Last updated: October 2026
Affiliate Disclosure: Trident is reader-supported. Some links on our site are affiliate links. When you buy through those links, we may earn an affiliate commission — at no extra cost to you. Links to a brand's official site are not affiliate links. Learn more
NordPass is the password manager from Nord Security, the company behind NordVPN. It is built for a specific job: keep a unique password for every account, fill it in for you, and warn you when a login is weak or has shown up in a breach. People searching "NordPass review," "is NordPass safe," or "is NordPass worth it" are usually deciding between three buyers — one person, a household, or a small company — and between a free vault and a paid one.
This is a research review. We read NordPass's product, security, plans, and passkey pages and the company's help center. We did not install the apps or run a timed test, so nothing here is a hands-on score. Where a claim is NordPass's own, it is labeled that way. See the current price at our link, then confirm it on the checkout screen.
See the current price at our link
The quick verdict
NordPass is a sensible vault if you want passwords, passkeys, cards, and notes in one place and you will actually use the paid tools: Password Health, the Data Breach Scanner, email masking, and sharing. The Family plan is the household version of that, with six separate vaults. Teams, Business, and Enterprise are the company versions, with an admin panel instead of a shared spreadsheet.
The Free plan is a real password manager, not a teaser that locks you out after a handful of logins. NordPass says it stores unlimited passwords, autosaves and autofills, syncs, and supports multi-factor authentication. The limit is sessions: Free allows one active device at a time. Health checks, breach alerts, masking, and secure sharing sit on Premium.
On safety, the published design is serious: XChaCha20 encryption, a zero-knowledge vault, and audits NordPass names in public. That does not make a short master password safe, and losing both the master password and the recovery code means the personal vault items are deleted on reset. Personal plans publish a 30-day money-back guarantee on the first purchase. Business plans publish 14 days. Renewals are outside that window.
See the current price at our link
What NordPass is
NordPass describes itself as a password manager built by the people behind NordVPN. The vault holds login credentials, passkeys, credit cards, secure notes, and personal details. A browser extension can autosave a new password and autofill it later. A built-in generator creates a new password instead of you reusing an old one.
Personal plans are Free, Premium, and Family. Company plans are Teams, Business, and Enterprise. All of them sit on a Nord Account. NordPass's plans page says you can add NordVPN to that same account when you buy or upgrade. Our NordVPN review covers the VPN on its own.
Who NordPass is for
Individuals
One person with too many reused passwords is the core customer. Free is enough if you live on a single active device and you are willing to skip breach alerts and health reports. Premium is the plan NordPass points at when you want those reports, email masking, secure sharing, and the ability to stay logged in on more than one device at once.
Families
The Family plan is six separate encrypted vaults, each with the Premium feature set. One vault belongs to the plan owner. The other five can go to family or friends. NordPass says you cannot switch from Premium to Family inside the account; you contact support to make that change. Each person still has their own master password. Sharing a login is a separate action from sharing a whole vault. How that plan compares with other household options, including shared vaults and a rollout for relatives, is in the family password manager guide.
Small businesses
A company that still keeps logins in a spreadsheet or a chat thread is who the business plans are written for. NordPass's homepage says the product is trusted by more than 10,000 businesses. That figure is the company's claim, not a count we audited.
The business features page describes an admin panel, company password rules, a sharing hub, group and folder sharing, a way to hand a departing employee's items to someone who is staying, account recovery, an activity log, security-key sign-in with a YubiKey or other FIDO2 key, email masking, and a built-in authenticator for one-time codes. The business plans page says Business includes what Teams includes, and adds group and folder sharing, password-strength monitoring, data-breach monitoring, and a Vanta integration. It describes Enterprise as the tier with centralized tracking of shared credentials, single sign-on and user provisioning through Microsoft Entra ID, Microsoft ADFS, and Okta, plus Splunk and Microsoft Sentinel integrations. Google Workspace single sign-on is listed on the features page as its own integration.
Key features
XChaCha20 encryption
NordPass encrypts vault data with XChaCha20. On its security page the company calls XChaCha20 a fast stream cipher, and says it is the only major password manager using it. The "only major" line is NordPass's comparison, not an independent census. What we can verify is the algorithm they say they use, and the key setup below.
