CLI, headless mode, or API for CI/automation; the product's own llms.txt explicitly declares 'Public API: None' and is local-first by design, meaning it cannot be run headlessly or scripted in CI.

   • [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”
   • [probe] “PROBE openapi: all candidate paths 404 (https://2fas.com/openapi.json, https://2fas.com/swagger.json, https://2fas.com/api/openapi.json, htt…”

   proof ↗⚑ flag

3. ai-native userConnect an agent via an official MCP server

   weight 3 · round drawn
   Proton Pass—none0/10

   The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)

   ⚑ flag

   2FAS—none0/10

   2FAS is a password/2FA manager, not an agent, so an MCP server axis could plausibly apply to its ecosystem; however evidence explicitly states 'Public API: None' and no OpenAPI/MCP endpoint exists, with probes confirming no API surface for agents to connect to.

   • [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”
   • [probe] “PROBE openapi: all candidate paths 404 (https://2fas.com/openapi.json, https://2fas.com/swagger.json, https://2fas.com/api/openapi.json, htt…”

   proof ↗⚑ flag

4. ai-native userUse an official CLI

   weight 2 · round to Proton Pass
   Proton Pass✓fullprobed7/10

   Proton Pass has an official CLI documented in a first-party blog post that supports CRUD on vaults and items (including SSH keys) and secret retrieval for scripts/CI/CD pipelines, which is directly relevant to AI-native/agentic automation workflows. Missing for 10: independent/hands-on corroboration of the CLI's reliability, no mention of AI-agent-specific integrations or MCP-style tooling, and no detail on scripting API depth or language bindings.

   • [claimed-docs] “enables you to securely retrieve secrets and other items across scripts, deployments, and continuous integration/ continuous delivery (CI/CD…”
   • [claimed-docs] “the CLI enables you to securely retrieve secrets and other items across scripts, deployments, and continuous integration/ continuous deliver…”
   • [claimed-docs] “View, create, update, and delete items including passwords, secure notes, credit cards, identities, WiFi entries, custom items, and stored S…”
   • [probe] “official CLI documented at https://proton.me/blog/proton-pass-cli”

   proof ↗⚑ flag

   2FAS—none0/10

   2FAS is a mobile/browser 2FA and password-manager app with no evidence of an official CLI; docs explicitly note 'Public API: None' and no CLI tool is mentioned anywhere in the evidence pack.

   • [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”

   proof ↗⚑ flag

5. ai-native userDrive the product through a documented public API

   weight 3 · round to Proton Pass
   Proton Pass~partialprobed5/10

   Proton Pass offers a CLI for CRUD operations on vaults and items (passwords, notes, SSH keys, etc.) usable in scripts/CI pipelines, which provides programmatic access, but this is a CLI wrapper rather than a documented public REST/GraphQL API with SDKs, and llms.txt/docs.md probes both 404. missing for 10: a formal public API specification (REST/GraphQL/SDK), API reference docs, and independent developer corroboration of programmatic/agentic use beyond the CLI.

   • [claimed-docs] “enables you to securely retrieve secrets and other items across scripts, deployments, and continuous integration/ continuous delivery (CI/CD…”
   • [claimed-docs] “Create, read, update, and delete vaults”
   • [claimed-docs] “the CLI enables you to securely retrieve secrets and other items across scripts, deployments, and continuous integration/ continuous deliver…”
   • [claimed-docs] “View, create, update, and delete items including passwords, secure notes, credit cards, identities, WiFi entries, custom items, and stored S…”
   • [probe] “PROBE llms.txt: HTTP 404 at https://proton.me/llms.txt”
   • [probe] “PROBE docs-md: HTTP 404 at https://proton.me/support/pass.md”
   • [probe] “official CLI documented at https://proton.me/blog/proton-pass-cli”

   proof ↗⚑ flag

   2FAS—none0/10

   2FAS explicitly states 'Public API: None' in its own llms.txt, and OpenAPI/swagger probes all return 404, confirming there is no documented public API to drive the product programmatically — it is local-first by design.

   • [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”
   • [probe] “PROBE openapi: all candidate paths 404 (https://2fas.com/openapi.json, https://2fas.com/swagger.json, https://2fas.com/api/openapi.json, htt…”

   proof ↗⚑ flag

6. ai-native userIssue scoped/least-privilege API credentials for an agent

   weight 2 · round drawn
   Proton Pass—none0/10

   Proton Pass CLI supports retrieving secrets/items for CI/CD and vault-level CRUD, but there is no evidence of issuing scoped or least-privilege API credentials/tokens specifically for an AI agent (e.g., fine-grained scopes, agent-specific permission tiers). Vaults provide organizational grouping, not credential scoping mechanisms for automated agents.

   • [claimed-docs] “enables you to securely retrieve secrets and other items across scripts, deployments, and continuous integration/ continuous delivery (CI/CD…”
   • [claimed-docs] “Create, read, update, and delete vaults”
   • [claimed-docs] “the CLI enables you to securely retrieve secrets and other items across scripts, deployments, and continuous integration/ continuous deliver…”
   • [claimed-docs] “View, create, update, and delete items including passwords, secure notes, credit cards, identities, WiFi entries, custom items, and stored S…”

   proof ↗⚑ flag

   2FAS—none0/10

   2FAS is a local-first authenticator/password manager with no public API; its own llms.txt explicitly states 'Public API: None' and no agent-callable endpoint for token generation, so there is no mechanism to issue scoped/least-privilege API credentials for an agent.

   • [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”
   • [probe] “PROBE openapi: all candidate paths 404 (https://2fas.com/openapi.json, https://2fas.com/swagger.json, https://2fas.com/api/openapi.json, htt…”

   proof ↗⚑ flag

7. ai-native userBuild against official SDKs

   weight 2 · round drawn
   Proton Pass—none0/10

   Evidence shows only a CLI tool for secrets retrieval in CI/CD pipelines, not a developer SDK for building applications; no mention of SDKs, API libraries, or language bindings for programmatic integration exists in the evidence pack.

   ⚑ flag

   2FAS—none0/10

   2FAS explicitly declares 'Public API: None' and has no OpenAPI/SDK endpoints; probes confirm no SDK or API surface exists for developers to build against.

   • [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”
   • [probe] “PROBE openapi: all candidate paths 404 (https://2fas.com/openapi.json, https://2fas.com/swagger.json, https://2fas.com/api/openapi.json, htt…”

   proof ↗⚑ flag

8. ai-native userSubscribe to events via webhooks

   weight 2 · round drawn
   Proton Pass—none0/10

   No evidence of any webhook or event subscription mechanism; Proton Pass offers a CLI for CRUD operations but nothing about push/webhook notifications. Missing for 10: any webhook API, event subscription mechanism, or documentation referencing such a feature.

   ⚑ flag

   2FAS—none0/10

   2FAS is explicitly local-first with no public API ('Public API: None' per its own llms.txt), and no evidence anywhere mentions webhooks or event subscriptions; this is a password/2FA app, not an event-driven platform.

   • [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”

   proof ↗⚑ flag

Agentic features

1. ai-native userSet up automations that run autonomously in the background

   weight 2 · round drawn
   Proton Pass—none0/10

   The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)

   ⚑ flag

   2FAS—none0/10

   The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)

   ⚑ flag

2. ai-native userOperate the product with natural-language commands

   weight 2 · round drawn
   Proton Pass—none0/10

   Proton Pass offers a CLI for scripted secret retrieval and CRUD operations, but there is no evidence of natural-language command support, AI assistant integration, or conversational interface anywhere in the docs or community discussion. Missing for 10: any NL command parsing, chat/AI interface, or agentic natural-language control.

   ⚑ flag

   2FAS—none0/10

   The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)

   ⚑ flag

Api quality

1. ai-native userExplore an interactive API reference with runnable examples

   weight 2 · round drawn
   Proton Pass—none0/10

   No evidence of an interactive API reference or runnable examples; documentation covers CLI usage and product features only, and probes for docs/llms.txt endpoints returned 404. Missing for 10: interactive API reference, runnable code examples, developer API docs portal.

   • [probe] “PROBE llms.txt: HTTP 404 at https://proton.me/llms.txt”
   • [probe] “PROBE docs-md: HTTP 404 at https://proton.me/support/pass.md”
   • [probe] “official CLI documented at https://proton.me/blog/proton-pass-cli”

   proof ↗⚑ flag

   2FAS—none0/10

   No evidence of an interactive API reference or runnable examples; openapi probe returned 404s across all candidate paths and llms.txt explicitly states 'Public API: None' since 2FAS is local-first with no agent-callable endpoints.

