What does NordVPN actually include?
NordVPN’s feature set is broader than a single VPN app. At its center is an actively developed core VPN entitlement covering multiple protocols, a kill switch, DNS protection and a wide range of specialty servers. Around that core, NordVPN has added security and networking features that live inside its applications, one paid add-on for users who need a stable personal IP, and a group of separately branded products sold alongside the subscription.
Not everything on that list works the same way. Selected security and networking features, including scam and phishing protection and Meshnet, sit inside the NordVPN app itself. Dedicated IP is a paid add-on rather than something included by default. NordPass, NordLocker, Incogni and a US identity-protection service are separately bundled products, not features of the VPN client. And across all of these, exactly what you get depends heavily on your platform, your app build, your plan and sometimes your region.
In short, NordVPN’s features break down into four layers:
- The core VPN: protocols, kill switch, DNS protection and specialty servers, forming the central entitlement across NordVPN’s consumer plans, subject to platform support.
- Features built into the app: scam and phishing protection, Meshnet and the post-quantum option, available inside selected NordVPN applications.
- A paid add-on: Dedicated IP, purchased separately.
- Separately bundled products: NordPass, NordLocker, Incogni and a US identity service, sold alongside NordVPN but run as their own applications or services.
The four layers of NordVPN
Thinking of NordVPN as four layers, rather than one flat feature list, makes it much easier to answer the question that actually matters: what do you get, and where?
| Layer | What it means | Included capabilities or products |
|---|---|---|
| The core VPN layer, subject to platform support | The VPN itself: how your traffic gets encrypted and routed | NordLynx, OpenVPN, IKEv2/IPsec where supported, NordWhisper, kill switch, auto-connect, DNS protection, split tunnelling, specialty servers, up to 10 devices |
| Features built into the app | Security and networking tools surfaced inside selected NordVPN applications | Scam and phishing protection, scam, phishing, and malware protection, Dark Web Monitor, the post-quantum option, Meshnet |
| A paid add-on | Extra capability purchased on top of a plan | Dedicated IP |
| Separately bundled products | Products sold alongside NordVPN but run independently | NordPass, NordLocker, Incogni, a US identity-protection service |
Two things are worth holding onto as you read the rest of this article. First, being “in the app” doesn’t mean being available everywhere the app runs: platform and build differences show up throughout the core VPN and the embedded-features layer alike.
Second, being sold in the same bundle doesn’t mean being built into the same product: the wider suite is a commercial relationship first, and a technical one only where the evidence actually shows it.
What is included in the core VPN
The core VPN is where NordVPN’s engineering investment is most visible. NordLynx, the company’s WireGuard-based protocol, is the default across NordVPN’s major native apps and forms the backbone of the service. OpenVPN remains available as an alternative, though its exact availability depends on platform and configuration, and IKEv2/IPsec is offered only on selected platforms rather than universally.
Beyond protocol choice, the core VPN includes a kill switch, automatic connection, and DNS protection, along with split tunnelling for excluding chosen apps, sites or routes from the tunnel where the platform supports it. Specialty servers extend the core further: Double VPN, Onion Over VPN, P2P-optimized servers, and obfuscated servers for restrictive network conditions. All of this sits alongside a single allowance of up to 10 simultaneous connected devices.
NordVPN has also kept building at the protocol level. NordWhisper, a newer proprietary protocol, is worth a brief mention here (it gets a full section of its own later), and the recent post-quantum option (also covered in its own section) builds directly on NordLynx. Both point to continued development of the core VPN rather than a static feature set.
None of this means every control behaves identically everywhere. Kill switch defaults, split tunnelling availability, and even which protocols appear as options can vary by platform, a pattern this article returns to in the platform section below. And while NordVPN presents its protocol range as broad, the evidence available doesn’t establish that any one protocol is faster or more secure than the alternatives in a fixed, independently tested comparison, so this article doesn’t make that claim.
Beyond encrypting and routing traffic, NordVPN’s applications include additional features for blocking unsafe domains, trackers, malicious downloads and other threats: which is where the naming becomes more complicated.
What happened to NordVPN Threat Protection?
If you’ve used NordVPN for a while, you may remember a feature called Threat Protection. It’s been renamed, and the rename actually reflects a real split between two different capabilities: a broadly available basic version and a more capable, more restricted advanced version.
