NordPass Review 2026: A Cheap, Simple Password and Passkey Manager for People Who Live in AI and SaaS Tools
NordPass is the password and passkey manager from Nord Security, the company behind NordVPN. If your working week runs through a dozen AI tools, SaaS dashboards and admin consoles, it keeps every login, passkey and one-time code in one encrypted vault, and its business plans add an admin console and SSO from under $2 per user a month. This review covers the security model in NordPass's own words, what the audit firms actually looked at, the known security issues and how they were handled, what each plan costs now and at renewal, the refund rules quoted from NordPass's pages, and where developers will run into its limits.
There are no affiliate links in this review. Every NordPass link goes straight to nordpass.com or NordPass's own help center.
| Made by | Nord Security (NordPass released Nov 2019) |
| What it is | Password, passkey and 2FA-code manager; Teams, Business and Enterprise plans for companies |
| Personal | Free; Premium $1.99/mo first year, renews at $35.88/year |
| Teams | From $1.79 per user/mo, sold as a 10-user pack |
| Business | From $3.59 per user/mo, 5 users minimum |
A good-value, easy password and passkey manager with a clearly described security model. Developers who need secrets in a terminal should look elsewhere.
"For a person or small team drowning in AI and SaaS logins, NordPass does the core job at one of the lowest prices around: one vault, passkeys, built-in 2FA codes and masked emails. What it does not do is help you get API keys into scripts or AI agents. There is no command-line tool, and its Enterprise API returns audit logs, not secrets."
Here is how I read it. NordPass in late 2026 is two products sharing one app. The personal side is Free, Premium and Family. The business side is Teams, Business and Enterprise, run from an Admin Panel with policies, an activity log, SSO and, on Enterprise, user provisioning and SIEM feeds. Nord says on its homepage that more than 10,000 businesses use it.
Three things surprised me while checking the fine print. First, the refund window depends on which side you buy: personal plans carry a 30-day money-back guarantee, but NordPass Business customers get 14 calendar days, a rule stated on the business checkout, in the business Terms of Service and in the help center. Second, the "+3 extra months" on 2-year personal plans is a promotion that runs until Oct 21, 2026, and the extra months arrive only after the 30-day refund window has passed. Third, the Teams plan is sold only as a 10-user pack, so a five-person team pays almost exactly the same for Teams ($238.80 a year) as for five seats of the better Business plan ($239.40).
Not a hands-on test: JAVIS did not install, pay for or test NordPass for this review. It is built from NordPass's pricing page and checkout, product and security pages, Terms of Service (Business), help center and blog; the researcher's and audit firms' own publications where public; the US App Store and Google Play listings; Hacker News; and competitors' pricing pages, all as of Oct 4, 2026.
One vault for logins, passkeys and 2FA codes, plus a business layer for sharing and control.
NordPass describes itself in its help center as "a comprehensive passwords and passkeys manager." For someone with accounts in ChatGPT, Claude, Notion, Figma, Stripe, AWS and a long tail of trial tools, the map below is the useful version: what each piece does and which plan carries it.
A newer brand than 1Password or Bitwarden, sold hard on price, with Nord Security's security marketing behind it.
NordPass's personal promotion terms name nordvpn S.A. (Panama); its business discount terms name Nord Security Inc. (New York).
NordPass's own homepage claim, Oct 4, 2026. Not independently checked.
Google Play US listing, Oct 4, 2026. An install bracket, not active users.
12,975 ratings on the US App Store; 34.3K reviews on Google Play US, Oct 4, 2026.
