NordPass vs Proton Pass vs Bitwarden (2026): Which Password Manager Should You Trust?

Affiliate disclosure: Some of the links below are affiliate links. We earn a commission when you sign up through them. This doesn't change your price and doesn't affect our rankings — see our full disclaimer for how we handle vendor relationships. Bitwarden has no affiliate program with us; it's included here because it's a legitimate, widely-recommended option and we think you should see how it stacks up.

Three password managers, three different philosophies. NordPass leans on a distinctive encryption cipher and the backing of Nord Security. Proton Pass leans on Proton's Swiss jurisdiction and an unusually generous free tier. Bitwarden leans on being fully open source with a decade of public audit history. We synthesized each vendor's own pricing and security documentation to lay out exactly what you get — and don't get — at every tier, so you can pick the one that matches your actual threat model and budget.

Our methodology

We compared each vendor's own pricing pages, security/architecture pages, and published compliance or audit documentation as of July 2026: bitwarden.com/pricing, proton.me/pass/pricing and proton.me/pass/security, and nordpass.com/security alongside NordPass's plans page. Where a vendor's pricing page rendered plan features but not exact dollar amounts at the time of research, we note that explicitly rather than inventing a number.

We don't take placement fees and we don't accept review accounts with strings attached. The NordPass link above is an affiliate link via Nord Security's affiliate program, and the Proton Pass link is an affiliate link via Commission Junction. Bitwarden currently has no affiliate program available to us, so its link is a plain, non-monetized link to bitwarden.com — we're covering it anyway because it's a legitimate contender and leaving it out would make this comparison dishonest.

Comparison table

Where exact current dollar pricing didn't render as plain text on a vendor's own pricing page at research time, we've flagged it as sourced from pricing-tracker consensus rather than presenting it as a directly-quoted vendor figure. Always confirm current price on the vendor's checkout page before buying — password manager pricing changes frequently and varies by region and promotion.

NordPass in depth

NordPass is built by Nord Security, the company behind NordVPN. According to NordPass's official security page, the vault is protected with the XChaCha20-Poly1305 authenticated-encryption cipher, and NordPass states it is "currently the only major password manager using XChaCha20." Master-password-derived keys use Argon2id with a 16-byte salt, and the private key that decrypts your vault is wiped from memory when the app locks. Infrastructure is hosted on AWS across separate US and EU data centers, per the same page.

On certifications, NordPass's security page lists ISO/IEC 27001 and SOC 2 alongside HIPAA and GDPR badges, and states the product "undergoes regular internal reviews and independent third-party security audits" plus a bug bounty program. Independent write-ups reference Cure53 audits of NordPass, though we recommend checking NordPass's own trust center (trust.nordpass.com) for the current public audit report rather than relying on secondhand summaries.

Free plan, per NordPass's official plans page: unlimited password storage, autosave/autofill, and multi-factor authentication — but access is capped at one device active at a time, and Password Health, the Data Breach Scanner, secure sharing, and file attachments are all Premium-only. Premium and Family add multi-device access, breach scanning (covering one primary domain), password health scoring, file attachments, and secure sharing. NordPass Authenticator is a separate line item not included even on Premium, per the plan comparison table.

NordPass is not open source — there's no such claim anywhere on its security page, in contrast to the other two products here.

Proton Pass in depth

Proton Pass is built by Proton AG, the Swiss company behind Proton Mail, Proton VPN, and Proton Drive. Per Proton's Pass security page, vault items are protected with 256-bit AES-GCM encryption using a 32-byte random vault key that "cannot be brute-forced," and Proton Pass encrypts not just passwords but all fields — usernames, URLs, and notes — so that "not even Proton" can read the metadata. For sharing and vault-key protection, Proton Pass layers in OpenPGP with Curve25519 elliptic-curve cryptography.

Proton's security page states plainly that "all Proton Pass apps are open source" and links to its GitHub org (github.com/protonpass) for independent review, plus a public bug bounty program and published third-party security-audit reports on Proton's blog. Proton is based in Geneva, Switzerland — a jurisdiction outside US and EU legal reach that the company markets as a structural privacy advantage.

Free plan, per Proton's official pricing page: unlimited devices, unlimited logins/notes/credit cards, the password generator, passkeys on all devices, alerts for weak/reused passwords, and — notably — 10 hide-my-email aliases at no cost. Not included on the free tier, per Proton's plan-comparison table: secure sharing of individual items, integrated 2FA/TOTP storage, item history, the CLI, file attachments, Dark Web Monitoring, Proton Sentinel's advanced account protection, or Emergency Access — those move to Pass Plus and above. Proton Unlimited bundles Pass Plus with Mail, Calendar, Drive, and VPN under one subscription.

Bitwarden in depth

Bitwarden is the only one of the three with no affiliate relationship to this site, and we're covering it in full because it's a legitimate, widely-recommended option that deserves a fair look. Per Bitwarden's official compliance page, its entire codebase — client and server — is hosted publicly on GitHub, and the company describes itself as "focused on open source software." That transparency extends to self-hosting: Bitwarden explicitly supports running the server application on your own infrastructure, which neither NordPass nor Proton Pass offers.