   • [probe] “PROBE openapi: all candidate paths 404 (https://2fas.com/openapi.json, https://2fas.com/swagger.json, https://2fas.com/api/openapi.json, htt…”
   • [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”

   proof ↗⚑ flag

2. ai-native userDownload a machine-readable API spec (OpenAPI or equivalent)

   weight 2 · round drawn
   Proton Pass—none0/10

   No evidence of a machine-readable API spec (OpenAPI or similar); only a CLI tool for scripts/CI/CD is documented, and probes for llms.txt and docs-md endpoints both returned 404.

   • [probe] “PROBE llms.txt: HTTP 404 at https://proton.me/llms.txt”
   • [probe] “PROBE docs-md: HTTP 404 at https://proton.me/support/pass.md”
   • [claimed-docs] “enables you to securely retrieve secrets and other items across scripts, deployments, and continuous integration/ continuous delivery (CI/CD…”

   proof ↗⚑ flag

   2FAS—none0/10

   Direct probes for OpenAPI/swagger specs all returned 404, and the product's own llms.txt explicitly states 'Public API: None,' confirming no machine-readable API spec is offered.

   • [probe] “PROBE openapi: all candidate paths 404 (https://2fas.com/openapi.json, https://2fas.com/swagger.json, https://2fas.com/api/openapi.json, htt…”
   • [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”

   proof ↗⚑ flag

3. ai-native userRely on versioned APIs with a documented deprecation policy

   weight 2 · round drawn
   Proton Pass—none0/10

   The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)

   ⚑ flag

   2FAS—none0/10

   2FAS explicitly declares 'Public API: None' and has no OpenAPI/swagger endpoints (all probes 404), meaning there is no versioned API at all, let alone a documented deprecation policy.

   • [probe] “PROBE openapi: all candidate paths 404 (https://2fas.com/openapi.json, https://2fas.com/swagger.json, https://2fas.com/api/openapi.json, htt…”
   • [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”

   proof ↗⚑ flag

1. ai-native userPerform bulk operations across many items at once

   weight 2 · round to Proton Pass
   Proton Pass~partialclaimed5/10

   The official CLI supports scripted CRUD on vaults and items (passwords, notes, SSH keys, etc.) which could be used to script bulk operations, and the import/export tools allow migrating many items at once. However, there is no documented explicit 'bulk edit/delete/tag' feature or batch API, and no community evidence of anyone actually scripting bulk operations at scale. Missing for 10: dedicated bulk-action API/UI, documented batch limits, and independent confirmation of large-scale scripted use.

   • [claimed-docs] “enables you to securely retrieve secrets and other items across scripts, deployments, and continuous integration/ continuous delivery (CI/CD…”
   • [claimed-docs] “the CLI enables you to securely retrieve secrets and other items across scripts, deployments, and continuous integration/ continuous deliver…”
   • [claimed-docs] “View, create, update, and delete items including passwords, secure notes, credit cards, identities, WiFi entries, custom items, and stored S…”
   • [claimed-docs] “Create, read, update, and delete vaults”
   • [claimed-docs] “With our import tool, you can migrate passwords and other items from most major password managers in just a few minutes.”
   • [claimed-docs] “You have three options for export: 1. A ZIP file containing a PGP-encrypted JSON file 2. An unencrypted ZIP file 3. A CSV file”

   proof ↗⚑ flag

   2FAS—none0/10

   2FAS is a local-first authenticator/password manager with no public API (explicitly declared 'Public API: None'), and no evidence of bulk operations across items (e.g., batch import/export beyond single-file import, bulk edit/delete of tokens or vault entries) that an AI agent could invoke. There's no scripting, CLI, or API surface for programmatic bulk actions.

   • [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”
   • [claimed-docs] “We support imports from Aegis, Raivo, LastPassAegis, Stratum (formerly Authenticator Pro) and Google Authenticator.”

   proof ↗⚑ flag

1. ai-native userDo everything through the API that I can do in the UI

   weight 2 · round to Proton Pass
   Proton Pass~partialprobed5/10

   Proton Pass ships a CLI/API that supports CRUD on vaults and items (passwords, notes, cards, identities, SSH keys, custom items), enabling scripted/CI access similar to core UI functions. However, there's no evidence the CLI/API exposes other UI capabilities like vault sharing, TOTP generation, Pass Monitor/Sentinel checks, alias management, or emergency access. Missing for 10: API coverage for sharing, TOTP/2FA, monitoring, aliases, emergency access, and any independent confirmation of API completeness.

   • [claimed-docs] “enables you to securely retrieve secrets and other items across scripts, deployments, and continuous integration/ continuous delivery (CI/CD…”
   • [claimed-docs] “Create, read, update, and delete vaults”
   • [claimed-docs] “the CLI enables you to securely retrieve secrets and other items across scripts, deployments, and continuous integration/ continuous deliver…”
   • [claimed-docs] “View, create, update, and delete items including passwords, secure notes, credit cards, identities, WiFi entries, custom items, and stored S…”
   • [probe] “official CLI documented at https://proton.me/blog/proton-pass-cli”

   proof ↗⚑ flag

   2FAS—none0/10

   2FAS's own llms.txt explicitly declares 'Public API: None' and probes confirm no OpenAPI/swagger spec exists at any candidate path, meaning there is no API surface at all through which a user could replicate UI actions.

   • [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”
   • [probe] “PROBE openapi: all candidate paths 404 (https://2fas.com/openapi.json, https://2fas.com/swagger.json, https://2fas.com/api/openapi.json, htt…”

   proof ↗⚑ flag

2. ai-native userExport all of my data in open formats and leave

   weight 3 · round to Proton Pass
   Proton Pass✓fullclaimed7/10

   Proton Pass supports data export in multiple open, portable formats (unencrypted ZIP, CSV, PGP-encrypted JSON) allowing users to leave with their data, and also offers an import tool for migrating in from other managers. Missing for 10: independent hands-on verification of export completeness/fidelity, and no evidence of bulk API/CLI-based export for programmatic 'leave' workflows beyond CLI CRUD operations.

   • [claimed-docs] “If you want to use your passwords elsewhere or create a separate hardcopy, you can easily export your data from Proton Pass.”
   • [claimed-docs] “You have three options for export: 1. A ZIP file containing a PGP-encrypted JSON file 2. An unencrypted ZIP file 3. A CSV file”
   • [claimed-docs] “With our import tool, you can migrate passwords and other items from most major password managers in just a few minutes.”

   proof ↗⚑ flag

   2FAS~partialcommunity6/10

   2FAS explicitly supports exporting/backing up data (encrypted export files, self-host freedom, import/export in free tier) and even imports from competitor formats, showing some portability. However, there's no evidence the export format itself is documented as an open/standard schema (e.g., JSON spec or standard otpauth migration format), and the backup is typically encrypted for 2FAS's own re-import rather than a documented open format for third-party tools. missing for 10: explicit open/standard export format spec, independent confirmation the exported file is usable outside 2FAS ecosystem, and details on the exact format encoding.

   • [claimed-docs] “Synchronize your Tokens with 2FAS export files, iCloud or Google Drive.”
   • [claimed-docs] “data can be encrypted with your password, so we encourage you to do that.”
   • [claimed-docs] “Freedom to self-host your data”
   • [claimed-docs] “You decide where to store your Items. You can store it in your own cloud or keep it as an encrypted file on an external drive.”
   • [community] “Free tier of 2FAS Pass includes auto-fill, import/export, and standard password generator; paid tier adds multi-device sync, more than 200 v…”
   • [claimed-docs] “We support imports from Aegis, Raivo, LastPassAegis, Stratum (formerly Authenticator Pro) and Google Authenticator.”

   proof ↗⚑ flag

3. ai-native userRead the product's source under an open license

   weight 2 · round to 2FAS
   Proton Pass~partialcommunity5/10

   Community evidence confirms Proton Pass client apps are open source on GitHub (protonpass org), but users note this covers only the clients, not the full product/server-side, and there was confusion over whether it was truly open-sourced. No first-party docs in the pack mention a license or open-source repo at all. Missing for 10: official documentation citing the open-source license, confirmation that server/backend code is open, and clarity on license terms.

   • [community] “It seems only the clients are open source? https://github.com/orgs/protonpass/repositories”
   • [community] “Am I correct in believing that they haven't open-sourced Proton Pass yet?... Their official announcement post says it's now open source, how…”
   • [community] “Please note that we do have encrypted notes... And it is open source: https://github.com/protonpass”

   proof ↗⚑ flag

   2FAS✓fullprobed8/10

   2FAS explicitly points to its GitHub repositories for both the auth app and browser extension, describing itself as open-source, and the probe confirms 'open-source two-factor authentication' positioning with 'Freedom to self-host your data.' missing for 10: explicit license name (e.g., MIT/GPL) is not stated in evidence, and no independent audit confirming license terms.