Scam and phishing protection
Scam and phishing protection, formerly Threat Protection, works at the DNS level, blocking connections to unsafe or unwanted domains before they load. It is documented across a broad platform set: Windows, macOS, Android, iOS, Linux, Android TV, Fire TV, and the Chrome, Firefox and Edge browser extensions. It generally functions while your traffic is being routed through NordVPN, though current documentation notes a mobile-phone exception that allows it to work without an active VPN connection.
Scam, phishing, and malware protection
Scam, phishing, and malware protection, formerly Threat Protection Pro, operates differently: it works at the application layer, which means it doesn’t require an active VPN connection at all. That extra capability comes with a much narrower footprint. It’s available only on Windows 10 64-bit, Windows 11, and macOS 12 and later, and only on the direct-download build of the Mac app, not the version distributed through the App Store. It isn’t available on Android, iOS, Linux, TV platforms, or any browser extension.
Its documented functions go beyond DNS-level blocking: ad and tracker blocking, malicious-URL blocking, download scanning and quarantine, Windows app-vulnerability scanning, and cookie-banner hiding.
It includes some antivirus-like functions, including download scanning and quarantine, but the evidence available doesn’t establish equivalence to a full standalone antivirus product, and no independent detection-accuracy or efficacy figures were located to support any performance claim. It’s also limited to selected plans, and no single, universal plan boundary applies across the board.
What the strongest Threat Protection version requires
- Windows 10 64-bit or Windows 11, or macOS 12+ on the direct-download build (not the App Store version)
- A plan that includes it: availability varies by plan and region
- No active VPN connection needed to work
Which version do you actually get?
In practice, the basic DNS-based version has much broader platform availability. The advanced application-layer version is limited to Windows and the direct-download macOS app, as well as selected plans. If you’re on Linux, a mobile device, a TV platform, or the App Store version of the Mac app, the advanced version simply isn’t part of your experience, regardless of what plan you’re on.
| Current name | Former name | How it works | Platforms | Works without an active VPN? | Plan requirement |
|---|---|---|---|---|---|
| Scam and phishing protection | Threat Protection | DNS-level blocking | Windows, macOS, Android, iOS, Linux, Android TV, Fire TV, browser extensions | Mobile exception only | Plan availability not universally established |
| Scam, phishing, and malware protection | Threat Protection Pro | Application-layer blocking, scanning and quarantine | Windows 10 64-bit/11; macOS 12+ (direct download only) | Yes | Selected plans only |
Threat Protection isn’t the only NordVPN feature with device-specific limits; the newer post-quantum option comes with its own constraints.
NordVPN’s post-quantum option comes with trade-offs
NordVPN began rolling out post-quantum protection for NordLynx on Linux in the autumn of 2024, then announced a much broader expansion across Windows, macOS, iOS, Android, Android TV and tvOS in May 2025. It’s opt-in, and it only activates when you’re using NordLynx.
That NordLynx dependency is the key thing to understand: the feature adds forward-looking protection but cannot be combined with several specialist capabilities. It’s incompatible with OpenVPN and, by extension, with IKEv2/IPsec. It can’t be used alongside Dedicated IP, Meshnet, or obfuscated servers. Whether it works with NordWhisper hasn’t been established either way.
Which features cannot be combined with post-quantum mode
- OpenVPN
- IKEv2/IPsec
- Dedicated IP
- Meshnet
- Obfuscated servers
- NordWhisper: compatibility not established
| Feature or protocol | Compatibility | Practical implication |
|---|---|---|
| NordLynx | Required | Post-quantum only works through NordLynx |
| OpenVPN | Incompatible | Switching protocols disables the feature |
| IKEv2/IPsec | Incompatible | Same NordLynx dependency applies |
| Dedicated IP | Incompatible | Can’t use both at once |
| Meshnet | Incompatible | Can’t use both at once |
| Obfuscated servers | Incompatible | Can’t use both at once |
| NordWhisper | Not established | No official confirmation either way |
What this trade-off actually means for a given reader is less clear-cut. Several interpretations remain plausible from the available evidence: it may reflect a reasonable technical limitation given how the protocols are architected, a genuine trade-off a privacy-conscious user needs to weigh consciously, or simply a sign that the feature set is expanding faster than its parts are being made to work together.
