Skip to content
Start with Identity
Join free
Password Management

NordPass

Founded 2019Vilnius, LithuaniaPrivate (Nord Security)Score 4/5Evaluated 2026-09-20Website ↗

Capability scores

Methodology →
Authentication
4.0
SSO & Federation
3.5
Authorization
3.0
Lifecycle & Provisioning
3.0
MFA & Passwordless
3.5
Governance & Audit
4.0
Developer Experience
3.0
Deployment Flexibility
2.5
Pricing Transparency
3.0
Support & Ecosystem
3.5

Scored 0–5 against a published rubric. Independent analysis, no vendor sponsorship.

Overview

NordPass is the business and consumer password manager from Nord Security, the Lithuanian company behind NordVPN, launched in 2019. Nord Security raised 100 million dollars led by Warburg Pincus in September 2023 at a 3 billion dollar valuation, with roughly 2,000 staff at that time. NordPass pairs a clean interface with modern cryptography and a credible business tier, though it trails the category leaders on enterprise integration depth.

What it is good at

The cryptographic story is genuinely differentiated. NordPass encrypts with XChaCha20-Poly1305-IETF and derives keys with Argon2id rather than the AES-256 and PBKDF2 combination most competitors use. It holds SOC 2 Type 2 and renewed ISO/IEC 27001:2022 in December 2025. It has no entries in the National Vulnerability Database, and when DEF CON 33 research disclosed clickjacking flaws across ten password managers in August 2025, NordPass had already shipped a fix months earlier. Passkey storage, breach monitoring, and group-based sharing are all present, and admin controls are straightforward for teams without a dedicated identity function.

Where it falls short

Tier gating is aggressive. Google Workspace is the only SSO option below the Enterprise tier, so any business running Okta or Microsoft Entra pays the top price or goes without. Provisioning reportedly requires deploying an Encryption Service onto your own infrastructure, unusual friction for a SaaS product. There is no self-hosting and no open-source codebase.

Pricing transparency is the real weakness. Prices render client-side and vary by promotion and geography, and NordPass publishes no renewal rate at all, which matters when headline prices are first-term discounts. Audit currency is also thin: the most recent NordPass-specific audit we could verify is from 2021.

Independent research has found real issues. The USENIX Security 2024 injection-attack paper showed NordPass leaking vault information through duplicate-password metrics.

Pricing

One-year and two-year terms only; no monthly option on personal plans. Teams is a fixed 10-user bundle, Business and Enterprise start at 5 seats. Published discounts are 20 to 28 percent for annual and 28 to 40 percent for two-year terms. Get the renewal price in writing.

Best for, and who should look elsewhere

Choose NordPass for small and mid-sized teams wanting strong cryptography and a manageable admin experience. Choose 1Password for enterprise depth, Bitwarden for open source or self-hosting, or Keeper Security if you need privileged access alongside passwords. See 1Password vs Bitwarden.

Bottom line

A cryptographically modern password manager that suits SMB and mid-market teams, held back by Enterprise-only SSO and a refusal to publish renewal pricing.