   • [claimed-docs] “You can easily take a look at our code - reflecting our transparent and user-first approach. Check out our GitHub repository”
   • [claimed-docs] “Join our GitHub project and contribute to 2FAS by running code review and committing your ideas.”
   • [claimed-docs] “Check out our GitHub repository and delve deep into the intricacies of the browser extension back-end.”
   • [claimed-docs] “Freedom to self-host your data”
   • [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”

   proof ↗⚑ flag

4. ai-native userSelf-host the core product

   weight 3 · round to 2FAS
   Proton Pass—none0/10

   No evidence anywhere in the docs pack of a self-hosted server option; Proton Pass is offered only as a hosted SaaS with client apps, and community comments confirm only the client apps are open source while the backend/server is closed ('only the clients are open source').

   • [community] “It seems only the clients are open source? https://github.com/orgs/protonpass/repositories”
   • [community] “Am I correct in believing that they haven't open-sourced Proton Pass yet?... Their official announcement post says it's now open source, how…”

   proof ↗⚑ flag

   2FAS~partialcommunity6/10

   2FAS explicitly markets 'Freedom to self-host your data' and lets users choose their own cloud/WebDAV/external drive storage for vaults, and the core apps are open-source on GitHub for self-hosting/auditing. However, this is self-hosting of data/storage, not the full core service (no self-hostable server/backend, no API for self-managed infrastructure), and community commentary questions how this differs meaningfully from server-reliant competitors. Missing for 10: a self-hostable backend/server component, documentation of running the whole product on own infrastructure, and independent confirmation that self-hosted storage removes all vendor dependency.

   • [claimed-docs] “You decide where to store your Items. You can store it in your own cloud or keep it as an encrypted file on an external drive.”
   • [claimed-docs] “Freedom to self-host your data”
   • [claimed-docs] “You can easily take a look at our code - reflecting our transparent and user-first approach. Check out our GitHub repository”
   • [community] “Skeptical about 'local-only' claim: 2FAS Pass supports backups to iCloud, WebDAV and local file, meaning passwords rely on a server's securi…”

   proof ↗⚑ flag

Storage

1. everyday userThe app stores passkeys and signs me into websites and apps with them, not just TOTP codes

   weight 3 · round to Proton Pass
   Proton Pass~partialclaimed6/10

   Docs confirm Proton Pass supports passkeys for passwordless authentication and separately supports TOTP code generation, indicating both capabilities coexist rather than TOTP-only. However, there is no detailed description of the sign-in autofill flow for passkeys or independent/hands-on confirmation that passkey sign-in works reliably across sites/apps. Missing for 10: hands-on/community validation of passkey autofill and sign-in success, cross-platform passkey sync confirmation, and detail on browser/app integration for passkey use.

   • [claimed-docs] “Passkeys allow you to authenticate yourself for online accounts without using passwords or passphrases.”
   • [claimed-docs] “Proton Pass can securely generate TOTP codes for websites that you have saved login details for.”

   proof ↗⚑ flag

   2FAS—none0/10

   2FAS is a TOTP authenticator (2FAS Auth) and separately a password manager (2FAS Pass); evidence covers token/2FA codes, vault items, and password autofill, but nothing describes passkey (WebAuthn/FIDO2) storage or passkey-based sign-in to websites/apps.

   ⚑ flag

Sync

1. power userMy passkeys sync across ecosystems — iOS, Android, Windows, Linux, browsers — instead of being locked to one platform vendor

   weight 2 · round to Proton Pass
   Proton Pass~partialcommunity4/10

   Proton Pass confirms passkey support (proton-pass-docs-8) and offers apps across iOS, Android, browsers, and a desktop app (with offline access per proton-pass-docs-9), implying cross-platform sync of vault items including passkeys. However, there's no explicit documentation confirming passkeys specifically sync across all platforms (vs. just being stored), and community comments note desktop app limitations/lack thereof at the time (proton-pass-comm-2, proton-pass-comm-14), raising doubt about full ecosystem parity. Missing for 10: explicit cross-platform passkey sync confirmation, Linux/Windows native app evidence beyond browser extensions, and independent hands-on verification that passkeys created on one platform are usable on another.

   • [claimed-docs] “Passkeys allow you to authenticate yourself for online accounts without using passwords or passphrases.”
   • [claimed-docs] “You don’t need to do anything to access Proton Pass offline. Everything in your vaults is accessible whether you’re connected to the interne…”
   • [community] “If you are paying for Pass Plus or Proton Unlimited then you have integrated 2FA/TOTP which Bitwarden also makes you pay for... And no deskt…”
   • [community] “Pity it's only available on iOS and Android as apps and as browser extensions elsewhere. I would've been interested to check out a desktop p…”

   proof ↗⚑ flag

   2FAS—none0/10

   The evidence pack describes 2FAS Auth's 2FA token sync and 2FAS Pass's password vault sync (iCloud, Google Drive, WebDAV, browser extension) but contains no mention of 'passkey' or WebAuthn/FIDO2 credential support or storage anywhere. Since passkey sync is a distinct capability from OTP tokens or password items, there's no evidence this product delivers it.

   ⚑ flag

Export

1. power userExport all my TOTP secrets in an open, readable format and leave for another app whenever I choose — no lock-in

   weight 3 · round to 2FAS
   Proton Pass~partialclaimed5/10

   Proton Pass docs confirm a general data-export feature with multiple output options (PGP-encrypted ZIP, unencrypted ZIP, CSV), which supports the 'open, readable format' portability need, but no evidence explicitly confirms that TOTP secrets/seeds specifically are included in these exports (as opposed to being locked to Proton's own TOTP display). No community or hands-on report verifies successful TOTP secret export and re-import elsewhere. missing for 10: explicit confirmation that TOTP seeds are included in CSV/JSON export, independent verification that exported TOTP secrets can be imported into another app.

   • [claimed-docs] “If you want to use your passwords elsewhere or create a separate hardcopy, you can easily export your data from Proton Pass.”
   • [claimed-docs] “You have three options for export: 1. A ZIP file containing a PGP-encrypted JSON file 2. An unencrypted ZIP file 3. A CSV file”
   • [claimed-docs] “Proton Pass can securely generate TOTP codes for websites that you have saved login details for.”

   proof ↗⚑ flag

   2FAS~partialclaimed6/10

   2FAS explicitly supports imports from other apps (Aegis, Raivo, Google Authenticator, etc.) and offers 2FAS export files for backup/sync, with optional password-based encryption of backups. However, evidence doesn't confirm the export format is an open/readable standard (e.g., plaintext otpauth URIs or documented JSON schema) rather than a proprietary encrypted blob, and there's no explicit statement about exporting TO other apps' formats for migration away from 2FAS. missing for 10: documented open/standard export format spec, explicit 'export to other apps' migration path, independent confirmation the export file is human-readable/portable.

   • [claimed-docs] “We support imports from Aegis, Raivo, LastPassAegis, Stratum (formerly Authenticator Pro) and Google Authenticator.”
   • [claimed-docs] “Synchronize your Tokens with 2FAS export files, iCloud or Google Drive.”
   • [claimed-docs] “data can be encrypted with your password, so we encourage you to do that.”

   proof ↗⚑ flag

Import

1. power userImport tokens in bulk from other authenticator apps instead of re-enrolling every account by hand

   weight 2 · round to 2FAS
   Proton Pass~partialclaimed4/10

   Proton Pass documents a general import tool that migrates passwords and other items from most major password managers, and it can generate TOTP codes for saved logins, but there is no explicit evidence of bulk import specifically from dedicated authenticator apps or of preserving TOTP secrets during that import process. missing for 10: explicit documentation of bulk TOTP import from authenticator apps, confirmation that the import tool carries over 2FA secrets rather than just passwords, independent or hands-on confirmation of successful token migration.

   • [claimed-docs] “With our import tool, you can migrate passwords and other items from most major password managers in just a few minutes.”
   • [claimed-docs] “Unlike other password managers, Proton Pass uses end-to-end encryption on every field you fill for the items you create (usernames, website …”
   • [claimed-docs] “Proton Pass can securely generate TOTP codes for websites that you have saved login details for.”

   proof ↗⚑ flag

   2FAS~partialclaimed6/10

   2FAS docs explicitly list bulk import support from Aegis, Raivo, LastPassAegis, Stratum, and Google Authenticator, directly supporting the power-user portability story. However, the list is limited to a handful of named apps, no evidence of a generic/universal import format (e.g., OTP URI batch, QR export from arbitrary apps), and no independent hands-on verification of the import process working smoothly. Missing for 10: broader import coverage beyond five named apps, independent/community confirmation of successful bulk import, and details on edge cases (e.g., failed imports, partial data loss).

