NordPass: what makes it appealing, and what holds it back
A ready-made vault, encrypted on the device according to the publisher, with passkeys and a generator. Here is what NordPass puts forward, and what to weigh before storing your logins there.
Getting started
Original AI-generated illustration · SecuFocus
At a glance
Key points
NordPass is worth a look if you want a commercial vault without hosting it: encryption the publisher says happens on the device, passkeys, a generator, and a free plan to start on one device. That plan does not cover several devices. Independent audits are not named on the page we read. We did not test the vault.
Who publishes the vault
The about page presents NordPass as a password manager for people and companies. It names Jonas Karklys, founder and chief executive, and says the idea came while NordVPN was being built.
The product sits in the Nord Security group, next to NordVPN, NordLayer and NordLocker. The group’s history page lists 2019 as the launch year. That is not the date of the version you would install.
What makes it appealing
The security, features and plans pages describe a vault you can use without hosting it yourself. Here is what they put forward, not what we measured.
- NordPass writes that no one, including the company, can see the vault contents. Data is encrypted on the device before it is sent. The private key stays on the device.
- The master password is used to derive the unlock key with Argon2id and a 16-byte salt. The contents are presented as encrypted with XChaCha20.
- The features page describes passkeys, a generator, item sharing, and unlock with face, fingerprint or Windows Hello.
- For a team, the same page describes an admin panel, password policies, FIDO2 security keys and a built-in TOTP authenticator.
- The plans page, read on 7 October 2026, shows a free plan described as lasting, with autosave, autofill and secure storage.
What holds it back
These points do not remove the interest of the vault. They say what reading the pages does not let us conclude.
- On the free plan, multi-device access, password health, the breach scanner, the NordPass authenticator and file attachments are marked absent. The paid offer shown next to it adds several of those functions. The authenticator stayed marked absent on the two rows we could separate.
- The displayed price and the renewal price are on the site. They can change. We do not copy them here.
- The master password and the recovery method stay on your side. A synced vault is convenient. If it is lost, it concentrates a lot of access in one place.
- The security page announces independent audits. The passage read on 5 October 2026 names neither the firm, nor the date, nor the scope. We did not read a report.
- NordPass says it is the only major password manager using XChaCha20. We did not repeat that comparison, and we did not install the app.
- The vault does not make a website safe if that website has been compromised.
The choice
If you want a ready-made vault, with a generator and passkeys, and you do not want to host it, NordPass is worth a closer look. The free plan lets you see the gesture on one device. Note the recovery method somewhere else, then read the renewal price before you pay.
A link to NordPass may be an affiliate link. If it is, the page says so. A possible commission does not change these points, and it does not turn this reading into a test. We do not publish a ranking.
Check and explore
Sources for this article
Numbers connect each reference to the passages that use it. Dates show when the documentation was consulted.
- NordPass, vault security ↗nordpass.com ·
This article draws on the sources above. The exercises are for you to try on your devices; SecuFocus does not present them as tests carried out by its editorial team. Interfaces and features can change. Method and corrections.
Cite this article
Keep this reference with the article when you save or share it.