NordPass is young for its category. It was first shown publicly in mid-2019, and Cure53's 2020 audit announcement dates the official release to November 2019; the US App Store lists the iOS app from Nov 17, 2019. Since then most of the visible product work has gone into the business side: shared folders, policies, SIEM integrations and, in Q3 2026, hardware security keys for login.
| When | What happened | Source |
|---|---|---|
| Jul 2019 | NordPass shown publicly as a password manager "from NordVPN," ahead of release | Hacker News submission, Jul 11, 2019 |
| Nov 2019 | Official release; iOS app listed from Nov 17, 2019 | Cure53 audit press release; App Store US |
| Mar 5, 2020 | Cure53 audit of the consumer apps announced | PR Newswire release |
| Oct 20, 2021 | Cure53 audit of NordPass Business: 15 issues, 1 rated High, fixed | NordPass blog |
| Dec 12, 2023 | SOC 2 Type 2 attestation announced (Type 1 in 2022) | NordPass blog |
| Feb 15, 2024 | Browser extension 5.13.24 fixes a clickjacking class later shown at DEF CON 33 | Researcher Marek Tóth's report |
| Apr 7, 2026 | Q1 update: shared subfolders, item transfer, domain reservation | NordPass blog |
| Jul 24, 2026 | Q2 update: vault redesign, global search, iOS subfolders | NordPass blog |
| Sep 30, 2026 | Q3 update: FIDO2 security keys for login, CrowdStrike SIEM, shared-folder password history | NordPass blog |
Ratings are high. The written reviews tell a rougher story about syncing, re-logins and support.
Each source is reported on its own; the numbers are not blended. App Store figures from the US storefront (Apple's lookup for country=us) and Google Play figures from the US listing (gl=US), Oct 4, 2026. The 150 written App Store reviews run from Nov 9, 2025 to Oct 2, 2026. Written reviews skew toward people who had a problem, which is why they look so different from the star average. We have not included Trustpilot, Reddit or G2 in this review.
"Will not keep me logged in": the reviewer selects the option to stay unlocked, yet "almost every time my computer goes into standby, I have to log back in."
A security-minded request: the browser extension "forces a 5-minute minimum auto-lock timer," while the mobile app can lock immediately.
A switcher's view: "Great product and I used to be 1Password person." The same review praises a quick reply to a question.
| Pattern | Example | Where and when |
|---|---|---|
| Asked for the master password too often | "Makes me sign into the app every single time I use it" | App Store US, Jun 29 and Sep 22, 2026 |
| Slow or unreliable sync between devices | "very slow to sync between devices" | App Store US, Sep 4 and Sep 15, 2026 |
| Hard to move passwords in from Apple's Passwords app on iPhone | "Can't import my passwords from my iPhone into Nord" | App Store US, May 23 and Jun 21, 2026 |
| Support hard to reach live, no phone line | "Can't get live help, support is all automated" | App Store US, Feb 3 and Jul 31, 2026 |
| Locked out after master password or recovery code trouble | Reviewers resetting and losing their vault | App Store US, Dec 17, 2025 and Jan 11, 2026 |
| Satisfied long-term users | "over three years and I've had no issues" | App Store US, Sep 8, 2026 |
| Malware aimed at password-manager extensions, NordPass included | A list of targeted extensions in the Mastra npm attack | Hacker News, Jun 18, 2026 |
Personal plans start under $2 a month. Business seats start under $4. The first term is the cheap one.
1 user. Unlimited passwords, autosave and autofill, MFA for your account.
- Only one active session on one device at a time
- No sharing, Password Health, breach scanner or Authenticator
- Comes with a 30-day Premium trial
Premium, 1 user. $23.88 for the first year, or $1.39/mo on the 2-year plan ($37.53 for 27 months during the current promotion).
- Unlimited simultaneous devices
- Authenticator, Email Masking, File Attachments, Emergency Access
- Renews at $35.88/year
6 separate vaults with Premium features. $44.28 for the first year, or $2.49/mo on the 2-year plan ($67.23 for 27 months).
- Renews at $71.88/year
- No direct switch from Premium to Family
1-year plan, 5 users minimum ($239.40/year for 5). Teams from $1.99 in 10-packs; Enterprise $5.99.