   • [claimed-docs] “We support imports from Aegis, Raivo, LastPassAegis, Stratum (formerly Authenticator Pro) and Google Authenticator.”

   proof ↗⚑ flag

Migration

1. everyday userMoving to a new phone transfers all my tokens in one guided step

   weight 2 · round to 2FAS
   Proton Pass~partialclaimed3/10

   Proton Pass stores TOTP secrets in E2E-encrypted vaults that sync via the cloud (docs-5, docs-9, docs-16), which implies that logging into a new phone would pull down existing 2FA tokens, but no evidence explicitly documents a guided 'new device setup' or migration wizard for phones. The only explicit migration flows described are import/export between different password manager products (docs-3, docs-4, docs-11), not device-to-device transfer. missing for 10: explicit documentation of a phone-to-phone onboarding/migration step, confirmation that TOTP tokens sync automatically without manual re-entry, and any hands-on account of switching phones.

   • [claimed-docs] “Proton Pass can securely generate TOTP codes for websites that you have saved login details for.”
   • [claimed-docs] “You don’t need to do anything to access Proton Pass offline. Everything in your vaults is accessible whether you’re connected to the interne…”
   • [claimed-docs] “Vaults can be used to organize items — in the example above, we have a vault for personal items and one for work items.”

   proof ↗⚑ flag

   2FAS✓fullclaimed7/10

   2FAS Auth supports iCloud/Google Drive sync and encrypted export/backup files, letting a user restore tokens on a new device by simply enabling sync or importing the backup file, and 2FAS Pass has a dedicated recovery flow for restoring the vault on a different device via iCloud/Google Drive backups. missing for 10: a documented single-tap 'migrate to new phone' wizard UI and independent hands-on confirmation of the transfer experience.

   • [claimed-docs] “Synchronize your Tokens with 2FAS export files, iCloud or Google Drive.”
   • [claimed-docs] “data can be encrypted with your password, so we encourage you to do that.”
   • [claimed-docs] “Multi-device sync (encrypted)”
   • [claimed-docs] “Learn how to restore access to your 2FAS Pass Vault or run it on a different device.”
   • [claimed-docs] “If you have enabled sync with iCloud (on iOS) or Google Drive (on Android), your encrypted 2FAS Pass Vault file is right there.”

   proof ↗⚑ flag

1. ai-native userChoose where my data is stored (region/residency)

   weight 2 · round to 2FAS
   Proton Pass—none0/10

   No evidence pack item mentions data residency, regional data storage options, or any control over where user data is physically stored; Proton Pass docs cover encryption, vaults, CLI, and export but not region selection. Missing for 10: any documentation of data residency/region choice, EU-only or multi-region storage options, or admin controls for data location.

   ⚑ flag

   2FAS~partialcommunity7/10

   2FAS is local-first: users choose to keep data on-device, in their own iCloud/Google Drive, WebDAV, or fully self-hosted, giving strong control over storage location (2fas-docs-5, 2fas-docs-14, 2fas-docs-17). This satisfies the spirit of data residency choice, though it's not a formal 'select region/datacenter' feature and relies on user-configured third-party clouds rather than a first-party regional hosting option. Missing for 10: explicit region/datacenter selection controls, independent verification of self-host setup beyond marketing pages.

   • [claimed-docs] “You decide where to store your Items. You can store it in your own cloud or keep it as an encrypted file on an external drive.”
   • [claimed-docs] “Freedom to self-host your data”
   • [claimed-docs] “Multi-device sync (encrypted)”
   • [claimed-docs] “data can be encrypted with your password, so we encourage you to do that.”
   • [community] “Skeptical about 'local-only' claim: 2FAS Pass supports backups to iCloud, WebDAV and local file, meaning passwords rely on a server's securi…”

   proof ↗⚑ flag

2. ai-native userPrevent my data from being used to train AI models

   weight 3 · round drawn
   Proton Pass~partialclaimed4/10

   Proton Pass's end-to-end encryption of all vault fields (docs-10) structurally means Proton cannot access plaintext user data, which would prevent it from being used to train AI models, but there is no explicit policy statement addressing AI training data use. Missing for 10: an explicit privacy policy or documentation statement about AI training opt-out/data usage, and independent confirmation of this claim.

   • [claimed-docs] “Unlike other password managers, Proton Pass uses end-to-end encryption on every field you fill for the items you create (usernames, website …”

   proof ↗⚑ flag

   2FAS~partialprobed4/10

   2FAS is local-first with explicit 'no telemetry' claims and no public API for data collection (2fas-probe-rt-1, 2fas-probe-rt-2), which implies user data isn't centrally harvested and thus couldn't feed AI training pipelines. However, there is no explicit statement addressing AI model training or an opt-out policy specifically. Missing for 10: explicit AI-training data policy/opt-out statement, independent confirmation that no data is ever sent to third-party AI services.

   • [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”
   • [probe] “PROBE runtime (recorded 2026-09-15): machine-readable pricing verified live at https://2fas.com/.well-known/pricing.md — '# 2FAS Pricing... …”

   proof ↗⚑ flag

3. ai-native userControl data retention and deletion

   weight 2 · round to 2FAS
   Proton Pass~partialclaimed5/10

   Docs show users can create/read/update/delete vaults and items via the CLI/app, and can export or migrate data before deleting it, giving concrete control over stored data. However there is no explicit documentation on account-level data retention policies, deletion timelines, or how long Proton retains deleted data, which is central to a full 'control retention and deletion' story. Missing for 10: explicit retention-period/account-deletion policy documentation, independent confirmation that deleted data is purged.

   • [claimed-docs] “Create, read, update, and delete vaults”
   • [claimed-docs] “View, create, update, and delete items including passwords, secure notes, credit cards, identities, WiFi entries, custom items, and stored S…”
   • [claimed-docs] “If you want to use your passwords elsewhere or create a separate hardcopy, you can easily export your data from Proton Pass.”
   • [claimed-docs] “You have three options for export: 1. A ZIP file containing a PGP-encrypted JSON file 2. An unencrypted ZIP file 3. A CSV file”

   proof ↗⚑ flag

   2FAS~partialprobed6/10

   2FAS gives users explicit control over where data is stored (own cloud, external drive, self-hosting) and confirms no telemetry/tracking, which supports retention control (2fas-docs-5, 2fas-docs-14, 2fas-probe-rt-2). However there is no explicit documentation of a deletion/erasure workflow, data-retention policy, or account-deletion mechanism beyond implied local file control. Missing for 10: explicit data deletion/right-to-erasure documentation, retention period policy, and independent confirmation that deleting local/cloud copies fully removes data.

   • [claimed-docs] “You decide where to store your Items. You can store it in your own cloud or keep it as an encrypted file on an external drive.”
   • [claimed-docs] “Freedom to self-host your data”
   • [claimed-docs] “data can be encrypted with your password, so we encourage you to do that.”
   • [probe] “PROBE runtime (recorded 2026-09-15): machine-readable pricing verified live at https://2fas.com/.well-known/pricing.md — '# 2FAS Pricing... …”

   proof ↗⚑ flag

4. ai-native userOpt out of telemetry and usage tracking

   weight 2 · round to 2FAS
   Proton Pass~partialcommunity4/10

   Community evidence confirms telemetry exists in the browser extension and can be disabled, but only via Proton account settings, not directly within the extension itself, indicating a real but limited opt-out mechanism (proton-pass-comm-13). No first-party documentation from Proton Pass describes a formal telemetry/opt-out policy or setting. missing for 10: official docs on telemetry settings, in-extension opt-out toggle, confirmation of no tracking by default.

   • [community] “There's still nothing about the telemetry in the browser extension?... telemetry data is anonymous, but it's always sent to the remote endpo…”

   proof ↗⚑ flag

   2FAS✓fullprobed8/10

   2FAS explicitly states in its machine-readable pricing/docs that 2FAS Auth has 'no advertising, no telemetry,' meaning tracking is absent by design rather than requiring opt-out, and the product is positioned as local-first/open-source, reinforcing a privacy-first posture. Missing for 10: no explicit dedicated privacy-settings toggle documentation, and no independent audit confirming zero telemetry across 2FAS Pass as well as Auth.

