NordPass review: what the password manager does well, and where it falls short

This NordPass review sticks to what can be checked: how the vault is encrypted according to NordPass's own documentation, what outside auditors have published, which features sit behind the paid plans, and where it is weaker than its rivals. I compared it using NordPass's security page, help center and plans page, its published audit announcements and named independent reviews, not our own testing.

The short version: NordPass is a polished, easy password manager from Nord Security, the company behind NordVPN. Its encryption design is sound on paper and its two extras, Email Masking and a breach scanner, are genuinely useful. Its weak spots are a closed codebase, public audit write-ups that are now several years old, a free plan that only works on one device at a time, and a sign-in routine with one more step than most.

Privacy toolkit for this job

• NordPassOne unique password per account, filled only on the real site.Start with NordPass
• YubiKey 5 NFC (USB-A)Stops phished passwords from opening your email and bank accounts.Last Amazon check Oct 23, 2026, 11:25 AM CT: $58.00On Amazon
• Yubico Security Key NFC (USB-A)Phishing-resistant sign-in at a lower cost than the full YubiKey.Last Amazon check Oct 23, 2026, 11:25 AM CT: $29.00On Amazon

Picked from published documentation and reviews, not our own testing. We earn a commission from some services we link to. As an Amazon Associate I earn from qualifying purchases. Product prices and availability are accurate as of the date/time indicated and are subject to change. The full Privacy kit

How the vault is protected

NordPass's security page describes its design in more detail than most marketing pages do. In plain terms:

• Everything is encrypted on your device before it is uploaded. NordPass calls this zero-knowledge architecture and says no one at the company, itself included, can see what you store.
• Vault contents are encrypted with XChaCha20, a modern stream cipher. NordPass says it is the only major password manager using it; most rivals use AES-256. Both are respected ciphers, and how carefully either is implemented matters more than the name.
• When you type your Master Password, the app runs it through Argon2id, a function built to make password guessing slow, together with a 16-byte salt. The result decrypts your private key, which in turn decrypts the key that protects your vault. When you lock the app, NordPass says, the private key is wiped from memory.
• Vault data is stored on Amazon Web Services, in separate data centers in the US and the EU.

What this means for you: someone who broke into NordPass's servers would get encrypted data, and how long it stays encrypted depends largely on your Master Password. Make it a long passphrase of random words. Our passphrase generator builds one in your browser.

What outside auditors have said

The independent evidence is real but not recent:

• March 2020. Cure53, a Berlin security firm, audited NordPass's cryptographic design, source code and apps. NordPass's announcement quotes Cure53's founder saying the NordPass complex "should be judged as secure."
• October 2021. Cure53 audited NordPass Business, covering the Android, iOS and desktop apps, the browser extensions, the Admin Panel and Nord Account. NordPass's blog says the work took 21 person-days and found 15 security-relevant issues, one rated high, which NordPass fixed and Cure53 verified.
• Company certifications. NordPass says it has followed the ISO/IEC 27001 standard since 2021, passed a SOC 2 Type 1 audit in 2022 and announced a SOC 2 Type 2 attestation in December 2023. These check how the company runs its systems, not the app's code.
• On request. The NordPass Trust Center lists an ISO 27001 certificate, a SOC 2 Type 2 report and a penetration test report for NordPass Business. They are available on request rather than published.

NordPass also runs a bug bounty program, which pays outside researchers to report flaws. For comparison, Bitwarden links its third-party audit reports from 2018 to 2025 on its own site.

Privacy kit

• YubiKey 5C NFC (USB-C)Two-step sign-in that a fake login page cannot copy.Last Amazon check Oct 23, 2026, 11:25 AM CT: $58.00On Amazon
• Yubico Security Key C NFC (USB-C)Phishing-resistant sign-in for USB-C laptops and phones.Last Amazon check Oct 23, 2026, 11:25 AM CT: $29.00On Amazon
• Thin sliding webcam cover (2 pack)Keeps the camera covered when you are not on a call.Last Amazon check Oct 23, 2026, 11:25 AM CT: $6.99On Amazon

Chosen from specifications, policies and published reviews; we have not tested these ourselves. Product prices and availability are accurate as of the date/time indicated and are subject to change. More in the Privacy kit

Free vs paid, in features only

NordPass's plans page splits the features like this at the time of writing:

The free plan is a fair trial, not a long-term home. Most people use a phone and a computer, and being logged in on only one at a time gets old quickly. For the current price of each plan, see NordPass's site, and note that the advertised rate on its plans page covers the first term, so check what the renewal costs before you commit.

