Security and privacy decision
NordPass
A competent developer can build a useful self-hosted password vault and browser autofill, but reproducing NordPass’s enterprise integrations, certifications, and managed breach-scanning at scale is costly—keep paying for full enterprise capabilities or build a minimal internal tool for limited needs.
Visit website↗$4.99/mo
$60/yr
Not verified against a pricing page.
$100one-off80 h to build
$0/mo6 h/mo upkeep
On cash alone, building overtakes the subscription at 2 seats.
Open-source builds that already do this
Every project below is open source and already does this job today. Fork one, self-host it, or take the parts you need - the build prompt further down assumes an empty file, and this is the shortcut past that. Licences differ; check the one on each card before you ship. All NordPass alternatives, with the arithmetic →
What a replacement has to do
- Store encrypted credentials in a per-user vault, autofill logins in browsers, sync encrypted vaults via a backend, basic org admin to provision users and shared folders, and a simple breach-check using a public breach dataset.
What it still won’t have
- Third-party security certifications and audit evidence (ISO 27001, SOC 2, HIPAA)
- Enterprise integrations (Entra ID/Okta, Splunk, Microsoft Sentinel, Vanta)
- 24/7 enterprise support and dedicated customer-success management
- Built-in hosted dark-web/credit-card breach scanning at scale
What remains hard
- Compliance and regulation
ISO 27001 certified
- Compliance and regulation
SOC 2 Type 2 certified
First-year cost
Keep paying
Paying is—cheaper in year one.
On cash alone, building overtakes the subscription at 2 seats.
Money you would actually spend
Time you would spend
—
What you would spend
What we assumed
The verdict above measures whether you could build it. This one is only about money.
Runnable build prompt
Build a minimal cross-platform password manager using React for the admin UI, React/TypeScript for a browser extension, Node.js/Express for the sync API, Postgres for metadata, and S3 for encrypted blob storage. Implement: (1) per-user encrypted vaults (use libs for XChaCha20 or AES-GCM), (2) secure auth (email+password + optional WebAuthn), (3) browser extension autosave/autofill communicating securely with native/app or extension storage, (4) backend endpoints to store/retrieve encrypted vault blobs and basic user/group provisioning, (5) a simple breach-checker that compares emails/password hashes against a provided breach dataset. Out of scope: enterprise SSO integrations (Okta/Entra), third-party compliance certification, and 24/7 support. Include error handling, audit logging for admin actions, and unit/integration tests for crypto, API, and extension flows.
How we checked
How the score was reached
- Partly verdict base52
- An open-source build was found+5
- 5 cited sources+3
- Hard moats found in the evidence-3
- Evidence score57
The base comes from the verdict. Everything under it is a check that either happened or did not, and each one is a fact frozen in this record rather than a judgement made at render time - so the same evidence always produces the same number.
How scoring works →Cited sources · 5
Every page the run actually retrieved.
- official productNordPass — official product
- official pricingNordPass Business plans
- official docsNordPass Features
- open sourceAdam-ZS/AccessVault
- open sourceVaultGaurd-Credential-Manager
Integrity checks
What held up, and what did not.