   • [probe] “PROBE runtime (recorded 2026-09-15): machine-readable pricing verified live at https://2fas.com/.well-known/pricing.md — '# 2FAS Pricing... …”
   • [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”

   proof ↗⚑ flag

App lock

1. everyday userThe app itself locks behind biometrics or a PIN, so a borrowed phone doesn't expose my codes

   weight 2 · round drawn
   Proton Pass—none0/10

   No evidence pack item mentions app-level biometric or PIN lock for Proton Pass; the closest related items cover offline vault access, 2FA/TOTP generation, and encryption, but none address a lock screen or app-level authentication gate. Missing for 10: any mention of biometric unlock, app PIN lock, or auto-lock timeout feature.

   ⚑ flag

   2FAS—none0/10

   The evidence pack describes 2FAS Pass's tiered security and sync options, and confirms access to the browser extension/autofill must be approved in-app, but nowhere states that the 2FAS Auth or Pass app itself can be locked behind biometrics or a PIN to block access if the phone is borrowed. No docs or community evidence mention an app-lock/biometric-gate feature for the authenticator itself.

   • [claimed-docs] “2FAS Pass supports 3 Security Tiers for protecting your Items.”
   • [claimed-docs] “Access through the Browser Extension or using Autofill must be confirmed in 2FAS Pass.”

   proof ↗⚑ flag

Audits

1. security engineerThe vendor publishes independent security audits of the app and its sync protocol

   weight 2 · round drawn
   Proton Pass—none0/10

   No evidence of any independent third-party security audit report, pentest, or audit of the sync protocol; evidence only covers feature docs (encryption claims, Sentinel, Monitor) and open-source status debates in community threads. Community comments even question whether the client is fully open source, but no audit report is cited or linked anywhere.

   ⚑ flag

   2FAS—none0/10

   Evidence shows only open-source code availability claims and general transparency messaging, with no mention of independent third-party security audits of the app or its sync protocol; community discussion even questions the trust model of cloud-based sync without referencing any audit report.

   • [claimed-docs] “You can easily take a look at our code - reflecting our transparent and user-first approach. Check out our GitHub repository”
   • [claimed-docs] “Join our GitHub project and contribute to 2FAS by running code review and committing your ideas.”
   • [community] “Skeptical about 'local-only' claim: 2FAS Pass supports backups to iCloud, WebDAV and local file, meaning passwords rely on a server's securi…”

   proof ↗⚑ flag

Monitoring

1. power userThe app warns me when a service I use is breached or a stored credential is weak, reused, or exposed

   weight 2 · round to Proton Pass
   Proton Pass✓fullclaimed8/10

   Pass Monitor explicitly scans the dark web for credential leaks (breach detection), checks password health (weak/reused detection), and flags accounts missing 2FA, directly matching the story; this is documented as a core built-in feature rather than a third-party tool. Missing for 10: independent hands-on verification of Pass Monitor's accuracy/coverage and detail on exposed-credential alerting granularity beyond docs claims.

   • [claimed-docs] “Pass Monitor is a security feature in Proton Pass that scans the dark web for credential leaks, checks on the health of your passwords, and …”
   • [claimed-docs] “Pass Monitor is a security feature in Proton Pass that scans the dark web for credential leaks, checks on the health of your passwords, and …”
   • [claimed-docs] “Proton Sentinel uses AI and human analysis to make it much harder for an attacker to take over your account.”
   • [claimed-docs] “Proton Sentinel is an advanced account protection program that provides maximum security for those who need it. It mitigates security threat…”

   proof ↗⚑ flag

   2FAS—none0/10

   No evidence of breach monitoring, weak/reused/exposed password detection, or security-posture alerts anywhere in the docs, community reports, or probes; 2FAS's evidence covers sync, tiers, self-hosting, and import/export but nothing about credential health warnings or breach alerts.

   ⚑ flag

Push

1. it adminPush-based sign-in includes phishing defenses — number matching, location context, and admin-enforced MFA policies

   weight 2 · round drawn
   Proton Pass—none0/10

   The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)

   ⚑ flag

   2FAS—none0/10

   The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)

   ⚑ flag

Server

1. it adminSelf-host the sync server on my own infrastructure and keep every secret inside my perimeter

   weight 2 · round to 2FAS
   Proton Pass—none0/10

   The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)

   ⚑ flag

   2FAS~partialcommunity4/10

   2FAS advertises 'freedom to self-host your data' and lets users choose where encrypted vault/token data lives (own cloud, WebDAV, external drive) rather than relying on 2FAS-hosted storage, which partially satisfies the perimeter-control need. However there is no evidence of an actual downloadable/self-hostable 'sync server' component (e.g. a Vaultwarden-style server binary) — it's more bring-your-own-storage for encrypted files/backups, and community commentary explicitly questions whether this differs meaningfully from relying on third-party server infrastructure. Missing for 10: a dedicated self-hosted sync-server artifact/deployment docs, and independent confirmation that all sync traffic stays fully within admin-controlled infra.

   • [claimed-docs] “You decide where to store your Items. You can store it in your own cloud or keep it as an encrypted file on an external drive.”
   • [claimed-docs] “Freedom to self-host your data”
   • [community] “Skeptical about 'local-only' claim: 2FAS Pass supports backups to iCloud, WebDAV and local file, meaning passwords rely on a server's securi…”

   proof ↗⚑ flag

Source

1. security engineerThe client apps are open source, so the code handling my seeds can be inspected and community-reviewed

   weight 2 · round to 2FAS
   Proton Pass~partialcommunity6/10

   Community evidence confirms Proton Pass clients are open source with a public GitHub repo (github.com/protonpass), directly supporting inspectability of the code handling secrets. However, other community comments show confusion/skepticism about finding or verifying this ('haven't been able to find the repository', 'it seems only the clients are open source'), and there's no first-party doc in the pack explicitly stating open-source status or citing security audits. Missing for 10: first-party documentation confirming open-source licensing/repo, evidence of independent security audits or community code review of the seed-handling logic, and clarity on scope (client-only vs. broader).

   • [community] “Please note that we do have encrypted notes... And it is open source: https://github.com/protonpass”
   • [community] “It seems only the clients are open source? https://github.com/orgs/protonpass/repositories”
   • [community] “Am I correct in believing that they haven't open-sourced Proton Pass yet?... Their official announcement post says it's now open source, how…”

   proof ↗⚑ flag

   2FAS✓fullprobed8/10

   2FAS explicitly markets itself as open-source and points to a public GitHub repo for code review, including for the browser extension backend ('delve deep into the intricacies'), and invites community contribution/code review. The core apps (2FAS Auth, described as 'Free, Open-source 2FA Authenticator App') are confirmed open-source via probe data. Missing for 10: no independent security audit report or third-party code-review corroboration is cited, and evidence doesn't explicitly confirm the mobile app repos (vs. just extension) are inspectable.

   • [claimed-docs] “You can easily take a look at our code - reflecting our transparent and user-first approach. Check out our GitHub repository”
   • [claimed-docs] “Join our GitHub project and contribute to 2FAS by running code review and committing your ideas.”
   • [claimed-docs] “Check out our GitHub repository and delve deep into the intricacies of the browser extension back-end.”
   • [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”

   proof ↗⚑ flag

Automation

1. ai-native userAn agent can fetch a current TOTP code programmatically — via CLI or API — to complete a 2FA login inside an automated workflow

   weight 2 · round to Proton Pass
   Proton Pass~partialprobed4/10

   Proton Pass ships an official CLI documented for scripting/CI-CD use that can 'securely retrieve secrets and other items' (docs-1/14) and lists item types it can read (docs-15), but TOTP/2FA codes are not explicitly named among the retrievable item types, and no docs or community evidence confirm a CLI/API command that outputs a live TOTP code for use in an automated login flow. missing for 10: explicit CLI/API command or output field for TOTP codes, hands-on confirmation of an agent successfully pulling a 2FA code programmatically.

   • [claimed-docs] “enables you to securely retrieve secrets and other items across scripts, deployments, and continuous integration/ continuous delivery (CI/CD…”
   • [claimed-docs] “the CLI enables you to securely retrieve secrets and other items across scripts, deployments, and continuous integration/ continuous deliver…”
   • [claimed-docs] “View, create, update, and delete items including passwords, secure notes, credit cards, identities, WiFi entries, custom items, and stored S…”
   • [claimed-docs] “Proton Pass can securely generate TOTP codes for websites that you have saved login details for.”
   • [probe] “official CLI documented at https://proton.me/blog/proton-pass-cli”

   proof ↗⚑ flag

   2FAS—none0/10

   The evidence explicitly states 2FAS has no public API for programmatic TOTP retrieval ('Public API: None — local-first by design, no agent-callable endpoint for token generation'), and no CLI is documented anywhere in the pack; OpenAPI probes all 404. This directly rules out agent-driven fetching of TOTP codes via CLI or API.