- Admin Panel, policies, shared folders, groups
- Every member also gets a free personal Premium plan
- 14-day free trial, no card needed
Swipe sideways to see all columns →
| Business plan | Seats | Monthly billing | 1-year plan | 2-year plan |
|---|---|---|---|---|
| Teams | 10-user pack only | $2.49/user ($24.90/mo) | $1.99/user ($238.80/yr) | $1.79/user ($429.60 for 2 yrs) |
| Business | 5 minimum | $5.99/user ($29.95/mo for 5) | $3.99/user ($239.40/yr for 5) | $3.59/user ($430.80 for 2 yrs, 5 users) |
| Enterprise | 5 minimum | $7.99/user ($39.95/mo for 5) | $5.99/user ($359.40/yr for 5) | $5.39/user ($646.80 for 2 yrs, 5 users) |
Not an affiliate link. It opens NordPass's own pricing page.
Personal plans renew at about 1.5 to 2.4 times the intro monthly price. Business checkouts quote the same price again.
Every personal checkout prints the renewal price before you pay, which I give NordPass credit for. The 1-year Premium plan, for example, says the service will "automatically renew annually after the first year, unless canceled," and "The renewal price is $35.88/year, VAT may apply. The price is subject to change, but we will notify you of any adjustments before charging."
Swipe sideways to see all columns →
| Plan | First charge | Covers | Then renews at | Renewal vs intro, per month |
|---|---|---|---|---|
| Premium, 1-year | $23.88 | 12 months ($1.99/mo) | $35.88/year ($2.99/mo) | 1.5x |
| Premium, 2-year | $37.53 | 24 + 3 promo months ($1.39/mo) | $35.88/year | 2.2x |
| Family, 1-year | $44.28 | 12 months ($3.69/mo) | $71.88/year ($5.99/mo) | 1.6x |
| Family, 2-year | $67.23 | 24 + 3 promo months ($2.49/mo) | $71.88/year | 2.4x |
| Business, 1-year (5 users) | $239.40 | 12 months ($3.99/user/mo) | $239.40 on Oct 4, 2027 | 1.0x (as quoted) |
30 days for personal plans, 14 days for business, first purchase only, and no refunds on renewals.
These rules are quoted exactly, because the conditions matter more than the headline number.
| Rule | Exact wording | Source (date) |
|---|---|---|
| Personal: 30 days | "If you wish to claim a refund, you can do so by canceling the subscription within 30 days following the initial purchase of the selected NordPass plan." | Help center, "What is your money-back policy?" (updated Sep 14, 2026) |
| Personal: first purchase only | "The guarantee applies only to your initial subscription purchase. Once your subscription renews, it's no longer eligible for a refund under this policy (unless local laws require otherwise)." | Same article |
| Business: 14 days | "A refund request is made within 14 (fourteen) calendar days of your initial purchase date for our Services." | Terms of Service (Business), effective May 26, 2025 |
| Business: no add-ons or renewals | "Refunds will not be provided for any additional services, features, add-ons, or renewals purchased during the Subscription Period." | Same |
| Business: payment exclusions | No refunds "For payments made using cryptocurrency, prepaid cards, or gift cards," for purchases through Authorized Partners, or if "a refund was already issued for the Customer." | Same |
| Business: cancelling mid-term | "If you cancel your subscription, you will not receive a refund for the unused part of the current subscription period." | NordPass pricing page FAQ |
| 2-year promo months | The 3 extra months are delivered "after the expiration of the Money Back Guarantee period"; a refund within 30 days cancels the promotion too. | Discount period terms (promotion Jul 29 to Oct 21, 2026) |
Should you use NordPass?
Encrypted on your device, with keys NordPass says never reach its servers. Here is the wording, exactly.
