By the VPNTruth Editorial TeamPublished Last updated
NordPass stores passwords, cards and notes in an XChaCha20-encrypted vault that only opens with your master password. We checked every plan and security claim against NordPass's own documentation — here is what holds up, and what doesn't.
✔ Free plan — one device at a time✔ Zero-knowledge encryption✔ Every claim sourced
A password manager securely stores all your passwords in one encrypted vault. Instead of remembering dozens of passwords — or reusing the same weak one everywhere — you only need to remember one master password. NordPass handles the rest.
Most people have far more online accounts than they can hold unique passwords for. Reusing one across sites is the dangerous part — a single breach anywhere then unlocks everything else. Almost everyone knows this already; the problem is that memory does not scale.
NordPass encrypts your vault with XChaCha20 on your own device, before anything syncs. The key is derived from a master password that never leaves your machine, so NordPass stores data it cannot read. That is what zero-knowledge architecture means in practice.
NordPass autofills your passwords on any device — phone, tablet, desktop. Browser extensions for Chrome, Firefox, Safari and Edge. No more typing, no more forgotten passwords.
Six things worth knowing before you sign up, each labelled with the plan that actually includes it.
Your vault is encrypted on your device before it syncs, so NordPass cannot read it. XChaCha20 is a modern choice that does not lean on hardware acceleration, which helps on older phones — but it is not stronger than the AES-256 rivals use. Both are secure. Treat it as sound engineering, not a reason to switch.
Apps for Windows, macOS, Linux, iOS and Android, plus extensions for Chrome, Firefox, Edge and Safari. The vault syncs across all of them on the free plan too — the free-tier limit is on simultaneous sign-ins, not on how many devices you install it on.
Passkeys are stored and synced on the free plan rather than held back for Premium. If you are moving away from passwords entirely, it is the most useful thing NordPass gives away.
Scans your vault for weak, reused and old credentials, and checks stored data against known breaches. Widely described as a NordPass free-plan feature — including on this page until we checked. It is not: both require a paid plan.
Unlimited stored items with no credit card, which is more than several rivals allow. The catch is real though: one active session at a time, so signing in on your phone signs you out on your laptop. Bitwarden's free tier has no such limit.
Six separate encrypted vaults on Family, and centralised admin controls on Business. The Business product is also the only part of NordPass with a published independent audit behind it — see the security section below.
Source: NordPass Support (the vendor's own plan documentation) · · Official Free vs Premium feature comparison, read directly from the NordPass help centre · Tier availability for every feature above
Try NordPass Free →NordPass offers a genuinely useful free plan and affordable premium options. The longer you commit, the more you save. Check their site for the latest deals.
Always free, no credit card needed
Check NordPass's site for current pricing
Try Free Plan →Full access across all your devices
Check NordPass's site for current pricing
Get Premium Plan →Premium for up to 6 family members
Check NordPass's site for current pricing
Get Family Plan →🔒 NordPass offers a 30-day money-back guarantee on a first personal-plan purchase. It does not cover renewals, unless local consumer law says otherwise. Visit NordPass for current pricing.
Source: NordPass Support (the vendor's own refund documentation) · · Official money-back policy for personal accounts · Money-back terms
Every password manager says it is secure. The useful question is which of those claims someone outside the company has checked. We split them into what is documented and what is only asserted.
Real, and published in full. It covered NordPass Business — the apps, browser extensions, Admin Panel and Nord Account — over 21 person-days, finding 15 issues, one rated High, which was fixed and re-verified before publication. It did not cover the consumer product, and it is now several years old.
Source: Cure53 (independent German security audit firm) · · NordPass Business only — Android, iOS and desktop apps, browser extensions, Admin Panel and Nord Account; 21 person-days; 15 issues found, one rated High and fixed before publication
Displayed as badges on the NordPass security page. No certificate numbers, certifying bodies, audit dates or scope statements are published alongside them, so there is nothing a reader can independently check.
Source: NordPass (the vendor's own security page) · · Vendor claims ISO/IEC 27001, SOC 2, HIPAA and GDPR compliance and "regular" third-party audits, without naming auditors, dates or scope
Stated on the NordPass security page without naming an auditor, a date or a scope. We have found no published audit of the current consumer app.
Source: NordPass (the vendor's own security page) · · Vendor claims ISO/IEC 27001, SOC 2, HIPAA and GDPR compliance and "regular" third-party audits, without naming auditors, dates or scope
NordPass states this openly and it is a reasonable, modern choice. It is not stronger than the AES-256 its rivals use — both are considered secure — but it does not depend on hardware acceleration, which helps on older phones. Treat it as a sensible engineering decision, not a competitive advantage.
Source: NordPass (the vendor's own security page) · · Vendor claims ISO/IEC 27001, SOC 2, HIPAA and GDPR compliance and "regular" third-party audits, without naming auditors, dates or scope
We earn a commission on NordPass and nothing on the other two. That is exactly why this section is here — if one of them suits you better, you should know.
| Plan | Signed in at once | Stored items |
|---|---|---|
| NordPass Free | One at a time | Unlimited |
| Bitwarden Free | Unlimited | Unlimited |
| 1Password | No free tier — trial only | |
Source: NordPass Support (the vendor's own plan documentation) · · Official Free vs Premium feature comparison, read directly from the NordPass help centre · NordPass Free
Source: Bitwarden (a competing password manager's own pricing page) · · Official plan documentation, read directly from the vendor · Bitwarden Free
Open-source clients, published annual third-party audits, and a free tier with no session limit. Less polished than NordPass and the interface shows its origins, but on transparency and free-tier value it is ahead. If you want something you will never need to upgrade from, start here.
