Nordpass® Password Manage
🔍 Security Report Available View on Chrome Web StoreChrome will indicate if you already have this installed.
Overview
Designed by the security experts behind NordVPN, the NordPass password manager offers a refined yet user-friendly approach to password management. Effortlessly generate strong passwords, identify weak passwords, discover whether your data has appeared in a data breach, and benefit from the convenience of our autosave and autofill features. But there’s more to NordPass than meets the eye. Beyond passwords, trust NordPass to store your passkeys, credit cards, personal notes, and even files with 3GB of storage reserved just for that.
Never compromise on security. Keep your passwords safe with NordPass.
Here’s more of what you get when you choose NordPass:
➡️ Autofill and Autosave
Log into your favorite website without manually typing your password every time, and autosave new passwords with a click.
➡️ Documents
Securely store and organize PDFs and scans of passports, IDs, and any important paperwork. Add expiry dates and get automatic reminders before anything runs out.
➡️ Password Generator
Generate strong passwords for your online accounts with a single click.
➡️ Passkey storage
Step beyond passwords. Store passkeys next to passwords in NordPass, access them anytime, anywhere.
➡️ Password Health
Identify weak, old, and reused passwords with the dedicated Password Health tool.
➡️ Data Breach Scanner
Check if any of your sensitive data has been compromised and take immediate action.
➡️ Breach Monitoring
Receive real-time alerts about your breached data and stay ahead of potential threats.
➡️ Emergency access and password sharing
Share passwords securely with trusted individuals and provide emergency access to close contacts.
➡️ Credit card and personal info storage
Have direct, instant access to payment details when online shopping or personal details when booking trips without the need to remember or manually type them out.
➡️ Device sync
Save a password on your laptop and access it on your mobile while on the go.
➡️ Unlimited storage and devices
Store countless passwords and access them on all of your devices, even when you’re offline.
➡️ MFA and biometrics
Enhance security with Multi-Factor Authentication, OTP generators, and biometric access.
➡️ File Attachments
Securely attach, store, and retrieve files with 3GB of storage.
➡️ Password Import and Export
Switch from another password manager to NordPass without losing any data.
➡️ XChaCha20 encryption
All your data in NordPass is encrypted with the cutting-edge XChaCha20 encryption algorithm, ensuring unparalleled password security.
➡️ Zero-Knowledge architecture
With NordPass's zero-knowledge architecture, only you have access to your data.
Download NordPass and forget your password stress. Forever.
ℹ️ For more information, visit: https://nordpass.com/
🔒 For Privacy Policy, visit: https://nordpass.com/privacy-policy
✉️ Feel free to contact our Customer Support team with any questions you may have: support@nordpass.com
Tags
Privacy Practices
Security Analysis — Nordpass® Password Manage
Permissions
Code Patterns Detected
External Connections
Package Contents 138 files · 28.3MB
What This Extension Does
NordPass Password Manager is a browser extension that securely stores and autofills passwords, credit cards, personal notes, and files. It offers features like password generation, data breach scanning, and emergency access sharing. This extension is suitable for individuals seeking to manage their online identities and sensitive information.
Permissions Explained
- idleexpected: This permission allows the extension to run in the background even when the browser is idle.
Technical: The 'idle' permission grants access to Chrome's idle API, which can be used to monitor and control the browser's activity. This could potentially allow the extension to inject malicious code or track user behavior without their knowledge. - alarmsexpected: This permission enables the extension to schedule notifications and reminders.
Technical: The 'alarms' permission grants access to Chrome's alarms API, which can be used to create and manage scheduled events. This could potentially allow the extension to send unsolicited notifications or track user behavior without their knowledge. - storageexpected: This permission allows the extension to store data locally on your device.
Technical: The 'storage' permission grants access to Chrome's storage API, which can be used to read and write data to local storage. This could potentially allow the extension to steal sensitive information or inject malicious code without user consent. ⚠ 1 - tabsexpected: This permission enables the extension to access and manipulate browser tabs.
