NordPass vs Proton Pass Comparison

• Premium (individual, 2-year, standard rate): $80.73 for the first 27 months
• Family (6 users, 2-year, standard rate): $161.73 for the first 27 months

• Pass Plus (individual, annual): $35.88/year
• Pass Family (up to 6 users, annual): $59.88/year

Penetration test and source-code review of the NordPass Business apps, browser extensions, admin panel and account system

Source-code review and gray-box testing of the browser extensions, mobile and desktop apps, and CLI

The vault is encrypted client-side with XChaCha20-Poly1305-IETF at 256 bits. The master key is derived from the master password with Argon2id and a 16-byte salt (iteration count not published). Zero-knowledge — NordPass says it only verifies that you hold the key, without ever storing it.

Vault and item data are encrypted with 256-bit AES-GCM under 32-byte random keys; the user key is protected by a bcrypt hash of the account password. Authentication uses a hardened SRP implementation; sharing uses OpenPGP with ECC (Curve25519). Every field is encrypted client-side — usernames, URLs and notes included — so Proton cannot see which services you hold accounts with. Offline access on paid plans uses Argon2 for the local hash.

Made by Nord Security, the company behind NordVPN, NordLayer and NordLocker, based in Lithuania. Venture-funded: a 2022 Series C led by Novator Ventures, Burda Principal Investments and General Catalyst at a $1.6B valuation, then a $100M round from Warburg Pincus in September 2023 at a $3B valuation.

Proton AG, Geneva, Switzerland. Since June 2024 the primary shareholder is the non-profit Proton Foundation, which the founders endowed with Proton shares in an arrangement they describe as irrevocable. Proton began as a 2014 crowdfunding campaign.