# NordPass — Password Management

NordPass by Nord Security Inc. holds a panel rating of 2/5 from 6 AI judges (category median 2/5), as of 2026-10-14. Provenance: provenance unknown; sovereignty: not determined.

- Vendor: Nord Security Inc. (https://nordpass.com)
- Category: [Password Management](https://whats-best.ai/software/password-management.md)
- Provenance (editorial classification): provenance unknown
- Canonical page: https://whats-best.ai/software/password-management/nordpass
- Alternatives: https://whats-best.ai/software/password-management/nordpass/alternatives ([markdown](https://whats-best.ai/software/password-management/nordpass/alternatives.md))
- Data as of: 2026-10-21 · evaluated 2026-10-14 · oldest source captured 2026-10-01

**AI-generated.** Every score, rationale and verdict here is written by a panel of AI judges from public evidence — an analysis, not a hands-on test. Every fact quotes the vendor page it was read from. No score can be bought. How scores are made: https://whats-best.ai/methodology

## At a glance

- Vendor: Nord Security Inc.
- Headquarters: Not stated on the vendor’s pages as of 13 Oct 2026
- Data hosting: Default not stated; pages mention the US and the EU [S5]
- Free plan: Yes, per the vendor’s own page [S2]

## The panel's verdict

NordPass, Nord Security Inc.'s business password manager, scores strongest on operations and weakest on paperwork. Sharing and access control, identity integration, deployment and portability and security architecture hold at a flat 4, with audit and policy at 4 to 5. Those scores rest on published specifics: XChaCha20 with Argon2id derivation and X25519 key exchange, organization-level account recovery that reassigns a departed employee's items, provisioning with Entra ID and Okta, SSO with Google Workspace over OAuth 2.0, and clients for six platforms plus five browser extensions. Sovereignty is the weak column at 2 to 3 — vault items sit in AWS data centers across the US and EU, no captured page states where the contracting entity is incorporated, and subprocessors appear only as categories — and judges differ on how far that evidence goes. Pricing transparency follows at 1 to 2: no price figure appears on any captured page, and the enterprise route is a demo request. Judges split a point on whether the activity log, with no export or retention path shown, earns a 4 or a 5.

**Speaks for it:**
- Published encryption design names XChaCha20 for vault contents, Argon2id key derivation with a 16-byte salt, and X25519 for key exchange.
- A departed employee's items stay with the organization and can be reassigned, with organization-level account recovery documented.
- Provisioning with Entra ID and Okta, SSO with Google Workspace, and OAuth 2.0 for business authentication are documented.
- Clients cover iOS, Android, Windows, macOS, Linux, the web vault and five browser extensions, with offline credential access listed.
- The 14-day business trial requires no credit card.

**Held against it:**
- The captured pricing pages map six plan segments to features but show no price figure, seat minimum or add-on price.
- ISO 27001 and SOC 2 Type 2 certifications and the third-party audits appear without dates, auditor names or published reports.
- We found no public information on how the vault key is derived or released when a user signs in with SSO.
- We found no public information on exporting the activity log to a SIEM, or on log retention periods.
- We found no statement of where the contracting entity is incorporated and no subprocessor list with locations.

**Best for:**
- You need offboarding handled: a departed employee's items stay with the organization and can be reassigned.
- Your team already runs Entra ID or Okta and wants user and group provisioning with SSO.
- You want broad client coverage — six apps and five browser extensions — with offline credential access.
- You want to trial before committing, via a 14-day business trial that needs no credit card.

**Avoid if:**
- You must compute an annual invoice from published per-user prices before talking to sales — the captured pricing pages show tiers and features but no figures.
- You require vault data confined to a single region — the captured pages describe storage in AWS data centers across the US and EU.
- Your compliance regime needs audit logs exportable to a SIEM with stated retention — we found no public information on either.
- Your procurement requires a named subprocessor list and a stated incorporation jurisdiction — the privacy policy names recipient categories only.

## Scores by judge and criterion

Scores out of 5, each judge scoring independently against the published rubric (v1). "n/r" = not rated: the vendor publishes no price.

| Criterion | The CISO | The Identity Engineer | The Compliance Auditor | The SME Owner | The DevOps Engineer | The Skeptic |
| --- | --- | --- | --- | --- | --- | --- |
| Encryption model & independent audits | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 |
| Sharing, roles & recovery | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 |
| SSO, directory sync & provisioning | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 |
| Audit logs, policies & reporting | 2/5 | 2.5/5 | 2/5 | 2/5 | 2.5/5 | 2/5 |
| Hosting choice, offline access & export | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 |
| European sovereignty | 1/5 | 1.5/5 | 1/5 | 1/5 | 1.5/5 | 1/5 |
| Pricing transparency | 1/5 | 1/5 | 1/5 | 0.5/5 | 1/5 | 1/5 |
| **Weighted verdict** | **2/5** | **2/5** | **1.5/5** | **1.5/5** | **2/5** | **2/5** |