Technical: The 'tabs' permission grants access to Chrome's tabs API, which can be used to read and write tab data. This could potentially allow the extension to inject malicious code or track user behavior without their knowledge. - privacycheck this: This permission allows the extension to access sensitive information about your browsing activity.
Technical: The 'privacy' permission grants access to Chrome's privacy API, which can be used to read and write private data. This could potentially allow the extension to steal sensitive information or inject malicious code without user consent. ⚠ 1 - contextMenusexpected: This permission enables the extension to create custom context menus in the browser.
Technical: The 'contextMenus' permission grants access to Chrome's context menu API, which can be used to inject malicious code or track user behavior without their knowledge. - offscreenexpected: This permission allows the extension to create off-screen windows and tabs.
Technical: The 'offscreen' permission grants access to Chrome's off-screen API, which can be used to inject malicious code or track user behavior without their knowledge. - clipboardReadcheck this: This permission enables the extension to read data from your clipboard.
Technical: The 'clipboardRead' permission grants access to Chrome's clipboard API, which can be used to steal sensitive information or inject malicious code without user consent. ⚠ 1 - https://api-toggle.nordpass.com/*expected: This permission allows the extension to make requests to NordPass's API.
Technical: The 'https://api-toggle.nordpass.com/*' permission grants access to NordPass's API, which can be used to read and write sensitive information. This could potentially allow the extension to steal user data or inject malicious code without their knowledge. - https://api-toggle.stag.us.nordpass.com/*expected: This permission enables the extension to make requests to NordPass's staging API.
Technical: The 'https://api-toggle.stag.us.nordpass.com/*' permission grants access to NordPass's staging API, which can be used to read and write sensitive information. This could potentially allow the extension to steal user data or inject malicious code without their knowledge. - https://lastpass.com/*expected: This permission allows the extension to make requests to LastPass's API.
Technical: The 'https://lastpass.com/*' permission grants access to LastPass's API, which can be used to read and write sensitive information. This could potentially allow the extension to steal user data or inject malicious code without their knowledge.
Your Data
NordPass Password Manager accesses sensitive information such as passwords, credit cards, personal notes, and files. It sends this data to NordPass's API (https://api-toggle.nordpass.com/*) and LastPass's API (https://lastpass.com/*).
Technical Details
- www.w3.org
- support.nordpass.com
- nordpass.com
- formatjs.github.io
- my.nordaccount.com
- business.nordsec.com
- github.com
- api.nordpass.com
- json-schema.org
- addons.mozilla.org
- nordcheckout.com
- bit.ly
- https
- wss
- cookies
- tokens
- keystrokes
- page content
Code Findings
The extension uses dynamic JavaScript imports, which can make it harder to analyze and debug.
Technical: The extension uses the import() function to dynamically load JavaScript modules. This can be used to inject malicious code or evade security measures.
💡 Dynamic imports are commonly used in legitimate extensions to improve performance and flexibility.
The extension uses string obfuscation techniques, which can make it harder to analyze and debug.
Technical: The extension uses the String.fromCharCode() function to obfuscate strings. This can be used to hide malicious code or evade security measures.
💡 String obfuscation is commonly used in legitimate extensions to protect sensitive information.
The extension captures keystrokes, which can be used to steal sensitive information.
Technical: The extension uses the document.addEventListener('keydown', ...) function to capture keystrokes. This can be used to inject malicious code or steal user data without their knowledge.
💡 Keystroke capturing is commonly used in legitimate extensions for password management and autofill purposes.
The extension may contain hardcoded secrets, which can be used to inject malicious code or steal user data.
Technical: The extension contains a potential hardcoded secret in the background.js file. This can be used to inject malicious code or steal user data without their knowledge.
💡 Hardcoded secrets are commonly used in legitimate extensions for authentication and authorization purposes.
NordPass Password Manager is a feature-rich extension that offers robust password management and security features. However, it captures keystrokes, which raises concerns about user data protection. Users should exercise caution when using this extension and ensure they understand the risks involved.