Passkeys

NordPass can create, store and fill passkeys, and its passkeys page says they work across its apps, browser extensions and web vault. You can share a passkey with someone the way you share any other vault item. The catch is in its own passkey FAQ: at the time of writing, NordPass says there is no option to import or export passkeys to other password managers. If you switch later, plan on creating new passkeys site by site.

Email Masking

Email Masking launched in January 2024 and comes with the Premium and Family plans. It creates forwarding addresses that pass mail to your real inbox, so a shop or a forum never learns your main address. NordPass's help center says you can create up to 200 masks per account, at most 30 a day, and that incoming mail is stored on its servers in the EU.

One detail matters more than the limits. The same article says that if your subscription drops to the free plan, forwarding stops. Use masks for shops, newsletters and sign-ups you could lose without harm. Keep your real address for your bank, government accounts and anything you might need to recover.

Data Breach Scanner

The paid plans watch the email addresses you verify with a code, plus up to 50 credit cards, and look for them in leaked databases. A red banner means a new or unresolved breach; a green one means nothing has turned up. For email alone, Have I Been Pwned runs a similar check for free. Whichever tool raises the alarm, our breach checklist walks through what to change first, by type of data.

Is NordPass safe?

On the documented facts, yes for ordinary use: encryption happens on your device with current algorithms, the Master Password is protected by a slow key-derivation function, two Cure53 audits found issues that were fixed, and the company holds the usual security certifications. Three caveats are worth weighing.

1. You cannot read the code. NordPass is proprietary software, so you rely on its auditors and its word.
2. The public audit write-ups are from 2020 and 2021. Newer reports exist, but only on request and only for the Business product.
3. Recovery is on you. NordPass's help center says a forgotten Master Password needs the 24-character Recovery Code you saved at setup, or biometric sign-in that was already turned on. Without either, the only way back is a reset that deletes every item in your vault.

Turn on multi-factor authentication on day one. NordPass applies it to your Nord Account, the login it shares with NordVPN and NordLocker, and accepts an authenticator app or a security key over Bluetooth, NFC or USB. A small hardware key is the stronger option, because a fake login page cannot reuse it.

Where NordPass falls short

• The free plan. One device signed in at a time. PCWorld's Alaina Yee listed it first among the drawbacks in her March 2024 review.
• Two sign-ins. You log in to your Nord Account and then enter your Master Password. The same review called the process cumbersome; biometrics shorten it but do not remove it.
• No passkey export, as above.
• Closed source, no self-hosting. NordPass lists no self-hosted option.
• Masks tied to the subscription. Lapse, and your aliases stop forwarding.

NordPass vs Bitwarden

Bitwarden is the comparison most people ask about, because it sits at the other end on openness. Bitwarden's details come from its pricing page and help center.

Pick Bitwarden if you want to read or host the code yourself, or need a free plan that covers your phone and laptop. Pick NordPass if you want built-in masks and breach alerts in one tidy app and are happy to pay for them.

Who NordPass suits

It suits someone who wants a clean app, easy autofill, and email masks and breach alerts without stitching together separate services. It also suits families, since one Family plan covers six accounts, and anyone already using a Nord Account for NordVPN. It is a weaker fit for anyone who wants open code, self-hosting or a usable free tier. If you are still deciding whether you need a separate manager at all, our guide to password managers, passkeys and two-step codes explains how they fit together.

Before you sign up

1. Choose your Master Password first: a passphrase you can type, written down once and stored safely.
2. Print the Recovery Code during setup and keep it with your important papers, not in the vault.
3. Turn on multi-factor authentication for your Nord Account and save the backup codes.
4. After importing passwords from your browser or another manager, delete the export file, since it is not encrypted.
5. Decide which accounts get a masked address before you start handing them out.
6. Put the renewal date in your calendar and compare the renewal price on NordPass with Bitwarden's before it arrives.

Privacy kit

• NordPassCreates and stores a unique password for every account.Start with NordPass
• YubiKey 5 NFC (USB-A)Stops phished passwords from opening your email and bank accounts.Last Amazon check Oct 23, 2026, 11:25 AM CT: $58.00On Amazon
• Yubico Security Key NFC (USB-A)Phishing-resistant sign-in at a lower cost than the full YubiKey.Last Amazon check Oct 23, 2026, 11:25 AM CT: $29.00On Amazon

Chosen from specifications, policies and published reviews; we have not tested these ourselves. Product prices and availability are accurate as of the date/time indicated and are subject to change. More in the Privacy kit

Your next three steps

1. See how long your current password pattern would last in the password strength check; it runs in your browser.
2. Move every account to its own password in a manager such as NordPass.
3. Put a security key on your email first, then the bank, and keep a second key as the backup.