Zero-knowledge architecture
Zero-knowledge, in NordPass's own words, means the company cannot see what is in your vault. Items are encrypted on the device before backup or sync. NordPass says it does not store the master password, so a copy of the servers would not hand an attacker readable passwords.
The security page gets more specific. Each user has a public key on NordPass's servers and a private key kept on the device. The private key is encrypted locally with XChaCha20-Poly1305-IETF. Unlocking the app runs the master password through Argon2id with a 16-byte salt to derive a master key, which decrypts the private key. That private key decrypts the data-encryption key that protects the vault. NordPass says the private key is wiped from memory when the app locks. Key exchange is described as X25519 together with XSalsa20 and Poly1305.
The practical consequence is recovery. NordPass cannot email you your passwords. During setup it asks you to save a recovery code, a 24-symbol code. That code is how you set a new master password if you forget the old one. If biometric unlock is still enabled, support says you can reset the recovery code with a face or fingerprint scan on Windows, macOS, Android, iOS, or the browser extension. If you have neither the master password nor the recovery code, the personal reset path deletes the items in the vault. Business members can request recovery that the organization owner approves.
Passkeys
Passkeys are the passwordless logins sites are starting to offer. NordPass's passkey page says you can create, store, use, and share passkeys from the mobile app, the browser extension, the web vault, and the desktop app, on any plan, including Free. You will still have ordinary passwords for sites that do not offer passkeys. The vault is there for both.
Password Health
Password Health is a Premium tool. NordPass says it flags weak, old, and reused passwords so you can replace them. The business features page also describes scans for exposed, weak, old, or reused passwords in employee vaults. It does not change the passwords for you. It tells you which ones to rotate first.
Data Breach Scanner
The Data Breach Scanner is also a Premium feature on personal plans. NordPass says it checks whether your data appears in known breaches. On business plans, the scanner is described as alerts when a company domain, an email address, or a credit-card number shows up in a breach. An alert is a prompt to change the password and turn on multi-factor authentication, not a fix by itself. If a notice says your identity data leaked, follow what to do after a data breach before you shop for more software.
Email masking
Email masking is on the Premium feature list in NordPass's help center, and the business pages describe it as aliases you can use at sign-up so a newsletter or a new account does not get your real address. The point is to shrink the number of places your primary inbox appears.
Cross-device sync
NordPass says both Free and paid users can install the app and the extension on as many devices as they want, and that vault data syncs. The difference is how many sessions stay open. Free allows one active session on one device. Premium lets you stay logged in on unlimited devices at the same time. An active session, per the help center, starts when you log in on a desktop app, the web vault, or a mobile app. The plans page puts the same idea in shorter words: Premium adds the ability to switch devices without logging in again.
Apps are published for Windows, macOS, Linux, Android, and iOS. Extensions are listed for Chrome, Firefox, Edge, Opera, and Safari on the features page, and the password-manager page adds Brave. You can unlock the app with a face scan, a fingerprint, or Windows Hello where NordPass documents biometrics.
Sharing
Secure item sharing is a Premium feature: send a password or another vault item to another NordPass user without pasting it into email. The Family plan is the larger version of sharing, because each person has a full vault rather than one borrowed login. Business sharing adds folders, groups, permission changes, and, on the features page, a time limit on access plus a sharing hub that shows who can see what.
What else comes with Premium
The help center's Free-versus-Premium article also lists a built-in authenticator for one-time codes, file attachments, and emergency access as Premium features. Free already includes multi-factor authentication on the NordPass account itself, using an authenticator app, a security key, or backup codes. Those are different things: one protects the NordPass login, the other stores the codes for your other accounts inside the vault.
How the plans differ
NordPass sells the personal plans on its plans page and explains the feature split in its help center. The table below is the feature split only. See the current price at our link.
| Feature | Free | Premium | Family |
|---|---|---|---|
| Unlimited password storage | Yes | Yes | Yes |
| Autosave and autofill | Yes | Yes | Yes |
| Passkeys | Yes | Yes | Yes |
| Multi-factor authentication | Yes | Yes | Yes |
| Install on many devices | Yes | Yes | Yes |
| Active sessions | One at a time | Unlimited, stay logged in | Same as Premium |
| Password Health | No | Yes | Yes |
| Data Breach Scanner | No | Yes | Yes |
| Email masking | No | Yes | Yes |
| Secure item sharing | No | Yes | Yes |
| File attachments and emergency access | No | Yes | Yes |
| Built-in authenticator | No | Yes | Yes |
| Separate vaults | One | One | Six |
Family's six vaults each get the Premium list. Company buyers should read the Teams, Business, and Enterprise breakdown on NordPass's business plans page rather than assume the personal table applies. The personal money-back guarantee is 30 days from the initial purchase, and NordPass says a renewal is not covered. Business customers get 14 days on the initial purchase. Canceling auto-renewal does not by itself send a refund; the help center says you contact support to request one.