No independent audit of the cryptographic implementation was located, and how the feature behaves if post-quantum negotiation fails hasn’t been documented either. None of that undermines the fact that the rollout happened and follows a clear timeline: it just means claims about the strength or completeness of the protection itself should stop at what NordVPN has stated.
NordVPN’s other protocol-level addition, NordWhisper, raises a similar question: what the company states versus what has been independently confirmed.
What is NordWhisper, and who is it for?
NordWhisper is a company-described proprietary protocol intended for restrictive network environments: the kind of connection you might get on an office network, a university campus, an airport, a hotel, a cafe or a conference venue. It’s opt-in, and NordLynx remains the default protocol even where NordWhisper is available.
What NordVPN says it does. According to NordVPN, NordWhisper is built specifically to work on networks that block or interfere with typical VPN traffic.
What the public evidence confirms. NordWhisper is documented on Windows, macOS, Linux (both the GUI and command line), Android, iOS and Android TV. It’s opt-in rather than default. It’s stated to be incompatible with Dedicated IP, Meshnet and Onion Over VPN, and a current regional version of NordVPN’s documentation adds obfuscated servers to that incompatibility list as well.
What remains unverified. No independent technical analysis of how NordWhisper actually works, and no public report testing its effectiveness on genuinely restrictive networks, was located. That doesn’t mean it fails to do what NordVPN describes: it means the claim currently rests on the company’s own account rather than outside verification.
NordVPN’s other specialist addition, Meshnet, raises a different question: not where it works, but who actually needs it.
Is Meshnet useful for ordinary users?
Meshnet has been available without a paid VPN subscription since March 2023. The available record establishes that Meshnet moved from subscription-gated access to availability without a paid VPN subscription. It does not establish that Meshnet was ever sold as a separate subscription.
It lets you link your own devices together (up to 10) and connect to up to 50 external devices, enabling remote access, file sharing, and routing your traffic through another Meshnet device. It’s documented on Windows, macOS, Linux, Android and iOS, and requires a Nord Account to use.
For someone who wants to remotely access their home computer, share files directly between trusted devices, or route their connection through a device in another location, Meshnet addresses use cases that a typical VPN subscription does not normally cover.
For a basic user who just wants their everyday browsing protected, it’s likely more capability than they’ll ever touch. Not because it doesn’t work, but because it solves a different, more specialist problem. Its natural home is inside the NordVPN app itself, alongside the other embedded features, rather than among the separately bundled products covered later in this article.
No public data on how widely Meshnet is actually used was located, and no feature-specific independent security testing was found either. Those gaps don’t tell us the feature is under-used or insecure: they simply mean neither claim can be made with confidence.
Not every NordVPN capability is free or built in. Dedicated IP is the one feature that costs extra.
What costs extra: NordVPN Dedicated IP
Dedicated IP is NordVPN’s one paid add-on, purchasable at checkout, through your Nord Account, or via the Windows or macOS app. It gives you a personal, unshared IP address rather than one drawn from a shared server pool. It is primarily relevant to workflows that require a stable address, such as maintaining IP allowlists or repeatedly connecting from the same assigned IP.
How many devices can use it simultaneously depends entirely on your protocol: up to 10 devices on OpenVPN, but only a single connection on NordLynx. IKEv2 doesn’t support it at all, and it’s incompatible with the post-quantum option covered earlier.
Two points in NordVPN’s own documentation don’t agree with each other, and neither is resolved here.
One official page lists setup instructions for using Dedicated IP through a browser extension; another states plainly that Dedicated IP isn’t available through browser extensions.
Separately, one NordWhisper support page states that Dedicated IP is incompatible with NordWhisper, while a Dedicated IP setup page references NordWhisper in the context of a specific App Store build. NordVPN’s own documentation conflicts on this point in both cases, and that conflict itself is worth knowing about if you’re planning to rely on a specific combination of features.
Exact current pricing and the number of available locations weren’t established from a stable source and aren’t published here.
Dedicated IP’s contradictions are one example of a broader pattern: NordVPN’s feature availability depends heavily on which device you’re using.
Which NordVPN features are available on your device?