### The judges

- **The CISO** (v1.0): Answers to the board for the day the vault vendor is breached. Wants a whitepaper that says which fields are encrypted and which are not, audits by named firms with dates, a bug bounty, and an incident history written down rather than discovered in the press.
- **The Identity Engineer** (v1.0): Runs Entra ID for two thousand staff and owns the joiner-mover-leaver process. Wants SCIM that suspends a leaver's vault the moment the account is disabled, an SSO unlock whose key model is documented, and FIDO2 keys and passkeys supported for the vault itself.
- **The Compliance Auditor** (v1.0): Prepares the ISO 27001 and NIS2 evidence and has to show who could see the firewall admin password last March. Wants event logs that cover views and copies, export to the SIEM, enforceable policies, and the contracting entity, hosting and subprocessors named.
- **The SME Owner** (v1.0): Runs a forty-person company where the shared passwords currently live in an Excel file. Wants shared vaults the team actually uses, a way back in when someone forgets the master password, credentials handed over when someone leaves, and a per-user price with SSO not hidden two tiers up.
- **The DevOps Engineer** (v1.0): Would rather run the vault in the company's own data centre than trust another SaaS with root credentials. Wants a documented self-hosted deployment with backup and high availability, open-source code to read, a CLI and API for pipelines, and an export that loses nothing.
- **The Skeptic** (v1.0): Has read the breach post-mortems. Reads "zero knowledge" next to unencrypted URLs and item names, "independently audited" with no report, "SSO unlock" where the vendor holds half the key, and "admin recovery" that means the vendor can decrypt — and treats a missing incident history as an answer.

## European sovereignty — proven facts

Built only from facts on the vendor's own pages; a dimension we could not prove is left open, never scored as zero. Headline: not determined.

| Dimension | Finding | Points | Source |
|---|---|---|---|
| Legal entity | Not determined | — | — |
| Ownership | Not determined | — | — |
| Data residency | Not determined | — | — |
| Subprocessors | Not determined | — | — |

## Key facts

Each fact is the vendor's own statement, cited to the source page it was read from ([S*n*] → Sources).

**Compliance**
- CCPA: yes [S3]
- Certifications: ISO 27001 · SOC 2 Type 2 [S5]
- Cross border safeguards: European Commission adequacy decision · EU standard contractual clauses [S3]
- Data sale: no [S3]
- Eea sccs: EU standard contractual clauses [S3]
- External audits: yes [S3]
- HIPAA baa: yes · yes [S4]
- HIPAA cure53: yes · yes [S2]
- ISO 27001: yes [S2]
- Minors age: 18 [S3]
- Sanctions: Belarus · Cuba · Iran · North Korea · Russia · Syria · restricted regions of Ukraine [S4]
- Security measures: yes · yes [S3]
- SOC 2: yes [S2]

**Data**
- Controller retention: necessity for original purpose or legal requirements [S3]
- Deletion on termination: yes [S4]
- DPA available: AVV (Auftragsverarbeitungsvertrag) im Footer verlinkt [S1]
- Logs: yes · no [S5]
- Retention end users: customer instructions [S3]

**Hosting**
- Legal entity: Nord Security [S1]
- Provider: AWS [S1]
- Provider: AWS [S5]
- Regions: US · EU [S5]

**Integrations**
- Apps platforms: iOS · Android · Windows · macOS · Linux · Web vault · Chrome · Firefox · Safari · Opera · Edge [S2]
- Browser extensions: Chrome · Firefox · Safari · Opera · Edge [S1]
- Identity providers: Integration mit Identitätsanbietern und Verzeichnissen [S1]
- Provisioning: yes · yes [S2]
- Third party integrations: yes · no [S4]

**Legal**
- Address: Nord Security Inc. · One Rockefeller Plaza, 11th Floor, New York, NY 10020, United States of America [S3]
- Contracting entity: Nord Security Inc. [S4]
- Controller: Nord Security Inc. [S3]
- Eea representative: Fred. Roeskestraat 115, 1076 EE Amsterdam, The Netherlands · nordsec B.V. [S3]
- Effective date: 2025-12-15 [S3]
- Effective date: 2025-05-26 [S4]
- Governing law: London, United Kingdom · England and Wales [S4]
- Liability limitation: yes [S3]
- Processor role: data processor for End User data, customer organization is data controller [S3]
- Refund policy: 14 [S2]
- Termination cure period: 30 [S4]

**Pricing**
- Free plan: yes · 30 [S2]
- Free trial: yes · yes [S4]
- Free trial: yes · no [S5]
- Introductory discount: yes [S4]
- Money back guarantee: 30 · yes [S2]
- Partner purchase: yes · yes [S4]
- Premium price: 1 · 1.39 · 53 · 37.53 · 27 · 80.73 [S2]
- Price changes: yes [S4]
- Proration: yes [S4]
- Refunds: 14 · yes [S4]
- Subscription model: subscription · yes [S4]
- Taxes exclusive: yes [S4]
- VAT excluded: no [S2]