The core promise of any cloud password manager is that the company storing your vault cannot read it. NordPass makes that promise in three places, and the wording is worth quoting rather than paraphrasing:
| Claim | Exact wording | Where (date) |
|---|---|---|
| Zero knowledge | "Built with the zero-knowledge principle in mind, NordPass ensures that no one – not even our company – can see what you and your team store in your vaults." | nordpass.com/security (Oct 4, 2026) |
| Local encryption | "NordPass encrypts all your data locally on your device before it's uploaded to the cloud." | nordpass.com/security |
| Keys | "Your Master Password, encryption, and decryption keys never reach our servers." | Help center, "Does NordPass save passwords on their servers?" (updated Jul 3, 2026) |
| Definition | "only you hold the encryption key," and the manager "simply verifies that you have it, without ever storing the key itself." | Help center, "What is a zero-knowledge architecture?" (updated Aug 12, 2026) |
The security page then explains the mechanics. When you log in, NordPass uses Argon2id with a 16-byte salt to derive a Master Key from your Master Password. That key decrypts your private key, which is stored on your device and encrypted with XChaCha20-Poly1305. The private key then decrypts a data encryption key, and that key encrypts the vault. Key exchange for sharing uses X25519 with XSalsa20 and Poly1305. The page also says that "When you lock the app, your private key is wiped from memory."
Two honest footnotes. First, NordPass says it is "currently the only major password manager using XChaCha20." That is NordPass's own claim, which we have not checked, and a cipher name alone is not a good reason to pick one manager over another. Second, the business version is designed so the organization keeps control: the security page says that if an employee leaves, "their items don't disappear," and "the organization can recover employees' accounts without any risk of losing data." That is a feature for companies, but it means that in a business account, recovery is possible through the organization, not only through you. Personal accounts recover through a 24-symbol recovery code; lose both that and your Master Password and the help center points you to an account reset.
From a pile of AI and SaaS logins to one vault: import, autosave, 2FA codes and masked sign-ups.
The workflow that matters for this site's readers is the steady churn of new tools: a new AI app trial on Monday, a SaaS admin invite on Wednesday, a 2FA prompt on Friday. Here is how NordPass handles that, step by step, using only features on its current plan pages.
If you would rather watch the setup than read it, NordPass's own channel has a full walkthrough:
Passkeys work and sync across your devices, but you cannot export them, and the extension is where attacks aim.
Passkeys are the reason many people are revisiting password managers in 2026: a growing number of AI and SaaS sites let you sign in with one instead of a password. NordPass stores them in the vault next to your logins and syncs them across devices. Its Passkeys FAQ (updated Oct 3, 2026) adds limits worth knowing before you move dozens of accounts:
| Question | NordPass's answer |
|---|---|
| Import or export passkeys? | "There is no option to import or export passkeys to password managers." |
| View or share a passkey? | "Passkeys cannot be viewed; however, they can be shared like other items in your vault." |
| Several passkeys for one account? | Yes, if the site allows it; NordPass shows all of them and you choose. |
| Unlock NordPass itself with a passkey? | Not yet: "We are currently working on enabling a passwordless sign-in process for NordPass." |
| Using Google to sign in to NordPass? | Do not rely only on a passkey stored in NordPass for that same Google account; keep a second way in. |
The extension is the front line. Browser extensions that fill in passwords can be tricked by malicious pages. In December 2023, security researcher Marek Tóth reported a clickjacking flaw in NordPass's extension: because of how its resources were exposed, the vault interface could be loaded invisibly in a page, and "With 4 clicks, it was possible to share all items from the password manager to an attacker's account." He writes that he was awarded a $10,000 bounty. His broader DOM-based clickjacking research, presented at DEF CON 33 on Aug 9, 2025, lists NordPass as fixed in extension version 5.13.24 (Feb 15, 2024). In the same table, updated Jan 14, 2026, he still listed 1Password and LastPass as vulnerable and showed Bitwarden, Dashlane and Proton Pass as fixed. Keep the extension updated, and treat any unexpected "verify you are human" page that asks for several clicks with suspicion.
A clean Admin Panel on every business plan. SSO beyond Google Workspace is Enterprise-only.