NordPass: frequently asked questions

How much does NordPass cost?
NordPass runs three business tiers and three personal tiers, all sold on one-year or two-year commitments rather than monthly. Independent price trackers recorded in April 2026 that business plans ran roughly 1.99 dollars per user per month for Teams, 3.99 for Business, and 3.59 to 5.99 for Enterprise on promotional annual terms, with Premium personal plans between roughly 1.29 and 1.99 dollars per month depending on the promotion running that week. We flag these as reported rather than confirmed: NordPass renders its prices client-side in JavaScript and geo-varies them, so there is no stable published figure to cite, and trackers disagree on the personal tiers. The discount percentages are published: a two-year term saves 28 percent on Teams, 40 percent on Business, and 33 percent on Enterprise. Prices exclude VAT.
What does NordPass cost at renewal?
NordPass does not disclose it. The company states only that renewal prices may differ from the initial purchase and are subject to change, and publishes no renewal rate anywhere we could find. Because the advertised prices are heavily discounted first-term promotions, the renewal figure is the number that actually determines multi-year cost, and it is the one number NordPass withholds. Estimates circulating online are back-calculated from monthly rates rather than observed from renewal invoices, so we do not repeat them. Ask for the renewal rate in writing before committing, particularly on a two-year business term.
Is NordPass secure?
The architecture is sound. NordPass encrypts vault contents with XChaCha20-Poly1305-IETF and derives the master key using Argon2id with a 16-byte salt, in a zero-knowledge model where encryption happens on device and the master password is never transmitted. Infrastructure runs on AWS in US and EU regions. NordPass has no CVEs in the National Vulnerability Database, verified by direct query in September 2026. Note that the five NVD entries for NordVPN belong to a sibling product and are not NordPass flaws. It holds SOC 2 Type 2 (announced December 2023) and renewed ISO/IEC 27001:2022 in December 2025 through certification body SERTIKA.
Has NordPass been independently audited?
Yes, though less recently than buyers may assume. Cure53 audited NordPass Business in 2021, covering the mobile and desktop apps, browser extensions, the Admin Panel, and Nord Account across 21 person-days, finding 15 security-relevant issues of which one was rated High; NordPass states the High was fixed and re-verified. An earlier Cure53 audit of the cryptographic premise is widely referenced as February 2020 but we could not locate a primary source for it. Neither report appears to be publicly downloadable, and we found no NordPass-specific penetration test more recent than 2021. Claims of a 2024 audit could not be corroborated.
Does NordPass support SSO and SCIM provisioning?
Only on the right tier, and this is the most common business-buyer trap. Teams and Business tiers support SSO with Google Workspace only. Microsoft Entra ID, AD FS, and Okta SSO, plus automatic user provisioning through Entra ID and Okta, are Enterprise-tier exclusives, as is activity log integration with Microsoft Sentinel and Splunk. Business-tier buyers expecting Okta or Entra SSO will not get it. Reporting also indicates that provisioning requires deploying a separate client-side Encryption Service onto your own Azure, AWS, or Docker infrastructure to preserve the zero-knowledge model, an operational step competitors do not require. NordPass publishes support articles on this deployment, though we could not read them to confirm the details.
Have researchers found weaknesses in NordPass?
Two independent findings are worth knowing, neither of which is a breach. At USENIX Security 2024, Cornell researchers published injection attacks against password managers and found NordPass leaked information through application-wide security metrics: an attacker could inject crafted shared entries and observe externally logged data such as duplicate-password counts to learn whether an injected value matched a password already in the vault. Seven of ten evaluated managers were affected. Separately, researcher Marek Toth demonstrated DOM-based extension clickjacking at DEF CON 33 in August 2025 against ten managers including NordPass; per that research NordPass had already addressed the issue in a February 2025 release, putting it ahead of several peers at disclosure.
Can NordPass be self-hosted?
No. NordPass is cloud-only, running on AWS in US and EU regions, with no on-premises or self-hosted deployment option and no open-source codebase. One nuance to avoid confusing: the Encryption Service used for directory provisioning is deployed on your own infrastructure, but that is a provisioning component, not vault self-hosting. Teams that require self-hosting should look at Bitwarden, which offers a self-hosted server, or Vaultwarden for a lightweight community implementation.
What are the best NordPass alternatives?
1Password for the strongest business feature set and enterprise ecosystem. Bitwarden if you want open source, self-hosting, or the lowest cost. Keeper Security if you need password management that extends into privileged access. Enpass for local-only storage with no vendor-hosted vault. For pure workforce SSO rather than credential storage, a password manager is the wrong category: look at Okta or Microsoft Entra instead.

More Password Management vendors

All Password Management →
Last reviewed By SWI Community TeamSuggest a correctionHow we research

By SWI Community Team · Last evaluated 2026-09-20

Independent, community-driven analysis. No vendor sponsorship. Compiled from public research and community input and verified on a best-effort basis, so details may be incomplete or out of date. Scores are opinions, not advice. Trademarks belong to their owners; mention does not imply affiliation or endorsement. See the full disclaimer, or send corrections to community@startwithidentity.com.