NordPass

NordPass is the password manager from the company behind NordVPN, and it feels like it: modern, tidy, easy to get started with. Its one genuinely distinctive technical choice is the cipher — XChaCha20-Poly1305 instead of AES. Where it lags the open, heavily-audited competition is transparency: the code is closed, the last independent audit anyone can point to was in 2021 and covered the business product, and no full audit report has ever been published.

Security

NordPass encrypts your vault on your device with XChaCha20-Poly1305-IETF at 256 bits before anything reaches its servers. The master key is derived from your master password with Argon2id and a 16-byte salt — a memory-hard function that resists GPU and ASIC cracking — though NordPass does not publish the iteration count. XChaCha20 is a legitimate, well-regarded stream cipher; the practical security difference versus a correctly implemented AES-256 setup is negligible, but NordPass is unusual in choosing it, and it argues the choice is simpler to implement safely and doesn’t lean on CPU AES instructions.

The zero-knowledge model is real and strict. NordPass states it “simply verifies that you have” the key “without ever storing the key itself,” and the recovery flow bears that out: lose your master password and your Recovery Code, with no biometric unlock enabled, and the only path back is a full account reset that deletes every item in the vault. There is no separate account secret in the style of a “second key” — the master password, optionally backed by a Recovery Code and biometrics, is what stands between you and your data.

Biometric unlock is available on Windows, macOS, Android and iOS and in the browser extension. Sign-in is protected by multi-factor authentication on the Nord Account — an authenticator-app code or a Bluetooth/NFC/USB security key — which then covers NordPass, NordVPN and NordLocker together. What NordPass cannot yet do is unlock itself with a passkey; that feature is described as in development, not shipped.

Independent verification is where NordPass is thin. The consumer app was audited by Cure53 (year not stated on the current page; the old standalone post now redirects). The most recent audit anyone can cite is Cure53’s October 2021 assessment of NordPass Business — 21 person-days across the apps, browser extensions, admin panel and account system, which found 15 issues including one High that was fixed and verified. That is a real audit, but it is four years old, it was scoped to the business product, and NordPass has only ever published blog summaries — Cure53’s own publications list shows no NordPass reports at all. NordPass does hold SOC 2 Type 2 and ISO 27001, which are compliance certifications, not penetration tests.

Privacy & Trust

The code is closed. You are trusting NordPass’s description of its own cryptography rather than anything a third party can read line by line, and the audit history above does not close that gap the way a current, public, consumer-scoped report would.

NordPass is made by Nord Security, the Lithuanian company that also makes NordVPN, NordLayer and NordLocker. It is venture-funded and has been through two large rounds — a 2022 Series C at a $1.6 billion valuation, then a $100 million round from Warburg Pincus in 2023 at a $3 billion valuation. That is a well-resourced, established owner, but it is a commercial one with outside investors, not a non-profit or a community project.

NordPass runs entirely as a hosted cloud service — there is no self-hosting option. It does not publish a breakdown of client-side telemetry the way it publishes its encryption details; there is a Nord Account layer, an activity log, and a rooted/jailbroken-device blocker, so the conservative reading is that some diagnostic data is collected and adjustable rather than absent. Vault contents themselves stay encrypted and out of reach.

There has never been a confirmed security incident affecting NordPass user vaults.

Features

The paid product is well-stocked: a built-in authenticator for TOTP codes, a Data Breach Scanner, Password Health reports, Email Masking for generating throwaway addresses, secure item sharing, file attachments, and Emergency Access for a trusted contact. Passkeys are supported in the sense that NordPass stores and autofills them for websites and can use them as a second factor — though they cannot be imported or exported.

The catch is that almost none of that is in the free tier. NordPass Free gives you autosave, autofill and unlimited stored items, but the authenticator, breach scanner, password health, email masking, sharing, attachments and emergency access are all Premium-only — and, most limiting of all, Free allows just one active session on one device at a time. You can install it anywhere, but logging in on your phone logs you out of your laptop.

Usability & Platforms

Getting started is genuinely easy, and the interface is one of the cleaner ones in this category — reviewers consistently single that out. NordPass covers Windows, macOS and Linux desktop apps, iOS and Android, and browser extensions for Chrome, Firefox, Safari, Opera and Edge. Sync is automatic across all of them on a paid plan. There is no command-line client.

The recurring real-world complaint is autofill: it works most of the time, but on some sites and apps it doesn’t prompt, and users fall back to copying the password out of NordPass and pasting it. Sync delays can also occasionally leave autofill offering an out-of-date password after you’ve changed one. Neither is a security problem; both are friction.

Price & Value

NordPass’s headline prices are introductory. Premium advertises around $1.39 a month, but that is a first-term promotional rate on a two-year plan; the standard rate works out to roughly $2.99 a month, and NordPass does not publish an explicit renewal price, so plan on paying at least the standard rate when the intro term ends. Family is about $5.99 a month standard for six accounts. At the standard rate NordPass sits mid-pack — cheaper than the premium-tier competition, more than the open-source options, and with a free tier too limited by the one-device rule to lean on.

Pros

• XChaCha20-Poly1305 vault encryption with Argon2id key derivation — a modern, memory-hard setup
• Strict zero-knowledge model; NordPass genuinely cannot recover a vault
• Clean, modern interface that is easy to set up
• Full paid feature set: authenticator, breach scanner, password health, email masking, sharing, attachments, emergency access
• Broad platform coverage — desktop, mobile and every mainstream browser
• Backed by a large, well-funded, established security company

Cons

• Closed source — the cryptography can’t be independently read
• The only citable independent audit is from 2021, was scoped to the business product, and was never published in full
• Free tier allows just one active device session at a time, and paywalls almost every feature
• Introductory pricing; the standard rate is roughly double the headline, with no published renewal price
• Autofill doesn’t always prompt, and sync delays can surface a stale password
• No self-hosting, no command-line client, and NordPass can’t yet be unlocked with a passkey

Our Rating

NordPass is a capable, good-looking password manager with a solid modern cipher and a full paid feature set. What it doesn’t offer is the thing the open, frequently-audited competition does: the ability to check its security claims rather than take them on trust. If a polished experience from a big-name security company is what you want, it delivers. If independent verifiability is high on your list, NordPass currently comes up short.

Rating: 7.3/10