For a small company the Admin Panel is the reason to pay for a business plan: you invite people, set password rules, see an activity log, and transfer a leaver's items to someone else. What changes by plan is identity: Teams and Business sign in with Google Workspace SSO, while Okta, Microsoft Entra ID and AD FS, plus automatic user and group provisioning, need Enterprise.
| Feature | Teams | Business | Enterprise |
|---|---|---|---|
| Admin Panel, password policy, activity log, item transfer | Yes | Yes | Yes |
| SSO with Google Workspace | Yes | Yes | Yes |
| Free personal Premium for each member | No | Yes | Yes |
| Shared folders, groups, Password Health | No | Yes | Yes |
| Data Breach Scanner (company domains) | No | 1 domain | Up to 10 |
| Vanta integration | No | Yes | Yes |
| SSO with Entra ID, AD FS, Okta; user and group provisioning | No | No | Yes |
| Network Allowlist, Sharing Hub, shared subfolders | No | No | Yes |
| Activity Log API; Splunk, Sentinel, CrowdStrike | No | No | Yes |
| Customized onboarding, dedicated success manager | No | No | Yes |
Two smaller admin details stood out. The Network Allowlist (Enterprise) can restrict vault and Admin Panel access by IP address or country, and NordPass's guide warns that rules that are too tight "may unintentionally block your team." And per the Google SSO help article, "An active Business Account session lasts up to 30 days on the same browser or device," unless your administrator set it differently.
Fine for storing an API key as a note. Not built to deliver secrets to code.
This is the section where NordPass's fit for AI builders is weakest. You can store an OpenAI or Anthropic key in a secure note or a password item, share it with a teammate for a limited time, and see in the activity log who shared what. What you cannot do is fetch that key from a terminal, inject it into a CI job, or give an AI agent scoped, revocable access to it. We found no command-line tool or secrets-injection feature in NordPass's help center, features page or pricing page as of Oct 4, 2026.
The API NordPass documents for organizations is the Activity Logs API, on Enterprise only (MSP partners get a separate Provider API for license and usage data). It is read-only audit data: you send a POST request to a regional endpoint with a token from the Admin Panel, filter up to 90 days at a time, and get at most the 10,000 most recent records, with a limit of 2,000 requests per 5 minutes per IP address. Tokens "last for two years," and Owners and Admins get email reminders before they expire. That is useful for a security team feeding a SIEM, not for a developer.
| Product | Developer and agent tooling, per its own pages (Oct 4, 2026) | Plan |
|---|---|---|
| NordPass | Activity Logs API (audit logs only); no CLI or secrets injection found | Enterprise |
| 1Password | "developer tools like SSH key signing, Git commit signing, CLI, and SDKs" | Teams Starter Pack and Business |
| Bitwarden | Secrets Manager with machine accounts to "Scope machine and AI agent access" | From $6/user/mo (Teams) |
| Proton Pass | Command line interface; SSH agent on business | Pass Plus; Pass Professional |
| Dashlane | None listed on its plan cards; it links a separate Developer tools page we did not review | Not compared |
A June 2026 reminder for AI builders. On Jun 18, 2026, OpenSourceMalware reported that more than 140 packages in the npm scope of Mastra, a TypeScript framework for AI agents, had been compromised with malware. Among other things, it went after browser-extension data for crypto wallets and password managers, and NordPass's extension is in its target list alongside LastPass, Bitwarden, 1Password, Dashlane, Proton and others. This was malware on infected machines, not a flaw in any password manager. The lesson is general: a password manager's encryption protects the stored vault, but a compromised developer laptop can still capture what you unlock, copy and type.
Two Cure53 audits, SOC 2 Type 2 and ISO 27001, but the newest public audit detail is from 2021.