Every feature discussed so far comes with a caveat about platform, and it’s worth seeing that pattern laid out in one place rather than scattered across the article. A status of “unresolved” below means NordVPN’s documentation doesn’t confirm one way or the other for that platform — it is not the same as “unavailable,” and one platform’s status should never be assumed to apply to a related one (Android’s status doesn’t tell you anything about Android TV, for instance).
| Feature | Windows | macOS (direct download) | macOS (App Store) | Linux | Android / iOS | TV platforms | Browser / router | Key limitation |
|---|---|---|---|---|---|---|---|---|
| Advanced protection | Available | Available | Unavailable | Unavailable | Unavailable | Unavailable | Browser extension: unavailable; router: unavailable | Windows and direct-download macOS only, plan-limited |
| Basic protection | Available | Available | Available | Available | Available (mobile exception on VPN requirement) | Android TV/Fire TV: available; others unresolved | Browser extensions: available; routers: unresolved | Broadest coverage of any protection feature |
| NordWhisper | Available | Available | Available | Available | Available | Android TV: available; others unresolved | Browser extension: not applicable; router: unresolved | Opt-in; incompatibilities with Dedicated IP, Meshnet |
| Post-quantum option | Available | Available | Available | Available | Available | Android TV: available; tvOS: available; Fire TV: unresolved | Browser extension: not applicable; router: unresolved | NordLynx-only |
| Meshnet | Available | Available | Available | Available | Available | Unresolved | Browser extension: not applicable; router: unresolved | Requires Nord Account |
| Dedicated IP | Available | Available | Available with protocol caveat | Available | Available | Android TV/Fire TV: setup documented; tvOS: unavailable | Browser extension: documentation conflicts; router: unresolved | NordLynx limited to one device |
| Split tunnelling | Available | Unresolved by function/build | Unresolved | Unresolved | Android: available; iOS: unresolved | Unresolved | Unresolved | Confirmed only on Windows and Android |
The clearest pattern is not one missing feature but where the gaps cluster. TV platforms, browser extensions and routers carry the largest concentration of unresolved or unavailable capabilities. That makes NordVPN’s feature set less predictable outside its main desktop and mobile applications.
Device and plan differences aren’t the only source of inconsistency. Several NordVPN-branded products exist entirely outside the NordVPN app.
Is NordVPN becoming a full security suite?
Beyond the VPN app itself, NordVPN sells access to several separate products under its wider subscription bundles.
| Product | What it is | Form | Commercial relationship | Integration boundary |
|---|---|---|---|---|
| NordPass | Password manager | Separate app | Included in selected plans | Technical workflow with the VPN app not established |
| NordLocker | Encrypted cloud storage | Separate app | Included in selected plans; storage varies by offer | Technical integration with the VPN client not established |
| Incogni | Data-removal service | Separate service | Included in selected regional bundles | Market coverage and permanence unresolved |
| US identity service | Identity protection, marketed under mixed NordProtect and Coveron naming | Separate service | Included in the highest US bundle tier | Provider, policy and data relationships unresolved |
Each of these runs as its own application or service, downloaded and used separately from the NordVPN client. What connects them commercially (a shared Nord Account, inclusion in the same subscription tier) is real and documented. Deeper technical integration was not established in the public evidence, and that applies equally to NordPass, NordLocker, Incogni and the identity service.
What “commercially bundled” does and does not mean
- Means: a shared account or billing relationship where documented, and inclusion in selected subscription plans.
- Does not mean: shared technical architecture, unified data handling, or one connected in-app experience.
The identity-protection component, currently marketed under a mix of NordProtect and Coveron naming, is worth noting mainly as an example of how much this bundle varies by region: it’s US-specific, its provider and policy relationship aren’t fully clear from public documentation, and specific coverage figures aren’t published here for that reason.
That raises the article’s central question: does everything NordVPN sells work as one product, or several products sold together?
Does the whole product work as one coherent system?
The honest answer sits between the two extremes.
Inside selected NordVPN applications, the VPN controls, Meshnet, the post-quantum option and the scam/phishing protection features are surfaced within the same product experience. Depending on the platform, app build and plan, several of these capabilities are available through the same NordVPN application.
Outside the app, NordPass, NordLocker, Incogni and the identity service remain commercially linked but operationally separate products or services, each with its own download, its own interface, and its own account relationship layered on top of the shared Nord Account.
Which parts feel like NordVPN, and which parts are simply sold alongside it?