   • [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”
   • [probe] “PROBE openapi: all candidate paths 404 (https://2fas.com/openapi.json, https://2fas.com/swagger.json, https://2fas.com/api/openapi.json, htt…”

   proof ↗⚑ flag

2. ai-native userExpose the vault through a local programmatic endpoint an agent can query for codes and secrets without screen-scraping the app

   weight 1 · round to Proton Pass
   Proton Pass~partialprobed6/10

   Proton Pass ships an official CLI that allows secure programmatic retrieval of secrets, passwords, SSH keys, and other items across scripts and CI/CD pipelines, which functions as a local endpoint an agent could query instead of screen-scraping the app. However, the docs don't explicitly confirm TOTP/2FA code retrieval via the CLI (2FA generation is only described in the app itself), and there is no mention of an agent-specific or MCP-style interface, nor independent hands-on verification of CLI use by AI agents. Missing for 10: explicit CLI support for TOTP code retrieval, agent/MCP-oriented interface documentation, independent corroboration of CLI usage in agentic workflows.

   • [claimed-docs] “enables you to securely retrieve secrets and other items across scripts, deployments, and continuous integration/ continuous delivery (CI/CD…”
   • [claimed-docs] “the CLI enables you to securely retrieve secrets and other items across scripts, deployments, and continuous integration/ continuous deliver…”
   • [claimed-docs] “View, create, update, and delete items including passwords, secure notes, credit cards, identities, WiFi entries, custom items, and stored S…”
   • [claimed-docs] “Proton Pass can securely generate TOTP codes for websites that you have saved login details for.”
   • [probe] “official CLI documented at https://proton.me/blog/proton-pass-cli”

   proof ↗⚑ flag

   2FAS—none0/10

   The product's own llms.txt explicitly states 'Public API: None' and no OpenAPI/local endpoint was found; 2FAS is local-first by design with no agent-callable interface for querying codes or secrets programmatically.

   • [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”
   • [probe] “PROBE openapi: all candidate paths 404 (https://2fas.com/openapi.json, https://2fas.com/swagger.json, https://2fas.com/api/openapi.json, htt…”

   proof ↗⚑ flag

Browser

1. everyday userA browser extension autofills my TOTP codes and passkeys during login instead of making me retype them

   weight 2 · round to Proton Pass
   Proton Pass✓fullcommunity8/10

   Docs confirm TOTP code generation for saved logins and passkey support, and community evidence from an actual user confirms the browser extension autofills TOTP/2FA smoothly ('Proton Pass is my default for all 2FA. I love the browser extension, so easy and sleek'). Passkey autofill is documented but not independently corroborated with hands-on testing. Missing for 10: independent hands-on confirmation of passkey autofill specifically, and more detail on passkey UX in the extension.

   • [claimed-docs] “Proton Pass can securely generate TOTP codes for websites that you have saved login details for.”
   • [claimed-docs] “Passkeys allow you to authenticate yourself for online accounts without using passwords or passphrases.”
   • [community] “I've been a Proton Unlimited subscriber... Proton Pass is my default for all 2FA. I love the browser extension, so easy and sleek.”
   • [community] “If you are paying for Pass Plus or Proton Unlimited then you have integrated 2FA/TOTP which Bitwarden also makes you pay for... And no deskt…”

   proof ↗⚑ flag

   2FAS✓fullcommunity7/10

   2FAS's browser extension is documented to autofill TOTP tokens with confirmation via the mobile app ('You don't have to retype anything'), and the 2FAS Pass extension supports autofill for passwords/passkeys confirmed in the vault app, with the free tier confirmed by community reports to include auto-fill. However, evidence is vendor-documented with only partial independent corroboration and no explicit hands-on confirmation of passkey autofill specifically working smoothly in-browser. Missing for 10: independent hands-on validation of passkey autofill UX, more detail on cross-browser support, and confirmation of friction-free flow beyond vendor claims.

   • [claimed-docs] “Click the browser extension icon when you need to enter a 2FA token, then confirm in the mobile app. You don't have to retype anything.”
   • [claimed-docs] “Access through the Browser Extension or using Autofill must be confirmed in 2FAS Pass.”
   • [community] “Free tier of 2FAS Pass includes auto-fill, import/export, and standard password generator; paid tier adds multi-device sync, more than 200 v…”
   • [claimed-docs] “You can easily take a look at our code - reflecting our transparent and user-first approach. Check out our GitHub repository”

   proof ↗⚑ flag

Desktop

1. power userA first-class desktop app gives me codes and vault access on my computer, not just on mobile

   weight 2 · round to Proton Pass
   Proton Pass!disputedcontradicted5/10

   Proton's own support docs describe a dedicated desktop app with offline vault access and TOTP code generation (docs-9, docs-16, docs-5), suggesting a first-class desktop experience. However, community hands-on reports explicitly state there was no desktop app for Proton Pass ('And no desktop app for proton pass, maybe some day though?' and 'Pity it's only available on iOS and Android as apps and as browser extensions elsewhere'), directly contradicting the vendor's desktop-app documentation. Missing for 10: independent corroboration that the desktop app actually exists and works as described, and resolution of the timeline discrepancy between docs and community reports.

   • [claimed-docs] “You don’t need to do anything to access Proton Pass offline. Everything in your vaults is accessible whether you’re connected to the interne…”
   • [claimed-docs] “Vaults can be used to organize items — in the example above, we have a vault for personal items and one for work items.”
   • [claimed-docs] “Proton Pass can securely generate TOTP codes for websites that you have saved login details for.”
   • [community] “If you are paying for Pass Plus or Proton Unlimited then you have integrated 2FA/TOTP which Bitwarden also makes you pay for... And no deskt…”
   • [community] “Pity it's only available on iOS and Android as apps and as browser extensions elsewhere. I would've been interested to check out a desktop p…”

   proof ↗⚑ flag

   2FAS—none0/10

   Evidence only shows mobile apps (iOS/Android) plus a browser extension, and the extension explicitly requires confirmation via the mobile app (2fas-docs-3, 2fas-docs-19) rather than functioning as an independent desktop client. No native desktop app for code generation or vault access is documented anywhere in the pack.

   • [claimed-docs] “Click the browser extension icon when you need to enter a 2FA token, then confirm in the mobile app. You don't have to retype anything.”
   • [claimed-docs] “Access through the Browser Extension or using Autofill must be confirmed in 2FAS Pass.”
   • [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”

   proof ↗⚑ flag

Watch

1. everyday userRead my codes from my smartwatch without pulling out my phone

   weight 1 · round to 2FAS
   Proton Pass—none0/10

   No evidence of a smartwatch app, watch companion, or complication for viewing TOTP codes; evidence only covers mobile, browser extension, and CLI surfaces, with community notes even lamenting lack of a desktop app. Missing for 10: any smartwatch app/companion, watch complication, or documentation of viewing codes without the phone.

   • [claimed-docs] “Proton Pass can securely generate TOTP codes for websites that you have saved login details for.”
   • [community] “Pity it's only available on iOS and Android as apps and as browser extensions elsewhere. I would've been interested to check out a desktop p…”

   proof ↗⚑ flag

   2FAS~partialclaimed5/10

   2FAS explicitly markets 'Apple Watch — Improved convenience and accessibility' as a feature, indicating watch support exists, but there's no detail on what functionality is available on the watch (e.g., whether codes are viewable standalone or require phone proximity) and no independent/hands-on confirmation of the experience. missing for 10: details on watch app functionality/UX, confirmation codes can be read without unlocking phone, independent hands-on review of the watch experience.

