NordPass
Nord Security's password manager, priced in pounds and sold the Nord way, with no CLI, API, MCP server or open-source code.
Who owns it
NordPass is the password manager of Nord Security, the group founded in Lithuania in 2012 behind NordVPN and NordLayer, with a holding company in the Netherlands and, for NordVPN at least, a contracting entity in Panama; NordPass's own terms and privacy pages blocked our reading, so the entity behind a NordPass contract is recorded as unconfirmed rather than assumed. The vault uses XChaCha20 with Argon2id key derivation, which NordPass calls unique among major password managers; the business pages list ISO 27001, SOC 2 Type 2 and a Cure53 audit as badges without a report link or date; there is a bug bounty. The clients are closed source, there is no self-hosting, and we found no data-residency page, so where a UK customer's vault sits is not published.
What it costs
Prices in pounds, stated as excluding VAT, on 8 September 2026, and they follow the Nord pattern of a discounted introductory term against a struck-through list price. Personal: Free, with autofill and storage but no multi-device access; Premium at £1.49 a month on a one-year plan (£17.88 for the first year against a £27.48 list) or £1.09 a month on a two-year plan; Family at £2.79 a month for six. Business: Teams at £1.99 a user a month on a one-year term, £1.79 on two years or £2.49 month to month, sold only as a ten-user pack, with an admin panel, shared folders and Google Workspace SSO; Business at £3.99 (£5.99 monthly) with a five-seat minimum adds group sharing, password health, breach monitoring and activity logs; Enterprise at £5.99 (£7.99 monthly) adds Entra ID, ADFS and Okta SSO with automatic user provisioning, a SIEM feed and an activity-log API. A 14-day business trial needs no card and personal plans carry a 30-day money-back guarantee; what the plan renews at after the introductory term is not shown on the page.
What you get and what to watch
Credentials are well covered: passkeys are stored, shared and used to sign in to sites, a built-in authenticator generates TOTP codes, biometrics and Windows Hello unlock the apps, and email masking hides staff addresses. What is missing is everything a developer or an automation would use: we found no command-line tool, no public API beyond the Enterprise activity log, no MCP server and no open-source code, a different posture from Bitwarden or 1Password. Support is 24/7 live chat on every business tier. Trustpilot is 4.0 on 2,064 reviews, 80% five-star and 10% one-star, many of them invited, with billing after cancellation, a Windows extension freezing after unlock and upgrade banners in the free app the recent one-star themes.
Not yet tested by Saaskly: assessed on published pricing, documentation, audit reports and third-party reviews.
Pros
- +Pound pricing before VAT from £1.99 a user with a month-to-month option; ISO 27001, SOC 2 Type 2 and a Cure53 audit
- +XChaCha20 and Argon2id; passkeys, a built-in authenticator, email masking; 24/7 live support
- +Trustpilot 4.0 on 2,064 reviews
Cons
- −No CLI, no public API, no MCP server, no open-source code, no self-hosting
- −Introductory pricing with the renewal rate not shown; Teams sold only in ten-user packs; Entra ID and Okta SSO need Enterprise
- −The contracting entity and the vault's data location are not published
Pricing
Minimum commitment: £1.49 (£1.49/yr for the entry licence). The least you can spend before walking away; excludes numbers, minutes and add-ons.
Premium (individual)
£1.49/yr · annual commitment
Month-to-month: not published
- ✓£1.49/mo on a one-year plan (£17.88 first year; list £27.48/yr), £1.09/mo on two years, ex VAT, 8 Sep 2026. Renewal rate not shown on the page. Family £2.79/mo for 6. Free: single-device access. 30-day money-back.
Teams (10-user pack)
£2.49/mo · month-to-month
£1.99/yr on an annual commitment
Month-to-month costs 25% more
- ✓£1.99/user/mo on a one-year term, £1.79 on two years, £2.49 month to month; sold as a 10-user pack; Google Workspace SSO. Business £3.99 (£5.99 monthly), min 5. Enterprise £5.99 (£7.99 monthly) with Entra ID/Okta SSO and provisioning. 14-day trial, no card.
Specifications
| Rating | 3.6 |
| Pricing and plans | |
|---|---|
| Business per user* | £1.99/user/mo annual · £2.49 monthly (Teams (10-user pack)) |
| Individual | £1.49/mo annual only |
| Free tier | Limited |
| Seat minimum | 10 |
| Family plan | £2.79/mo (6 seats) |
| Scored tier | Teams (10-user pack) |
| Tier above | Business (£3.99/user) |
| Free tier limits | One device at a time; no password health or breach scanner |
| Money-back (days) | 30 |
| Features | |
| Passkeys | Store |
| TOTP codes | ✓ |
| Hardware key | No |
| Shared vaults | ✓ |
| Secrets manager | No |
| Email aliases | ✓ |
| Built-in VPN | No |
| Admin console | ✓ |
| Role-based permissions | ✓ |
| Password health reports | ✓ |
| Dark-web monitoring | ✓ |
| External sharing | No |
| Guest accounts | No |
| Emergency access | ✓ |
| Browser extensions | Chrome, Firefox, Edge, Safari, Opera, Brave |
| Desktop apps | ✓ |
| Integrations and developers | |
| Open source | No |
| Self-host | No |
| SSO | Included |
| SCIM | ✓ |
| CLI | No |
| MCP server | No |
| API | No |
| Ownership and trust | |
| Breach on record | No |
| Last audit | None published |
| Owned in** | Other |
| Data location | Not published |
| Trustpilot (reviews) | 4.0 (2,064) |
| Encryption | XChaCha20; Argon2id key derivation |
| Zero-knowledge | ✓ |
| Bug bounty | ✓ |
| Audit logs | ✓ |
| HQ | Lithuania |
| Owner | Nord Security |
| SOC 2 | ✓ |
| ISO 27001 | ✓ |
| Support | |
| Linux | ✓ |
| Live chat | ✓ |
| Phone support | No |
| Support channels | Live chat 24/7, Email |
*Business per user: the business or teams tier the score is set on, per user per month on annual billing and then month-to-month, in the currency the vendor shows a UK visitor on the research date; see each profile for the VAT basis, the seat minimum and what the tier above adds.
**Owned in: where the company that owns the provider answers to. A US-owned provider is subject to US law (including the CLOUD Act) wherever the vault is stored; with a zero-knowledge design the vendor cannot read the vault either way, so this column is about the company, not the encryption. "Data location" records where the encrypted vault is stored.
Ready to try NordPass?
Affiliate link: Saaskly may earn a commission. It never affects our verdict.
Researched and drafted with AI assistance; reviewed and approved by Tim Meredith. How we use AI
Work at NordPass? Something not look right? Register in the vendor portal to see what we publish and send corrections.