**Product**
- Account recovery: yes [S5]
- Activity log: Aktivitätsprotokoll mit Prüfpfaden für Benutzeraktionen [S1]
- Analytics providers: Google Analytics [S3]
- Bug bounty: yes [S5]
- Bundle nordvpn: yes [S2]
- Business plan: Businessplan für Passwörter, Passkeys und sensible Mitarbeiterdaten [S1]
- Customer count: 10000 [S1]
- Data breach scanner: Dark-Web/Datenleck-Benachrichtigungen für Unternehmens-Domains und E-Mails [S1]
- Data breach scanner domains: 1 · 10 [S2]
- Data sharing: service providers · partners · Nord group companies · law enforcement · business transfers [S3]
- Data subject rights: Delete · Access · Rectify · Object · Portability · Restrict · Withdraw consent · Lodge a complaint [S3]
- DPA incorporated: yes [S4]
- Encryption algorithm: XChaCha20 [S6]
- Encryption model: XChaCha20 · X25519, XSalsa20, Poly1305 · Argon2id with 16-byte salt · XChaCha20-Poly1305-IETF [S5]
- End to end encryption: yes [S5]
- End user data processed: full name · telephone number · email · professional information · account registration · login information · subscription information · device information · application diagnostics · connection timestamps · IP addresses [S3]
- End user rights via customer: via Customer organization [S3]
- Family vaults: 6 [S2]
- Free plan faq: yes · yes [S2]
- Free tools: Benutzernamen-Generator · Firmennamen-Generator · Online-Passwort-Generator · Passwortprüfer · Datenleck-Scanner · Passwortweitergabe [S1]
- Integrated authenticator: integrierte 2FA-Authenticator-Funktion [S1]
- Item reassignment: yes [S5]
- License scope: limited, non-exclusive, revocable, non-transferable, non-sublicensable, fixed-term, worldwide license [S4]
- Network allowlist: yes [S2]
- Oauth2: OAuth 2.0 [S5]
- Owner role required: yes [S4]
- Password policies: unternehmensweite, individuell anpassbare Passwort-Regeln [S1]
- Personal plan: Privatplan für Passwörter, Kreditkarten und Dokumente [S1]
- Plan segments: Privat · Familie · Teams · IT-Teams · Business · Großunternehmen [S1]
- Platforms: iOS · Android · Windows · macOS · Linux · Web vault [S1]
- Premium features: yes · yes · yes · yes · yes · no [S2]
- Regular audits: yes [S5]
- Sharing hub: zentrale Verwaltung gemeinsam genutzter Anmeldedaten [S1]
- Surveill: yes [S5]
- Teams features: yes · yes · yes · yes [S2]
- Trial no credit card: 14 · no [S2]
- Xchacha20: XChaCha20 [S5]
- Xchacha20 vault: xChaCha20 [S2]
- Zero knowledge: yes [S5]

**Support**
- Business support: support for administrators and end users [S4]
- Demo: yes [S1]
- Enterprise enterprise support: yes · 24/7 · yes · yes [S2]
- Privacy contact: privacy@nordsecbusiness.com [S3]
- Sales response time: sales@nordsecurity.com · one business day [S2]
- Trial business: yes [S1]

## Questions

### Is NordPass European?

Not determined: the vendor’s pages as captured do not say where NordPass is based.

### Where does NordPass store data?

The default storage location for customer data is not stated on the vendor’s pages as of 13 Oct 2026. The vendor’s pages mention the US and the EU as hosting locations, per [the vendor’s page captured 1 Oct 2026](https://whats-best.ai/evidence/7043).

### Does NordPass have a free plan?

Yes. NordPass has a free plan, per [the vendor’s page captured 1 Oct 2026](https://whats-best.ai/evidence/7035).

### What are the best alternatives to NordPass?

As of 21 Oct 2026, the panel rates [Password Depot (3.5/5)](https://whats-best.ai/software/password-management/password-depot), [Keeper (3/5)](https://whats-best.ai/software/password-management/keeper) and [Passbolt (3/5)](https://whats-best.ai/software/password-management/passbolt) highest among the other 18 Password Management products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is [Password Depot](https://whats-best.ai/software/password-management/password-depot) (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: [how scores are made](https://whats-best.ai/methodology#ordering). The full list, with European products first: [NordPass alternatives](https://whats-best.ai/software/password-management/nordpass/alternatives).

## What this page leaves out

- 6 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 6 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 4 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 3 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 2 support facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 2 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown.
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement.

## Sources

- [S1] Vendor homepage: https://nordpass.com/de/ (checked 2026-10-01)
- [S2] Pricing page: https://nordpass.com/password-manager-pricing/ (checked 2026-10-01)
- [S3] Privacy policy: https://business.nordsec.com/legal/privacy-policy (checked 2026-10-13)
- [S4] Terms of service: https://business.nordsec.com/legal/terms-of-service (checked 2026-10-13)
- [S5] Encryption model & independent audits — found from sitemap: https://nordpass.com/security/ (checked 2026-10-01)
- [S6] Encryption model & independent audits — found from sitemap: https://nordpass.com/features/xchacha20-encryption/ (checked 2026-10-01)

---

Cite as: whats-best.ai, "NordPass — Password Management", AI panel analysis, as of 2026-10-21. https://whats-best.ai/software/password-management/nordpass

Corrections: https://whats-best.ai/correct/670?target=page