See the current price at our link
How to set NordPass up
NordPass's own "how to use" answer is short. This is that path, plus the recovery-code step the help center says happens at account creation.
- Pick a plan. On the plans page, choose Free, Premium, or Family. A company chooses Teams, Business, or Enterprise. You can start on Free and move to Premium later from the Nord Account.
- Install the app or the extension. Desktop and mobile apps cover Windows, macOS, Linux, Android, and iOS. NordPass recommends the browser extension so autosave and autofill work while you are on a site.
- Create the account and the master password. This password unlocks the vault. NordPass does not store it. The help center's guidance for a replacement master password is at least 12 characters, with upper and lower case, numbers, and symbols. Write down the recovery code it asks you to save. Download it as a PDF and keep that file somewhere you can still open if you are locked out of NordPass.
- Turn on multi-factor authentication and biometrics. Multi-factor authentication is available on Free. Biometrics let you reopen the app without typing the master password every time, on the platforms NordPass lists.
- Bring existing passwords in. NordPass says you can import from another password manager with a CSV file, and that it can detect passwords already saved in the browser.
- Replace the weak ones. Use the generator for new accounts. On Premium, run Password Health and the Data Breach Scanner and change anything they flag. Turn on multi-factor authentication at the email, bank, and other accounts that offer it.
- Share only what someone else must use. On Premium, share an item. On Family, invite people to their own vaults. On a business plan, use groups and folders so a leaver can be removed without emailing a password list.
Is NordPass safe?
For the "is NordPass safe" question, the useful standard is not a star rating. It is whether the vault is encrypted before it leaves the device, whether NordPass can read it, and whether an outside firm has looked at the design.
NordPass's answers, from its security and features pages: encryption happens locally with XChaCha20; the design is zero-knowledge; the master password is not stored; vault items are kept in AWS data centers in the US and EU; app logs on the device are not supposed to identify you; crash reports go out only if you enable them, and NordPass says those reports are not tied to an account. The company says it runs a bug bounty, regular internal and third-party audits, and a secure development lifecycle. The features FAQ says an independent audit by Cure53 covered the cryptographic premise, the source code, the background application, and its codebase. The security FAQ cites ISO 27001 and SOC 2 Type 2. Business sign-in is described as using OAuth 2.0.
We did not re-perform that audit. A published audit is evidence that someone outside the company examined the design. It is not evidence that every future release is flawless, and it does not protect a master password you also use on other sites. Save the recovery code. If a breach alert fires, change the exposed password everywhere it was reused.
NordPass vs other password managers
Shoppers usually put NordPass next to 1Password, Bitwarden, Dashlane, and Keeper. Those links go to each company's own site. They are not affiliate links, and this page does not invent test scores for them. Our password manager roundup is where the wider comparison lives.
What you can settle from NordPass's documentation, before you open those other sites:
- Encryption story. NordPass publishes XChaCha20 plus the zero-knowledge key setup above, and says that combination is its answer to "is it safe."
- Free plan. Unlimited passwords and passkeys, with a one-active-session cap, and without health, breach, masking, or sharing tools.
- Household. Six Premium vaults on Family, rather than one shared login.
- Company admin. Teams, Business, and Enterprise add the admin panel, sharing controls, and the monitoring split described above. A personal Premium plan is the wrong product if you need to revoke an employee's access on their last day.
Read the current feature list on each official site before you treat any manager as identical. Plan names and what sits behind a paywall change.
Pros and cons
Pros
- Vault items are encrypted on the device with XChaCha20, under a zero-knowledge design NordPass documents in detail.
- Free still includes unlimited password storage, autosave, autofill, sync, multi-factor authentication, and passkeys.