   • [claimed-docs] “Apple Watch Improved convenience and accessibility.”
   • [claimed-docs] “Apple WatchImproved convenience and accessibility.”

   proof ↗⚑ flag

Backup

1. security engineerBackups are end-to-end encrypted with a key the vendor never holds, and the encryption design is documented

   weight 3 · round to Proton Pass
   Proton Pass~partialclaimed5/10

   Proton Pass documents that all vault data is end-to-end encrypted (docs-10) and offers a PGP-encrypted export option that could serve as a backup (docs-11), implying the vendor cannot read backed-up data. However, there is no dedicated 'backup' feature documentation (only export/import), and no detailed cryptographic architecture whitepaper or independent audit is cited to substantiate the zero-knowledge key design in depth. missing for 10: dedicated backup-feature docs, detailed encryption architecture/whitepaper, independent security audit confirming vendor never holds keys

   • [claimed-docs] “Unlike other password managers, Proton Pass uses end-to-end encryption on every field you fill for the items you create (usernames, website …”
   • [claimed-docs] “You have three options for export: 1. A ZIP file containing a PGP-encrypted JSON file 2. An unencrypted ZIP file 3. A CSV file”
   • [claimed-docs] “Vaults can be used to organize items — in the example above, we have a vault for personal items and one for work items.”

   proof ↗⚑ flag

   2FAS~partialcommunity4/10

   2FAS documents that backups/sync can be encrypted with a user password (docs-9, docs-17, docs-18) and that vault storage location is user-controlled, but the encryption is presented as optional ('we encourage you to do that') rather than guaranteed end-to-end by default, and there is no detailed technical whitepaper describing key derivation, zero-knowledge architecture, or threat model. Community discussion (2fas-comm-1) explicitly questions whether backups to iCloud/WebDAV truly avoid vendor/server trust, further undercutting a strong E2E claim. missing for 10: a dedicated cryptographic design document (algorithms, key derivation, zero-knowledge proof), confirmation that encryption is mandatory/default rather than opt-in, and independent security audit corroboration.

   • [claimed-docs] “data can be encrypted with your password, so we encourage you to do that.”
   • [claimed-docs] “Multi-device sync (encrypted)”
   • [claimed-docs] “If you have enabled sync with iCloud (on iOS) or Google Drive (on Android), your encrypted 2FAS Pass Vault file is right there.”
   • [claimed-docs] “You decide where to store your Items. You can store it in your own cloud or keep it as an encrypted file on an external drive.”
   • [community] “Skeptical about 'local-only' claim: 2FAS Pass supports backups to iCloud, WebDAV and local file, meaning passwords rely on a server's securi…”

   proof ↗⚑ flag

Multi device

1. everyday userMy tokens are available on my phone, tablet, and computer at the same time, kept in sync automatically

   weight 2 · round to 2FAS
   Proton Pass~partialcommunity5/10

   Docs confirm cross-platform clients (mobile apps, browser extensions, and a desktop app referenced in the desktop-app guide) and offline access that presumably reconciles when back online, implying cloud sync of vault items including TOTP tokens. However, no first-party documentation explicitly describes the sync mechanism or guarantees real-time multi-device consistency, and community comments note a historical lack of a desktop app and inconsistent browser-extension availability (e.g., Firefox ESR incompatibility), suggesting platform coverage has been uneven over time. Missing for 10: explicit sync/consistency documentation, independent verification that sync is truly automatic and near-instant across phone/tablet/computer.

   • [claimed-docs] “You don’t need to do anything to access Proton Pass offline. Everything in your vaults is accessible whether you’re connected to the interne…”
   • [claimed-docs] “Proton Pass can securely generate TOTP codes for websites that you have saved login details for.”
   • [community] “If you are paying for Pass Plus or Proton Unlimited then you have integrated 2FA/TOTP which Bitwarden also makes you pay for... And no deskt…”
   • [community] “Pity it's only available on iOS and Android as apps and as browser extensions elsewhere. I would've been interested to check out a desktop p…”
   • [community] “Can't use the Firefox extension, FF 102 ESR is apparently too old”

   proof ↗⚑ flag

   2FAS~partialcommunity6/10

   2FAS documents syncing tokens across devices via iCloud/Google Drive and lists 'Multi-device sync (encrypted)' as a feature, and computer access is possible through a browser extension that confirms via the mobile app. However, this cross-device access relies on manual confirmation from the phone rather than tokens being independently and automatically available on a tablet/computer at all times, and multi-device sync appears gated behind a paid tier for the Pass product. Missing for 10: evidence of true simultaneous, always-available token access across phone/tablet/computer without per-use phone confirmation, and confirmation that Auth (not just Pass) multi-device sync is free and automatic.

   • [claimed-docs] “Synchronize your Tokens with 2FAS export files, iCloud or Google Drive.”
   • [claimed-docs] “Click the browser extension icon when you need to enter a 2FA token, then confirm in the mobile app. You don't have to retype anything.”
   • [claimed-docs] “Multi-device sync (encrypted)”
   • [community] “Free tier of 2FAS Pass includes auto-fill, import/export, and standard password generator; paid tier adds multi-device sync, more than 200 v…”

   proof ↗⚑ flag

Recovery

1. everyday userLosing my phone doesn't lose my accounts — a documented recovery path restores my tokens on a new device

   weight 3 · round to 2FAS
   Proton Pass~partialclaimed4/10

   Proton Pass stores TOTP codes and other secrets inside end-to-end encrypted vaults that live on Proton's servers (docs-5, docs-10), and offers export (docs-4/11) and Emergency Access (docs-20) features that could serve as backup/recovery mechanisms, implying data isn't lost with a device. However, there is no explicit documentation in the pack describing a dedicated 'lost phone / new device' recovery flow, account recovery phrase, or step-by-step restoration of 2FA tokens after device loss. Missing for 10: explicit account-recovery/recovery-phrase documentation, explicit cross-device sync confirmation, and a stated process for restoring TOTP secrets specifically after losing a device.

   • [claimed-docs] “Proton Pass can securely generate TOTP codes for websites that you have saved login details for.”
   • [claimed-docs] “Unlike other password managers, Proton Pass uses end-to-end encryption on every field you fill for the items you create (usernames, website …”
   • [claimed-docs] “If you want to use your passwords elsewhere or create a separate hardcopy, you can easily export your data from Proton Pass.”
   • [claimed-docs] “You have three options for export: 1. A ZIP file containing a PGP-encrypted JSON file 2. An unencrypted ZIP file 3. A CSV file”
   • [claimed-docs] “Emergency Access”

   proof ↗⚑ flag

   2FAS✓fullcommunity8/10

   2FAS documents multi-device sync via iCloud/Google Drive/encrypted export files for the Auth app, plus a dedicated recovery page explaining how to restore or run the Pass Vault on a new device using the cloud-synced encrypted vault file, and supports importing from other authenticator apps for migration scenarios. This directly addresses losing a phone and restoring tokens elsewhere, though community commentary raises trust questions about relying on third-party cloud storage rather than disputing that recovery works. Missing for 10: independent hands-on verification of the actual recovery flow succeeding, and clearer detail on recovery when no cloud sync was enabled beforehand.

   • [claimed-docs] “Synchronize your Tokens with 2FAS export files, iCloud or Google Drive.”
   • [claimed-docs] “Learn how to restore access to your 2FAS Pass Vault or run it on a different device.”
   • [claimed-docs] “If you have enabled sync with iCloud (on iOS) or Google Drive (on Android), your encrypted 2FAS Pass Vault file is right there.”
   • [claimed-docs] “data can be encrypted with your password, so we encourage you to do that.”
   • [claimed-docs] “We support imports from Aegis, Raivo, LastPassAegis, Stratum (formerly Authenticator Pro) and Google Authenticator.”
   • [community] “Skeptical about 'local-only' claim: 2FAS Pass supports backups to iCloud, WebDAV and local file, meaning passwords rely on a server's securi…”

   proof ↗⚑ flag

Automation

1. ai-native userAn agent can create and update vault entries — seeding new TOTP secrets, storing credentials — through documented programmatic surfaces

   weight 2 · round to Proton Pass
   Proton Pass~partialprobed6/10

   Proton Pass CLI documentation shows programmatic create/read/update/delete of items (including passwords, secure notes, SSH keys) and vaults, which an agent could invoke via scripts. However, there's no explicit mention of TOTP secret seeding via the CLI, and no dedicated agent/AI integration or API/SDK beyond the CLI is documented, and no independent confirmation of these CLI capabilities working reliably. Missing for 10: explicit TOTP-seeding support via CLI, broader API/SDK for agents, and independent hands-on verification of programmatic write operations.

   • [claimed-docs] “Create, read, update, and delete vaults”
   • [claimed-docs] “View, create, update, and delete items including passwords, secure notes, credit cards, identities, WiFi entries, custom items, and stored S…”
   • [claimed-docs] “the CLI enables you to securely retrieve secrets and other items across scripts, deployments, and continuous integration/ continuous deliver…”
   • [probe] “official CLI documented at https://proton.me/blog/proton-pass-cli”

   proof ↗⚑ flag

   2FAS—none0/10

   No programmatic API exists for creating/updating vault entries or seeding TOTP secrets; the product's own llms.txt explicitly states 'Public API: None' and openapi probes all 404, confirming no agent-callable surface for this workflow.