On pricing, Bitwarden's own pricing page (bitwarden.com/pricing) confirms the free plan includes "unlimited devices, unlimited passwords" with core features like the password generator, passkey management, encrypted export, and Bitwarden Send for direct encrypted sharing with one other user. Premium is $1.65/month, billed annually at $19.80, and adds the integrated TOTP authenticator, encrypted file attachments (5 GB), Emergency Access, and vault health reports. Families is $3.99/month for up to 6 users — figures Bitwarden's pricing page rendered directly, quoted as-is.

On security, Bitwarden's help-center compliance page lists SOC 2 Type II and SOC 3 certification, ISO 27001 certification, and an annual third-party audit program. As of the most recent update to that page, the cited assessments are a 2025 Bitwarden Web App and Network Security Assessment (Fracture Labs for the web application, Cure53 for network penetration testing) and a 2025 Bitwarden Mobile App Security Assessment (Unit 42 by Palo Alto Networks). Bitwarden's encryption model, per its published security whitepaper, uses AES-256 bit encryption with PBKDF2 or Argon2id for master-password-derived key stretching, under a zero-knowledge architecture.

The tradeoff: Bitwarden's free tier does not include integrated TOTP, file attachments, or Emergency Access — those moved behind Premium as part of a 2026 pricing restructure that also raised the Premium annual price. None of these three vendors gives you dark web monitoring or built-in authenticator codes for free; you're choosing which paid tier is cheapest for the specific feature you need.

Decision framework: which should you pick?

Try NordPass Free →   Try Proton Pass Free →

Frequently asked questions

Does Bitwarden have a real free plan?

Yes. According to Bitwarden's pricing page (July 2026), the free plan includes unlimited passwords and unlimited devices with no restrictions, plus core features like the password generator, passkey management, and Bitwarden Send. The paid Premium tier ($1.65/month billed annually) adds the integrated TOTP authenticator, encrypted file attachments, emergency access, and vault health reports — none of which are on the free plan.

Is NordPass's free plan actually usable?

It's usable but limited. NordPass's official plans page confirms the free tier supports unlimited password storage, autosave/autofill, and multi-factor authentication, but restricts you to one device active at a time and omits Password Health, the Data Breach Scanner, secure sharing, and file attachments — all of which require the Premium plan.

Is Proton Pass's free tier better than the competition?

On paper, yes, for a specific set of features. Proton's pricing page shows the free tier includes unlimited devices, unlimited logins, passkeys on all devices, and 10 hide-my-email aliases at no cost — features that NordPass and Bitwarden gate differently. However, Proton Pass Free does not include integrated 2FA/TOTP storage, secure item sharing, Dark Web Monitoring, or file attachments; those are Pass Plus features according to Proton's plan comparison table.

Which of these three is open source?

Bitwarden and Proton Pass are both open source; NordPass is not. Bitwarden's official compliance page states its entire codebase is hosted publicly on GitHub. Proton's security page states all Proton Pass apps are open source and independently reviewable on GitHub. NordPass's security page describes its architecture and audit history but does not claim an open-source codebase.

What encryption does each one use?

NordPass uses XChaCha20-Poly1305 for vault data (per NordPass's official security page), which it says makes it the only major password manager built on that cipher. Proton Pass uses 256-bit AES-GCM for vault encryption plus OpenPGP with Curve25519 for key sharing (per Proton's Pass security page). Bitwarden's public security whitepaper documents AES-256 bit encryption with PBKDF2 or Argon2id key derivation, and its zero-knowledge model has been independently audited multiple times.

Have these companies been independently audited?

All three publicize third-party audits. NordPass's security page cites Cure53 audits and SOC 2/ISO 27001 certification. Bitwarden's compliance page lists a 2025 web-app and network assessment (Fracture Labs and Cure53) and a 2025 mobile-app assessment by Unit 42 (Palo Alto Networks), alongside SOC 2 Type II, SOC 3, and ISO 27001 certifications. Proton's security page links to its published open-source security audit reports for Proton Pass.

The bottom line

There's no single winner here — the honest answer depends on what you're optimizing for. If code transparency and self-hosting matter to you, Bitwarden's fully open-source, independently audited codebase is the strongest match, and its $1.65/month Premium price is the cheapest confirmed figure in this comparison. If you want the most capable free plan without any upgrade pressure, Proton Pass's unlimited-device free tier with 10 built-in email aliases is hard to beat. If you're already inside the Nord Security ecosystem — NordVPN, NordLocker — or specifically want the XChaCha20 cipher, NordPass is a reasonable, well-certified choice, just note the one-device restriction on its free tier.

What all three share: none of them will read your passwords, all three have published independent security-audit history, and all three are meaningfully better than reusing passwords across sites or storing them in a browser without a master password. Pick based on the feature gaps above, not on marketing — the differences that matter are in the free-tier limits and the specific paid features each vendor gates.

Start with NordPass Free →