NordPass leans heavily on outside validation, and its homepage says "Regular third-party audits validate our practices." Here is what is actually public, with the date of each source. Cure53's public list of reports does not include a NordPass report, so the findings below come from NordPass's own summaries and Cure53's quoted statement in the 2020 press release.
| Audit or certification | What it covered and found | Public? |
|---|---|---|
| Cure53 audit, consumer apps (announced Mar 5, 2020) | Cryptographic premise, source code, background application and codebase, before and after the Nov 2019 release. Cure53's founder: "The NordPass complex should be judged as secure." | Summary in a press release; full report not on Cure53's list |
| Cure53 audit, NordPass Business (Oct 20, 2021) | 21 person-days on Android, iOS and desktop apps, browser extensions, Admin Panel and Nord Account. "Cure53 identified 15 security-relevant issues, one of which had a 'High' severity score," fixed and verified by Cure53. | Summary on NordPass's blog |
| SOC 2 Type 1 (2022) and Type 2 (announced Dec 12, 2023) | Nord Security, "the provider of NordPass Business," passed the Type 2 audit of how controls operate over time | Report on request via NordPass's Trust Center |
| ISO/IEC 27001 | "Since 2021, NordPass has been compliant with the ISO/IEC 27001:2017" (Dec 12, 2023 post) | Certificate on request via the Trust Center |
| Penetration test report, HIPAA report | Listed as "NordPass Business Penetration Test Report" and "NordPass Business HIPAA Report" | On request; Trust Center updated Jul 22, 2026 |
| Bug bounty | Nord Security's HackerOne program was "extended to NordPass" in 2021 | Press release, Apr 1, 2021 |
Breach and incident history
| Date | Event | Source |
|---|---|---|
| Mar 2018 | Not NordPass: a NordVPN server at a Finnish data center was accessed through the provider's insecure remote management system; NordVPN said it held no user activity logs. Disclosed Oct 2019. | TechCrunch, Oct 21, 2019 |
| 2021 | Cure53's business audit: 1 High-severity issue, fixed and verified | NordPass blog, Oct 20, 2021 |
| Dec 2023 | Extension clickjacking reported (4 clicks to share all items to an attacker); $10,000 bounty | Marek Tóth, research page |
| Feb 15, 2024 | Extension 5.13.24 fixes the DOM-based clickjacking methods later shown publicly | Same, status updated Jan 14, 2026 |
| Jun 18, 2026 | Mastra npm malware targets password-manager extension data, NordPass included (machine compromise, not a NordPass flaw) | OpenSourceMalware |
Best for budget-minded individuals and small teams on Google Workspace. Weakest for developer-heavy teams.
| Work pattern | Fit | Likely plan |
|---|---|---|
| Freelancer or consultant with 50+ SaaS and AI logins, laptop plus phone | Good | Premium, 1-year first |
| Household or 2-3 founders sharing a few accounts | Good | Family (6 vaults) |
| Startup of 5 on Google Workspace sharing tool logins | Good | Business (not Teams) |
| Company with Okta or Entra ID and compliance reviews | Good, at a higher price | Enterprise |
| Dev team putting API keys into CI and AI agents | Weak | Pair with a secrets manager, or choose a rival |
| Someone who wants open-source, inspectable clients | Weak | Bitwarden or Proton Pass |
The drawbacks that matter before you pay.
- Low prices, and personal renewals printed at checkout
- Encryption design described step by step on its own security page
- Passkeys, 2FA codes and masked emails in one vault
- Google Workspace SSO even on the cheapest team plan
- SOC 2 Type 2, ISO 27001 and a fixed, rewarded extension flaw handled well
- No CLI, secrets injection or machine access for code and agents
- Business refund window is 14 days, not 30
- Teams sold only as a 10-user pack
- Okta, Entra ID, provisioning and SIEM are Enterprise-only
- Newest public audit detail is from 2021; recent reports on request
- Free plan allows one active session at a time
- No passkey import or export
- Written app reviews report re-login, sync and support friction
The last point deserves weight. Star averages are strong, but the written US App Store reviews from the past year include a run of one-star complaints about being asked for the Master Password too often, slow sync and reaching a human in support. I cannot tell how common those problems are, only that they recur. The browser extension's minimum 5-minute auto-lock, raised by one reviewer, is a smaller point for people who share a screen or step away from a laptop in public.
If NordPass is not the fit, match the alternative to the need.