Strongest at: Free-tier value, auditability, open source
No free tier at all — only a trial — so it is not a NordPass free alternative. What it offers instead is the most mature sharing, family and recovery tooling in the category, plus Travel Mode. If you are paying anyway and want the best-built product, this is the comparison to make.
Strongest at: Sharing, family management, recovery design
Passkeys on the free plan, broad platform coverage, a clean interface and a straightforward import. Its weakest points are the free-tier session limit and the absence of a published consumer-scope audit. Strongest if you are already in the Nord ecosystem or want a paid manager without a learning curve.
Strongest at: Ease of use, passkeys on free, platform breadth
Drawn from NordPass's own documentation and the published audit record — not from a hands-on test programme we do not run.
Source: NordPass Support (the vendor's own refund documentation) · · Official money-back policy for personal accounts · Money-back terms
NordPass is a solid, well-built password manager, and any password manager beats reusing the same password everywhere — that is the decision that actually matters. Where it earns its 4.0 is breadth of platform support, passkeys on the free tier and a clean security model. Where it loses ground is the one-session free plan and a consumer product with no published audit behind it. If you want a free tier you will never outgrow, look at Bitwarden first. If you are paying anyway, NordPass is an easy recommendation.
Get NordPass Now →The overall score is the average of the four sub-scores below. Each one says what it is based on — a cited independent measurement, or our own assessment.
Zero-knowledge architecture — the vault is encrypted on your device before it syncs, so the provider cannot read it. Held below 4.5 because the only published independent audit covered NordPass Business rather than the consumer app, and the compliance badges carry no auditor, date or scope. Assessed from the published record; we have not commissioned an audit of our own.
Passkey storage is included on every tier, which several rivals paywall. Data breach scanning and password health reports are Premium-only. The free plan is uncapped on stored items and syncs across every device, but permits only one active session at a time.
Clean apps and browser extensions across all major platforms, with a straightforward import from other managers. Our assessment of the interface, not a measured result.
Competitive premium pricing and a free tier worth using, but rivals offer more mature sharing and admin reporting at a similar price. Our assessment.
This is our editorial verdict, not an average of reader ratings — we do not collect those, and we do not publish a review count we cannot substantiate.
VPNTruth is an editorial site, not a test lab. For password managers that means we check the vendor documentation and the published audits, tell you which claims we could verify and which we could not, and show our working.
Which features sit behind which tier is a question with a correct answer, and password-manager marketing is unusually loose about it. Every plan claim on this page was checked line by line against the vendor's own help centre and is cited below, because "free plan includes password health reports" is the kind of thing that is repeated across dozens of reviews without being true.
When a provider claims an independent security audit, we check who performed it, what scope it covered, and how recent it is. An audit from several years ago against a narrow scope is much weaker evidence than a recent full-product one, and we say so rather than repeating the marketing line.
A benchmark is a measurement; "best for beginners" is an opinion. We attribute the first and own the second. Where we rate something without data behind it — ease of use, quality of support, how a feature set fits a use case — we present it as our assessment, not as a test result.
A compliance badge with no certificate number, auditor or date is an assertion, not evidence. We list those separately from audits you can actually go and read, and we name the gap rather than letting a logo stand in for a finding.
Password-manager pricing changes constantly, renewal rates differ from introductory rates, and regional offers vary. Any figure here would be stale or wrong for many readers, so we link to the vendor's live pricing page instead of printing a number.
We have not run this software through a hands-on usability programme, timed its autofill, or commissioned a code audit. Where this page previously implied otherwise, that was wrong and has been corrected. If you spot a claim that is not backed by a named source, tell us and we will fix or remove it.
Sources we rely on
Source: NordPass Support (the vendor's own plan documentation) · · Official Free vs Premium feature comparison, read directly from the NordPass help centre · Plan and feature availability
Source: Cure53 (independent German security audit firm) · · NordPass Business only — Android, iOS and desktop apps, browser extensions, Admin Panel and Nord Account; 21 person-days; 15 issues found, one rated High and fixed before publication · Independent security audit
We earn a commission if you buy through our links, and that never changes a ranking or a score. Read our editorial policyfor how we handle this, or tell usif you think we have something wrong.
Everything you need to know before trying NordPass.
Join millions of users who trust NordPass to keep their passwords, credit cards, and private notes safe. Try it free — no credit card needed.
Free plan available. No credit card required. Upgrade anytime.
Disclosure: This page contains affiliate links. If you purchase through our link we may earn a commission at no extra cost to you. We only recommend products we genuinely believe in.
Editorial team, VPNTruth
An independent review site covering VPNs and privacy tools. We are not owned by, employed by, or operated on behalf of any provider we write about.
We synthesise published testing from independent labs and testing sites — CyberInsider and West Coast Labs among them — and check provider claims against their published audits. We do not run our own speed lab, and we cite the source and test date for every figure.
Affiliate commissions, paid by the provider when you buy through our links. You pay the same price either way. Commission rates play no part in how we rank or score anything.
Edited by Andrius Vaitiekunas.
Read our full editorial policy →