- Premium adds Password Health, the Data Breach Scanner, email masking, secure sharing, attachments, emergency access, and a built-in authenticator.
- Family is six separate Premium vaults. Business plans add admin, sharing, and breach tools a spreadsheet does not have.
- Apps for Windows, macOS, Linux, Android, and iOS, plus the major browser extensions.
- NordPass names a Cure53 audit and cites ISO 27001 and SOC 2 Type 2.
- A 30-day money-back guarantee on the initial personal purchase, and 14 days on the initial business purchase.
Cons
- Free is one active session. A second device means logging out of the first.
- The tools most reviews talk about — health, breach alerts, masking, and sharing — are not on Free.
- Lose the master password and the recovery code, and a personal reset deletes the vault items.
- NordPass says you cannot move from Premium to Family yourself. You have to contact support.
- The money-back window does not cover renewals, and canceling auto-renewal is not the same step as requesting a refund.
- We did not hands-on test import, autofill accuracy, or support response time, so those are not scored here.
Verdict
Use NordPass Free if you want a unique password per site and you mostly work on one device. Move to Premium if you want breach alerts, a health report, email masking, sharing, or more than one device logged in at once. Choose Family when up to six people each need that Premium vault. Choose a business plan when an admin has to grant and revoke access.
It is worth it when those paid tools match a problem you have. It is not worth paying for if Free's one-device vault already covers you. Either way, see the current price at our link, save the recovery code the day you create the account, and treat the money-back window as the time to confirm the apps fit how you actually log in.
See the current price at our link
A password manager does not watch your credit file. If a breach notice includes a Social Security number or you want identity monitoring and recovery help, that is a different product. Aura is the identity-theft service we review for that job. See Aura. Nord Security's own identity product is Coveron.
FAQ
Is NordPass safe?
NordPass encrypts vault items on your device with XChaCha20 before they sync, and it says it does not store your master password. Its security page describes a zero-knowledge design, a public and private key pair, Argon2id for the master key, hosting on AWS, a bug bounty, and ISO 27001 and SOC 2 Type 2. The features page says Cure53 audited the cryptographic design, source code, background app, and codebase. A weak master password is still a weak master password. If you lose both the master password and the recovery code, a personal account reset deletes the vault items.
Is NordPass worth it?
It is worth paying for if you need the tools that are not on the Free plan: Password Health, the Data Breach Scanner, email masking, secure sharing, file attachments, emergency access, the built-in authenticator, or staying logged in on more than one device at a time. The Family plan is six separate Premium vaults. Teams, Business, and Enterprise are the company plans. If one active device is enough, Free includes unlimited password storage, autosave, autofill, sync, and multi-factor authentication. See the current price at our link, and use the 30-day money-back window on an initial personal purchase if the apps are not a fit.
Does NordPass have a free plan?
Yes. NordPass Free includes unlimited password storage, autosave, autofill, sync, and multi-factor authentication. You can install it on as many devices as you want, but only one session can be active at a time. Password Health, the Data Breach Scanner, email masking, secure sharing, file attachments, emergency access, and the built-in authenticator are listed as Premium features.
Can NordPass store passkeys?
Yes. NordPass says you can create, store, use, and share passkeys on the mobile app, browser extension, web vault, and desktop app, on any plan.
What if I forget the NordPass master password?
NordPass asks you to save a 24-symbol recovery code during setup. Enter that code after choosing Forgot your master password to set a new one. If biometric unlock is still on, you can reset the recovery code from settings. If you have neither the master password nor the recovery code, a personal account reset deletes the items in the vault. A business member can request recovery that an organization owner approves.
Which devices does NordPass support?
NordPass publishes apps for Windows, macOS, Linux, Android, and iOS. Browser extensions are listed for Chrome, Firefox, Edge, Opera, Safari, and Brave. Biometric unlock is documented for Windows, macOS, Android, iOS, and the browser extension.
Are the NordPass buttons affiliate links?
Yes. The NordPass buttons on this page use Trident's NordPass affiliate link. Links to 1Password, Bitwarden, Dashlane, and Keeper go to each company's own site and are not affiliate links. The Aura link, where it appears, is a separate affiliate link.
Sources
Feature, plan, and security statements were checked against NordPass's site and help center on October 16, 2026. Plan details change. Confirm the current offer at the button above before you buy.