KeePassXC vs NordPass Comparison

• Premium (individual, 2-year, standard rate): $80.73 for the first 27 months
• Family (6 users, 2-year, standard rate): $161.73 for the first 27 months

First-level security certification of KeePassXC 2.7.9 on Windows — full source-code review, penetration testing of every security function, and cryptographic and random-number-generator analysis

Penetration test and source-code review of the NordPass Business apps, browser extensions, admin panel and account system

The database is encrypted with AES-256 by default (Twofish and ChaCha20 are also selectable) in the KDBX 4 format, with an HMAC-SHA-256 integrity check that detects tampering. The master key is derived with Argon2d by default — a memory-hard function that resists GPU and ASIC cracking — with the older AES-KDF still available. The composite master key can combine a password, a key file, and a YubiKey or OnlyKey challenge-response secret.

The vault is encrypted client-side with XChaCha20-Poly1305-IETF at 256 bits. The master key is derived from the master password with Argon2id and a 16-byte salt (iteration count not published). Zero-knowledge — NordPass says it only verifies that you hold the key, without ever storing it.

Volunteer, community-run open-source project under the keepassxreboot organization on GitHub — no company and no venture funding behind it. Development is paid for by donations. Forked from KeePassX in 2016; the KeePass lineage goes back to 2003.

Made by Nord Security, the company behind NordVPN, NordLayer and NordLocker, based in Lithuania. Venture-funded: a 2022 Series C led by Novator Ventures, Burda Principal Investments and General Catalyst at a $1.6B valuation, then a $100M round from Warburg Pincus in September 2023 at a $3B valuation.