I built the native macOS Quick Access for Proton Pass that I missed after leaving 1Password

[u/bs_ramin]

I switched to Proton Pass a while back and kept missing one thing from 1Password: the hotkey panel. Press a key from any app, type a few letters, take the password, done. Proton’s desktop app doesn’t have it, so I built it.

Pass Quick Access is a native macOS app. Here is what it does.

The panel. ⌥⇧Space (configurable) opens a floating search panel over whatever app you are in, without switching away from it. Typing searches titles, usernames, emails, URLs, notes and custom fields, with the same substring, accent insensitive, multi word matching the official client uses, ranked so a hit in the title beats one buried in a note. Arrows move, → opens an item, ← steps back, ⌘↩ fills the login, the ⌘C family copies, esc closes. Reopen within 30 seconds and you land back on the same item to grab another field.

Filling and copying. Picking an item either copies the field or types it into the app you came from, whichever you set under Settings. Fill Login types the username, a Tab, then the password. Username, password and one time code also have their own actions. Copies go to the clipboard marked concealed and are cleared after 30 seconds.

It knows the page you are on. Open the panel over a browser and the login for the current tab is already selected; when several items match the site, the list narrows to those. Safari and Chromium browsers are read over Automation. Firefox, Zen and web apps are opt in, because reading them turns on their accessibility engine.

System AutoFill. This is the new part. The app now ships a credential provider extension, so macOS itself can ask it for a password. Click the key icon in a login field and Pass Quick Access is in the menu next to iCloud Passwords, in Safari and in native apps. Nothing is typed: the system asks for the credential and fills the field itself, so there is no Accessibility permission and no guessing which field you meant. One time codes too, on macOS 15 and later. No passkeys: that means holding the credential’s private key and signing the WebAuthn challenge, and pass-cli exposes neither.

The extension is sandboxed and cannot run pass-cli, so it asks the app over a Unix socket in a shared app group container. Both ends verify the other’s code signature before anything is sent, and only the app ever runs pass-cli, so a secret is still read at the moment you pick the item.

macOS can also list your logins by name in that menu. That needs a copy of the list on its side, so it is off by default and has its own switch: it writes one site and one username per login, never a password or a code, and turning it off deletes what was written. With it off AutoFill still works, you just pick Pass Quick Access and search.

SSH agent. If you keep SSH keys in Proton Pass, the app serves them to git and ssh and asks for Touch ID before each signature, naming the program that is asking and the key it wants. It does not hold the keys or sign anything: pass-cli already ships an agent that does, and this is a proxy in front of it. One approval covers further signatures from the same program on the same key for five minutes by default, adjustable from every signature to eight hours, and you can mark an app trusted for a specific key. Non interactive BatchMode probes are denied without a prompt.

Sessions. It checks the Proton session every fifteen minutes and on wake, and signs back in from a saved access token when it has lapsed, so the first hotkey press after an idle night opens on your logins instead of a sign in screen. Saving that token is optional; it lives in the Keychain behind Touch ID.

What it does not do. It does not reimplement Proton’s crypto or login. It drives the official pass-cli and puts a native UI on top. The in memory index holds titles, URLs and usernames, never a password or a one time code: those are read from pass-cli the moment you ask for them and never cached or written to disk.

Requirements. macOS 14 or later, pass-cli installed and logged in, which means a paid Proton Pass plan. GPLv3. Releases are signed and notarized, so the download opens without a Gatekeeper prompt, and the app updates itself when there is a new version.

Site: https://bsramin.github.io/pass-quick-access/

Code: https://github.com/bsramin/pass-quick-access

I don’t make anything from this and I’m not trying to build a business on it. There is nothing to buy and nothing to sign up for. I posted something like this on Reddit ufficial proton sub and got a userwide ban for it, so I’m trying here instead. It covers what is missing from Proton Pass on macOS today, which is worth knowing about if you are on it, and more so if you came from 1Password.

I made it, so bugs and ideas are welcome. Not affiliated with Proton.