Swipe sideways to see all columns →
| Product | Personal, per year | Team entry price | Free plan | Choose it if |
|---|---|---|---|---|
| NordPass | $23.88 first year, then $35.88 | Business $3.99/user/mo (5 min); Teams 10-pack | Yes, one active session | You want a low-cost vault with passkeys, 2FA codes and email masks in one app |
| 1Password | $35.88 first year (promo), regular $47.88 | Teams Starter Pack $24.95/mo for 10; Business $8.99/user/mo | No; 14-day trial | Developers need CLI, SDKs and SSH or Git signing |
| Bitwarden | Premium $19.80 | Teams $4/user/mo; Enterprise $6 | Yes, unlimited devices | You want open source, or Secrets Manager for agents |
| Proton Pass | Pass Plus $35.88 (promo) | Pass Essentials $1.99/user/mo, 3 min (promo); Professional $4.49 | Yes | You want a CLI and SSH agent, or already use Proton |
| Dashlane | Premium $65.04 ($5.42/mo) | Password Management $8/user/mo | No (pricing page lists paid plans) | You want its scam protection and VPN bundle |
This review has no affiliate links. NordPass did not see it or pay for it.
There are no affiliate links in this article. Every NordPass link goes straight to nordpass.com, NordPass's help center or its YouTube channel, with no tracking parameters from JAVIS. The renewal math, the limits for developers and the cheaper alternatives are written for the reader, not for a sale.
Hands-on status: JAVIS has not installed, paid for or tested NordPass for this review. Facts come from NordPass's public pages, checkouts, Terms of Service (Business), help center, blog and Trust Center listing; audit details from NordPass's summaries and the 2020 press release; the security research from Marek Tóth's own report; user sentiment from the US app stores and Hacker News; competitor prices from their public pricing pages, all as of Oct 4, 2026.
Start with the Free plan or the 30-day Premium trial it includes, and test sync between your laptop and phone.
Open nordpass.com/pricingRead the security page, then request the reports from the Trust Center during the 14-day trial.
NordPass security pageA password manager guards the logins. These reviews cover the tools behind them.
Each card opens a published JAVIS review.
Questions people actually ask before paying
How much does NordPass cost in October 2026?
As shown at NordPass's checkout on Oct 4, 2026, in USD before tax: Premium $23.88 for the first year ($1.99 a month) or $37.53 for a 2-year plan plus 3 promotional months ($1.39 a month); Family $44.28 or $67.23. Business seats cost $3.99 per user a month on a 1-year plan, 5 users minimum. There is also a Free plan.
What does NordPass cost when it renews?
Premium renews at $35.88 a year and Family at $71.88 a year, per the checkout. The Business 1-year checkout quotes the same $239.40 for five users at renewal, "subject to change" with notice.
Can I get a refund?
Personal plans: within 30 days of your first purchase, through NordPass support; renewals are not covered unless local law requires it. Business plans: within 14 calendar days of the first purchase, by email to business support, with exclusions for add-ons, renewals, crypto, prepaid and gift-card payments and partner purchases.
Is NordPass zero-knowledge?
NordPass says so: "no one – not even our company – can see what you and your team store in your vaults," and "Your Master Password, encryption, and decryption keys never reach our servers." Data is encrypted on your device with XChaCha20 before upload.
Has NordPass been hacked?
We found no public report of a breach of NordPass's servers or customer vaults as of Oct 4, 2026. A researcher reported clickjacking flaws in its browser extension from December 2023; his status table lists NordPass as fixed in version 5.13.24 (Feb 15, 2024). NordVPN, a sister product, had a server breached in 2018.
Does NordPass support passkeys and SSO?
Yes. NordPass stores and syncs passkeys, though you cannot import or export them. SSO with Google Workspace is on every business plan; Okta, Entra ID and AD FS are Enterprise-only.
Can I use NordPass to manage API keys for code or AI agents?
Only by storing them as vault items. There is no CLI or secrets injection; the Activity Logs API (Enterprise) returns audit logs only.
Where this came from, and when.
