NordPass

Is NordPass safe?

Yes, for most people, with one caveat about evidence. NordPass encrypts your vault on your own device with XChaCha20, turns your master password into a key with Argon2id, and has no reported breach since it launched in November 2019. We score it 82/100, ahead of Dashlane (73) but behind Bitwarden (88) and 1Password (86).

The caveat is that most of what you know about NordPass's security comes from Nord Security itself. The one public independent audit was published in March 2020. Newer reports exist, but you have to ask for them. NordPass does pay outside researchers for bugs, though it publishes no scope or reward table.

How NordPass encrypts your vault

NordPass made an unusual choice: instead of AES-256, which nearly every other password manager uses, it encrypts vaults with XChaCha20. Its help centre says the algorithm is faster on devices without AES hardware support and simpler to implement correctly. Both are considered secure. The more important part is key derivation. NordPass uses Argon2id, which deliberately uses a lot of memory so that guessing master passwords on graphics cards is slow and costly.

That matters most in the scenario that hurt LastPass users: someone copies the encrypted vaults from the company's servers and tries to crack them offline. With a long, unique master password, Argon2id makes that impractical.

The app also stores passkeysPasskeyA way to sign in without a password. Your device holds a key tied to one website or app and unlocks it with your fingerprint, face or PIN.More in the glossary, which cannot be phished the way passwords can, and supports security keys for signing in.

What audits and checks back it up

Cure53, a Berlin security firm, audited NordPass in stages before and after its 2019 launch. The work covered the cryptographic design, source code, apps, browser extension and infrastructure. In the release Nord Security published in March 2020, Cure53's founder Mario Heiderich said "the NordPass complex should be judged as secure".

Since then, the checks have shifted to the business product. NordPass Business holds ISO 27001 certification and has passed a SOC 2 Type 2 audit, and NordPass also holds a HIPAA report and a penetration test report. All of them sit in a Trust Center that you must request access to, and people who are not customers have to sign a non-disclosure agreement first.

Outside researchers have found problems that the audits did not. In December 2023 Marek Tóth reported that a hidden frame on a malicious website could load NordPass's browser extension and, with four clicks, share every vault item to an attacker's account without notifying the user. NordPass fixed it and paid him a $10,000 bounty. In his wider 2025 study of clickjacking in password-manager extensions, NordPass was among the five that had already fixed the issue when he presented it in August 2025.

Compare that with Bitwarden, whose code is open and whose yearly audits are public, or 1Password and Dashlane, which outside cryptographers tested in the 2026 ETH Zurich study of what a hacked server could do. NordPass was not part of that study, so its design has had less public scrutiny than its main rivals.

What NordPass collects

Very little that is tied to you, if the store labels are right. Apple's label lists your email, user and device IDs, app interactions and crash data, all marked as not linked to your identity and none used to track you across other companies' apps. Some of those IDs are used for NordPass's own marketing. Google Play shows a little more: your name, email, user IDs, app interactions and purchase history, with your email used partly for advertising or marketing and shared with other companies for account and fraud purposes.

The NordPass privacy notice, updated on 15 October 2026, matches the labels. Analytics and advertising data are optional and switched off unless you agree, the phone's advertising ID is used only to measure NordPass's own campaigns, and you can see which analytics providers the app uses under Privacy Preferences in its settings. Nord's general policy names AppsFlyer and Firebase among them. Autofill diagnostics include visited web addresses, which Nord says are aggregated and anonymised.

Free accounts that are not used for 36 months are deleted, with warning emails three months and three days before.

Leaving NordPass

This is the weak spot. NordPass exports only to a CSV file from the desktop app or web vault, and that file holds every password in readable form. Deleting your NordPass account alone means tapping "Delete account" in the app and then finishing the process by email with support. You can delete your whole Nord Account online, but that also closes NordVPN or any other Nord product on it. NordPass says it may keep billing records after deletion for legal reasons.

How to use NordPass safely

1. Choose a long master password you use nowhere else, and keep the 24-character Recovery Code shown at sign-up somewhere safe. It is what lets you reset a forgotten master password.
2. Turn on multi-factor authenticationTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary with an authenticator app or, better, a security key.
3. If you export your vault, delete the CSV file as soon as you have imported it elsewhere, and never send it by email.
4. On the free plan, expect to be signed out on one device when you sign in on another, and do not keep the only copy of anything important there.
5. Set up emergency access (Premium) so a trusted person can reach your vault if something happens to you.

How we scored it

Regulatory record (87) and scams and harmful content (86) are the strongest factors, with no fines found and no user-to-user contact in the app. The weakest is transparency and control (76), because exports are plain CSV and audit reports sit behind a request form. Privacy (82) reflects a clean App Store label and opt-in analytics, and security (81) credits modern encryption and a paid bug bounty but notes that the only public audit is six years old.