   • [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”
   • [probe] “PROBE openapi: all candidate paths 404 (https://2fas.com/openapi.json, https://2fas.com/swagger.json, https://2fas.com/api/openapi.json, htt…”

   proof ↗⚑ flag

Policy

1. it adminEnforce org-wide policies — require app lock, restrict export, mandate strong master credentials — across every member's app

   weight 1 · round drawn
   Proton Pass—none0/10

   No evidence of org-wide admin policy controls (enforced app lock, export restrictions, mandated master password strength) for organization members; docs cover vaults, CLI, export, 2FA, sharing but nothing about admin-enforced policies across a team.

   ⚑ flag

   2FAS—none0/10

   2FAS is a consumer-focused authenticator/password manager with no evidence of centralized org policy management, admin dashboards, enforced app-lock policies, export restrictions, or credential strength mandates across users; it is explicitly local-first with no public API for such control (2fas-probe-rt-1). No IT-admin console or MDM/policy feature is documented anywhere in the pack.

   • [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”
   • [claimed-docs] “Freedom to self-host your data”
   • [claimed-docs] “data can be encrypted with your password, so we encourage you to do that.”

   proof ↗⚑ flag

Sharing

1. it adminMy team can share TOTP-protected logins through shared vaults or collections with per-member access control

   weight 2 · round to Proton Pass
   Proton Pass~partialclaimed5/10

   Evidence confirms Proton Pass supports TOTP/2FA generation for saved logins (docs-5) and secure vault sharing plus vault-based organization of items (docs-16, docs-17), which together imply TOTP items can be shared via vaults. However, there is no documentation of granular per-member access control (roles/permissions) or 'collections' as a distinct sharing unit, and no team-admin console evidence for managing member access levels within shared vaults. Missing for 10: explicit permission-level (viewer/editor/admin) documentation for shared vaults, evidence of 'collections' as an admin feature, and any IT-admin console showing per-member access management.

   • [claimed-docs] “Proton Pass can securely generate TOTP codes for websites that you have saved login details for.”
   • [claimed-docs] “Vaults can be used to organize items — in the example above, we have a vault for personal items and one for work items.”
   • [claimed-docs] “Secure vault sharing”

   proof ↗⚑ flag

   2FAS—none0/10

   2FAS is positioned as a personal, local-first authenticator/password manager with individual sync (iCloud/Google Drive/self-host) and multi-device sync for a single user, not team/organization features. No evidence of shared vaults, collections, or per-member access control for an IT-admin-managed team; the HN community discussion even questions its single-user 'local-only' security model, but nothing addresses team sharing at all.

   • [claimed-docs] “Synchronize your Tokens with 2FAS export files, iCloud or Google Drive.”
   • [claimed-docs] “Multi-device sync (encrypted)”
   • [community] “Skeptical about 'local-only' claim: 2FAS Pass supports backups to iCloud, WebDAV and local file, meaning passwords rely on a server's securi…”
   • [community] “Free tier of 2FAS Pass includes auto-fill, import/export, and standard password generator; paid tier adds multi-device sync, more than 200 v…”

   proof ↗⚑ flag

Enrollment

1. everyday userScan a QR code and immediately start generating TOTP codes for a new account

   weight 3 · round drawn
   Proton Pass~partialcommunity5/10

   Docs confirm Proton Pass generates TOTP codes for saved logins (proton-pass-docs-5) and community reports use it as their default 2FA tool (proton-pass-comm-12), but no evidence explicitly describes scanning a QR code to add a new TOTP secret and instantly getting codes. Missing for 10: explicit QR-code scanning workflow documentation, mobile camera scan support evidence, and independent hands-on confirmation of the scan-to-code flow.

   • [claimed-docs] “Proton Pass can securely generate TOTP codes for websites that you have saved login details for.”
   • [community] “I've been a Proton Unlimited subscriber... Proton Pass is my default for all 2FA. I love the browser extension, so easy and sleek.”

   proof ↗⚑ flag

   2FAS~partialprobed5/10

   2FAS Auth is a well-known TOTP app and docs reference connecting accounts via video tutorials, but the evidence pack lacks any direct documentation or hands-on confirmation of the core QR-scan-to-code-generation flow. missing for 10: explicit documentation/screenshots of QR scanning UX, confirmation that codes generate immediately post-scan, independent/hands-on corroboration of the onboarding flow.

   • [claimed-docs] “use our quick and easy-to-follow video tutorials to connect your online accounts.”
   • [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”

   proof ↗⚑ flag

Offline

1. power userCodes generate fully offline — no network, no vendor account required just to see my TOTP codes

   weight 2 · round to 2FAS
   Proton Pass—none0/10

   Proton Pass is fundamentally an account-based, encrypted-vault service — using it at all requires creating and logging into a Proton account, and TOTP codes are stored as fields within account-synced vaults. Evidence only shows that once logged in, offline access to already-synced vaults works (proton-pass-docs-9), but nothing supports generating/viewing TOTP codes without ever creating or authenticating a vendor account, which the story explicitly requires.

   • [claimed-docs] “You don’t need to do anything to access Proton Pass offline. Everything in your vaults is accessible whether you’re connected to the interne…”
   • [claimed-docs] “Proton Pass can securely generate TOTP codes for websites that you have saved login details for.”

   proof ↗⚑ flag

   2FAS✓fullprobed8/10

   2FAS Auth is described as open-source, local-first with no public API for token generation, and pricing docs confirm it's free with no telemetry, consistent with fully offline TOTP generation without vendor account requirement. Community evidence questions cloud-sync/backup security but this concerns 2FAS Pass (password manager), not the core Auth TOTP generation flow. missing for 10: independent hands-on confirmation that TOTP codes generate with device fully offline (airplane mode test), and explicit documentation stating no account/signup is ever required.

   • [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”
   • [probe] “PROBE runtime (recorded 2026-09-15): machine-readable pricing verified live at https://2fas.com/.well-known/pricing.md — '# 2FAS Pricing... …”
   • [claimed-docs] “data can be encrypted with your password, so we encourage you to do that.”

   proof ↗⚑ flag

Organization

1. power userKeep dozens of tokens organized — search, folders or groups, and service icons — so the right code is always two taps away

   weight 2 · round to 2FAS
   Proton Pass~partialcommunity4/10

   Proton Pass supports TOTP generation tied to saved logins and vaults for organizing items into groups (e.g., personal vs. work), but there is no evidence of search functionality or service icons, and a community report explicitly notes the browser popup overlay was inadequate for managing hundreds of logins, suggesting scaling friction for power users. Missing for 10: dedicated TOTP search/filter feature, service icon display, and evidence of smooth navigation across dozens of tokens.

   • [claimed-docs] “Proton Pass can securely generate TOTP codes for websites that you have saved login details for.”
   • [claimed-docs] “Vaults can be used to organize items — in the example above, we have a vault for personal items and one for work items.”
   • [community] “Would like to see web/desktop clients for this. When I used it recently I found the unexpandable pop-up overlay in the browser to not be ade…”

   proof ↗⚑ flag

   2FAS~partialclaimed6/10

   Docs confirm token customization with 'full control over groups, badges, icons, and labels' and Apple Watch access, directly supporting organization by groups/icons for quick access, but there is no mention of search functionality within the token list, no detail on folder/group UX depth, and no independent hands-on account of managing 'dozens of tokens' at scale. missing for 10: explicit search feature evidence, hands-on/independent validation of organization UX at scale, deeper detail on folder vs group implementation.

   • [claimed-docs] “Token customization Full control over the groups, badges, icons, and labels.”
   • [claimed-docs] “Token customizationFull control over the groups, badges, icons, and labels.”
   • [claimed-docs] “Apple Watch Improved convenience and accessibility.”
   • [claimed-docs] “Apple WatchImproved convenience and accessibility.”

   proof ↗⚑ flag

Variants

1. power userNon-standard tokens work too — Steam Guard, HOTP counters, custom periods and digit lengths

   weight 2 · round drawn
   Proton Pass—none0/10

   Evidence only confirms basic TOTP code generation for saved logins; no mention of Steam Guard tokens, HOTP counters, or custom period/digit length support anywhere in the docs or community discussion. Missing for 10: any documentation of Steam Guard support, HOTP counter-based tokens, or custom TOTP period/digit configuration.

   • [claimed-docs] “Proton Pass can securely generate TOTP codes for websites that you have saved login details for.”

   proof ↗⚑ flag

   2FAS—none0/10

   No evidence in the pack addresses Steam Guard tokens, HOTP counter-based codes, or custom period/digit-length configuration for 2FAS Auth — the docs only mention generic 'token customization' for groups/badges/icons/labels, which is unrelated to non-standard token algorithms.

   • [claimed-docs] “Token customization Full control over the groups, badges, icons, and labels.”
   • [claimed-docs] “Token customizationFull control over the groups, badges, icons, and labels.”

   proof ↗⚑ flag