Pricing and plans: nordpass.com/pricing (personal and business plan cards, comparison tables, FAQ), the order.nordpass.com checkouts for Premium and Family (1-year and 2-year) and NordPass's business checkout for Teams, Business and Enterprise (monthly, 1-year and 2-year), all as of Oct 4, 2026, in USD. The personal checkout added 10% VAT for its detected tax country; prices elsewhere may differ. Promotions: nordpass.com/discount-period-terms-conditions (2-year promo, Jul 29 to Oct 21, 2026) and nordpass.com/promotion-terms-and-conditions (NPFALL26, Sep 1 to Oct 31, 2026).
Refunds and terms: help center, "What is your money-back policy?" (updated Sep 14, 2026) and "What is your money-back policy for Business customers?" (updated May 26, 2026); Terms of Service (Business), effective May 26, 2025, on business.nordsec.com. The consumer Terms of Service on my.nordaccount.com were not reviewed.
Product and security: nordpass.com home, /security, /features, /business-password-manager and /passkeys; help center articles "What is NordPass?", "What is a zero-knowledge architecture?", "Does NordPass save passwords on their servers?", "Premium vs Free version of NordPass", "What if I forgot my NordPass Master Password?", "Passkeys FAQs", "NordPass plans for business", "Activity Logs API", "How to manage NordPass Tokens", "How to configure a Network Allowlist", "How to set up Google SSO for organization members", "How to enable password policies for members", "How to enable Sharing for your organization members?" (each dated in the text); NordPass blog quarterly updates (Apr 7, Jul 24 and Sep 30, 2026).
Audits and certifications: PR Newswire release on the Cure53 audit (Mar 5, 2020); NordPass blog, "NordPass Business Has Undergone an Independent Security Audit" (Oct 20, 2021); NordPass blog, "We've earned the SOC 2 Type 2 attestation" (Dec 12, 2023); trust.nordpass.com document list (updated Jul 22, 2026); Cure53's public report list at cure53.de; GlobeNewswire release on the Nord Security bug bounty extension to NordPass (Apr 1, 2021).
Security history: Marek Tóth, "DOM-based Extension Clickjacking" (Aug 9, 2025, updated Jan 14, 2026); TechCrunch, "NordVPN confirms it was hacked" (Oct 21, 2019); OpenSourceMalware, Mastra npm malware report (Jun 18, 2026); mastra.ai for what Mastra is.
Video: NordPass Password Manager YouTube channel (linked from nordpass.com): 1FbbsLEPMmE (Jul 1, 2025) and UTEJGH64XdU (Aug 9, 2024, also embedded on nordpass.com/passkeys).
User sentiment: Apple App Store US (lookup with country=us: 4.65 average, 12,975 ratings, version 4.17 of Oct 2, 2026) and the 150 most recent US written reviews (Nov 9, 2025 to Oct 2, 2026); Google Play US listing with gl=US (4.4, 34.3K reviews, 1M+ downloads, updated Sep 15, 2026); Hacker News comments 48590683 (Jun 18, 2026) and 46304236 (Dec 17, 2025) and the Jul 11, 2019 launch submission. Trustpilot, Reddit and G2 are not included.
Competitors: 1password.com/pricing/personal and /pricing/business, bitwarden.com/pricing and /pricing/business, proton.me/pass/pricing and proton.me/business/pass/pricing, dashlane.com/pricing and /pricing-personal, Oct 4, 2026.
JAVIS Fit Score (77/100): an editorial composite for individuals and small teams who use many AI and SaaS tools, weighing price and renewal transparency (strong), documented encryption design (strong), business controls for small teams (good, with SSO beyond Google locked to Enterprise), developer and agent fit (weak: no CLI or secrets delivery), public audit recency (a deduction: newest public findings from 2021), user sentiment (mixed: high star averages, recurring written complaints) and the 14-day business refund window (a deduction). It is judgment, not a measurement.
What this review does not cover: hands-on autofill accuracy, sync speed, the consumer Terms of Service and Privacy Policy in full, the request-only audit and pentest reports, and NordPass's MSP program.
