NordPass Data Export: One Format, And It Is The Plain One
NordPass exports to CSV and nothing else. No encrypted archive, no direct transfer, and no statement of which item types travel. The lowest password manager score here.
Exit score: 19 / 30
How hard NordPass makes it to leave with your data intact, scored against 6 criteria from the vendor's own published documentation. How we score.
| Criterion | Score | What the documentation says |
|---|---|---|
| Self-service | 4/5 | Export runs from the app without a request, an admin or a waiting period. Deducted one point because a single route means no fallback if it does not work for you. |
| Format openness | 3/5 | CSV is maximally open and every competing product reads it. But openness is the only virtue on offer here - there is no encrypted archive and no direct transfer standard documented alongside it. |
| Completeness | 2/5 | The documentation does not enumerate which item types are exported. For a vault holding passwords, notes, cards and identity records, not knowing what travels is a substantial gap. |
| Not paywalled | 4/5 | No plan tier is named as a requirement for export. Deducted one point because the article addresses the mechanism rather than availability, so the absence of a gate is inferred rather than stated. |
| Documentation clarity | 2/5 | Thin. It explains how to click through the export and warns "Never send your exported password file over email or untrusted channels", but does not state what the file holds or whether it is encrypted. |
| Caps and expiry | 4/5 | No item limits, throttles or expiry windows are documented. Scored high but not full, since the article does not confirm their absence explicitly. |
What comes out
- Your vault as a CSV file, readable by every competing password manager.
- Enough to migrate the core of an account - credentials in a universally understood format.
- On demand, with no waiting period or build queue.
What stays behind
- Any encrypted export option - CSV appears to be the only documented format.
- Any direct app-to-app transfer route of the kind Dashlane supports.
- Certainty about item types, since the documentation does not list what the CSV contains.
- Sharing and group configuration, which is account state rather than vault content.
NordPass scores 19 and nothing about that is a complaint about lock-in. You can export whenever you like, without asking anyone, with no waiting and no apparent tier gate. On the crude question of whether you are trapped, the answer is no.
The score is low for a subtler reason: there is only one way out, and it is the unsafe one.
CSV, alone
NordPass documents export to CSV. We found no encrypted archive format, and no equivalent of the direct app-to-app transfer that Dashlane supports.
For most software, one open format would be fine — CSV is universal, and universality is what a migration needs. For a password vault it is different, because of what the file is.
A CSV export of a password manager is a plain text document containing every login you have, including the ones for your email and your bank, in a folder that is probably synced to a cloud service. It has no password on it. Anyone who opens it can read all of it.
Products that offer an encrypted alternative give you a choice about whether that object ever exists. As documented, NordPass does not.
The warning it does give
To NordPass's credit, it does not present this casually:
"Never send your exported password file over email or untrusted channels."
That is worth taking seriously and worth understanding, because the reasoning is more than general caution. Email is stored on servers you do not control, retained indefinitely, indexed, and frequently synced to several devices. And your email account is itself protected by a password that is in the file.
Emailing a password export to yourself means the compromise of one account exposes every account you have. It is the specific move that turns a small breach into a total one.
What the documentation does not answer
Here is the gap that costs NordPass most of its points.
A modern password manager holds several kinds of thing: passwords, secure notes, payment cards, identity records, sometimes file attachments. The export documentation does not say which of those are in the CSV.
That is not a small omission. Secure notes are where people put recovery codes, software licence keys, safe combinations, account numbers — the things that are painful and sometimes impossible to reconstruct. If they are not in the export, and nothing tells you, you will find out after you have closed the account.
We have not guessed. It is listed as unverified above, and the only reliable answer is empirical: export, import, and go looking for a specific note.
How to do this safely anyway
The absence of an encrypted route does not make migration unwise. It makes it a task you do properly, in one sitting.
Set aside an hour. Export, import into the destination, verify, delete, empty the trash. The file should not exist when you stand up.
Export to a local folder, not a synced one. Desktop and Documents are frequently backed up to a cloud service by default. Downloads usually is not, but check. A plaintext password list uploaded to a backup provider is not something you can retract.
Verify before you delete anything from NordPass. Open the new vault, log into three real accounts with it, and find one secure note. Only then remove the source.
Rotate what matters afterwards. Email, banking, and the master password of the new manager. Twenty minutes, and it closes the window that the export opened.
Why this scores below Dashlane and Proton Pass
All three let you leave. The difference is what they let you leave with.
| Product | Formats documented | Encrypted route |
|---|---|---|
| Dashlane | CSV, DASH secure file, Credential Exchange | Yes — two of them |
| Proton Pass | PGP-encrypted ZIP, plain ZIP, CSV | Yes |
| NordPass | CSV | Not documented |
That table is most of the score. It is a gap in provision rather than a policy against you, and it could be closed by NordPass at any time — an encrypted export format is not a difficult feature. Until it is, the plaintext moment is unavoidable, and the honest thing is to plan for it rather than pretend it is not there.
The verdict
19 out of 30. Free to leave, thinly documented, and only one road out.
Nothing here suggests NordPass is holding your data hostage. What it does suggest is that export has been treated as a checkbox rather than a designed feature — one format, a short article, and no statement of contents.
For the same category done considerably better, see Dashlane at 24 and Proton Pass at 25. For choosing one in the first place, our small business password manager guide covers the buying decision rather than the leaving one.
Before you cancel
- Plan the export and the import as one continuous task. The file should not survive the afternoon.
- Export to a local disk, never to a synced or cloud-backed folder.
- Heed NordPass's own warning and never send the file over email or any messaging app.
- Delete the file and empty the trash immediately after importing.
- Check your destination vault for secure notes, cards and identity items specifically - do not assume they came.
- Change your most critical passwords afterwards, on the assumption the file was briefly readable.
- If you use NordPass on mobile only, confirm the desktop or web app is where the export lives before you need it.
What we could not verify
- Whether the exported CSV is encrypted in any way - the documentation does not say.
- Which item types are included: passwords, secure notes, credit cards, personal information.
- Whether export is available on the free plan or requires a subscription.
- Whether export is possible from the mobile apps or desktop and web only.
These are open questions, not criticisms. Where a vendor does not publish an answer we leave it unscored rather than guessing, and the score is calculated only from what is documented.
Questions people ask
How do you export passwords from NordPass?
Through the app's export function, which produces a CSV file. That is the only format documented - there is no encrypted archive and no direct transfer to another password manager. The CSV can then be imported into any competing product.
Is a NordPass export encrypted?
The documentation does not state that it is, and CSV files are not encrypted by nature. Treat the exported file as a plain readable list of every credential you own until NordPass documents otherwise, and handle it accordingly.
Does a NordPass export include secure notes and credit cards?
NordPass does not enumerate the item types in its export documentation, so this could not be established from the source. Import into your destination and check for a specific note and a specific card before deleting anything from NordPass.
Can you email a NordPass export to yourself?
No, and NordPass says so: never send your exported password file over email or untrusted channels. Email leaves copies on servers you do not control, in an account that is itself protected by one of the passwords in the file. The circularity is the point.
Is NordPass harder to leave than Dashlane?
Slightly, and specifically because of what is missing rather than what is blocked. Both let you export freely. Dashlane additionally offers an encrypted archive and a direct app-to-app transfer, so it gives you a way to migrate without a plaintext file ever existing. NordPass, as documented, does not.
Where this information comes from
Product details change often. Each item below links to the primary source we checked, so you can confirm anything that matters to your decision.
Vendors change their export tooling without announcing it. If something here no longer matches what you see in the product, tell us and we will re-check it.