What NordPass says about its encryption
These are vendor statements from the NordPass security page, not results of our own testing. NordPass says data is encrypted locally on your device before upload, that it follows a zero-knowledge principle so no one, including the company, can see vault contents, and that it uses XChaCha20, which it says is widely considered the most advanced encryption algorithm available today [1].
The page describes the key chain: your Master Password plus a 16-byte salt goes through Argon2id to derive a Master Key; that unlocks a private key encrypted with XChaCha20-Poly1305-IETF; the private key decrypts the data encryption key that protects vault items. Key exchanges use X25519 with XSalsa20 and Poly1305. When the app locks, NordPass says the private key is wiped from memory [1].
NordPass also says vault items are stored on AWS in separate US and EU data centers, app logs stay on your device unless you share them, and it runs a bug bounty program [1].
Published audits and attestations
Independent evidence is what separates a claim from a checked claim. The NordPass items we could find are listed below with their dates. The most detailed public write-up we found covers NordPass Business, not the consumer apps, and is from 2021. The security page says the product undergoes regular internal reviews and independent third-party security audits and cites ISO 27001 and SOC 2 Type 2 [1].
| Evidence | Date | What it covered | What it says |
|---|---|---|---|
| Cure53 audit of NordPass Business [2] | Published 20 Oct 2021 | Android, iOS and desktop apps, browser extensions, Admin Panel and Nord Account; 21 person-days | 15 security-relevant issues, one rated High; NordPass says the High issue was fixed quickly and Cure53 verified the fix |
| Earlier Cure53 audit of the consumer product [2] | Not dated on the page | NordPass B2C product | Mentioned as already completed; no findings summarized on that page |
| SOC 2 Type 2 attestation [3] | Announced 12 Dec 2023 | Nord Security, provider of NordPass Business | Followed a SOC 2 Type 1 in 2022 |
| ISO/IEC 27001 [3] | Since 2021, per the same post | NordPass information security management | Stated as compliance with ISO/IEC 27001:2017 |
What zero-knowledge does not protect you from
Zero-knowledge means the provider cannot read your vault; it does not stop someone who gets your master password. The LastPass incident shows why the master password matters: LastPass said an attacker copied encrypted vault backups, and that their safety depended on keys derived from each user’s master password [8]. The same logic applies to any vault, NordPass included.
NordPass account MFA can use an authenticator app or a Bluetooth, NFC or USB security key, and it applies to your Nord Account across Nord products [4]. MFA is included on the Free plan [6]. If you forget your Master Password, NordPass says you reset it with the 24-symbol recovery code you saved at setup [5]; lose both and you are relying on the separate account-reset path.
Emergency Access is a deliberate exception to zero-knowledge between people: a trusted contact you choose can view all your passwords and notes once access is granted [7]. Use it only with someone you fully trust.
Checklist: what to verify for any password manager
- Is encryption done on the device before upload, and how is the key derived from the master password? NordPass documents Argon2id and XChaCha20 [1].
- Is there a named third-party audit, with a date and a scope that includes the apps you will use? Check how old it is [2].
- Are there organization-level attestations such as SOC 2 Type 2 or ISO 27001, and which entity do they cover [3]?
- Does the free plan include MFA for the account? NordPass Free does [6].
- Does the service support a hardware security key for login [4]?
- What is the recovery path if you forget the master password, and where will you store the recovery code [5]?
- Who can see your data through sharing or emergency features, and after what wait [7]?
Questions before you decide
Can NordPass see my passwords?
NordPass says no. It describes a zero-knowledge design where data is encrypted on your device before upload and no one, including the company, can see vault contents. That is a vendor statement this guide did not verify independently.
Has NordPass been independently audited?
NordPass published a Cure53 audit of NordPass Business in October 2021 that found 15 issues, one High and fixed, and reported a SOC 2 Type 2 attestation for Nord Security in December 2023.
What happens if I forget my NordPass Master Password?
NordPass says you reset it with the 24-symbol recovery code you were asked to save during setup. Without that code you need its separate account reset process.
Sources & verification
Product details and prices can change. Check the linked provider before buying.
- NordPass security overview Accessed 30 Oct 2026
- NordPass: NordPass Business has undergone an independent security audit (20 Oct 2021) Accessed 30 Oct 2026
- NordPass: SOC 2 Type 2 attestation (12 Dec 2023) Accessed 30 Oct 2026
- NordPass: how to enable multi-factor authentication Accessed 30 Oct 2026
- NordPass: what if I forgot my Master Password Accessed 30 Oct 2026
- NordPass plans (1-year and 2-year tabs, compare all features) Accessed 30 Oct 2026
- NordPass: how to give Emergency Access Accessed 30 Oct 2026
- LastPass blog: notice of recent security incident (Aug to Dec 2022 updates) Accessed 30 Oct 2026
Sources link directly to providers. Product buttons may use separately labeled affiliate links. Read our disclosure.