The core application, even with its platform gaps, is where NordVPN’s product identity actually lives. The wider bundle is closer to a subscription containing several separately operated products. They are visibly connected through packaging, billing and account access, while deeper shared design, engineering and data architecture were not established in the public evidence.
Sharing a Nord Account or a subscription bill doesn’t, by itself, prove deep integration, and the evidence available doesn’t establish that deeper integration exists across the wider suite. The result is neither a fully unified platform nor a disconnected collection of products.
The NordVPN app provides a recognizable core experience, while the wider subscription connects several operationally separate products through account access, billing and packaging.
That split between the app and the wider bundle also shows up in where NordVPN appears to be putting its development effort.
What NordVPN’s recent product development reveals
The pattern of recent activity is consistent enough to describe with some confidence.
NordVPN has continued investing in its protocol layer: ongoing NordLynx maintenance, the NordWhisper launch, and the staged post-quantum rollout. Linux has also received visible product investment, including the GUI release in May 2025 and its open-sourcing under GPLv3 in October 2025. It has expanded endpoint and browser-level protection, moved Meshnet to free access, and continued building out its commercial bundle of password, storage, identity and data-removal products, with some regional variation in what that bundle includes.
Separately, NordLayer continues to exist and expand as a business-focused product outside the consumer lineup entirely.
Put simply: NordVPN is deepening the core VPN while expanding commercially into adjacent security and privacy categories. What the evidence doesn’t support is any claim about which of these tracks is getting the most investment, which is proving most successful, or what’s coming next. None of that was established in the material reviewed, and this article doesn’t speculate on NordVPN’s future roadmap.
Which of these developments matter depends heavily on what kind of NordVPN user you are.
Who NordVPN’s feature set suits
Basic VPN user. Core VPN controls, auto-connect, DNS protection and the broadly available basic scam and phishing protection align closely with the routine needs of a basic VPN user. The main limitation for this segment is likely to be understanding which renamed or plan-dependent extras apply to their device.
Privacy-focused user. Protocol choice, the specialty server range, and NordVPN’s history of repeated no-logs assurance engagements are all relevant here. It’s worth being clear, though, that assurance history speaks to logging-related claims specifically, not to the quality of individual features, so this segment still runs into the same platform and integration gaps as everyone else when scrutinizing specific capabilities.
Power user. NordWhisper, split tunnelling, Meshnet, Dedicated IP and protocol-level control give this segment the deepest control surface NordVPN offers. It’s also the segment most exposed to everything unresolved in this article: the post-quantum incompatibilities, the two Dedicated IP documentation conflicts, and the platform gaps in split tunnelling and Meshnet all matter more to someone actively trying to combine these features.
Family or household. The ten-device allowance and support across major desktop, mobile and TV platforms make NordVPN applicable to multi-device households. No dedicated family-management architecture was established, and advanced protection is not available across mobile platforms.
Traveller or restrictive-network user. NordWhisper and obfuscated servers are the most directly relevant capabilities for travellers and users on restrictive networks. NordWhisper is documented across desktop and mobile platforms and on Android TV, but independent evidence of its real-world effectiveness was not located.
Security-suite buyer. The advanced desktop protection feature, combined with the bundled password, storage, identity and data-removal products, is the appeal here. This is also the segment whose value proposition depends most on the wider suite working as a connected whole, and, as covered above, that deeper integration isn’t established in the evidence available.
Business user. NordLayer exists as a separate Nord Security product for business customers and sits entirely outside the NordVPN consumer plans covered in this article.
Several of these strengths, especially for privacy-focused and power users, rest on evidence that remains incomplete.
What remains unverified
A few gaps run through several of the features covered above and are worth stating plainly in one place.
Public report-level evidence was not located establishing feature-specific independent testing of Meshnet, NordWhisper or the advanced protection feature.
- NordWhisper’s real-world effectiveness on restrictive networks hasn’t been independently confirmed.
- Meshnet’s actual adoption isn’t publicly known.
- Deeper technical integration across the wider product suite wasn’t established either way.
- Regional plan structures shift enough that a single, stable map of what’s included where wasn’t achievable at the time of writing.
- And both Dedicated IP documentation conflicts (on browser-extension support and on NordWhisper compatibility) remain open in NordVPN’s own material.
Separately, NordVPN has disclosed six no-logs assurance engagements. These relate to logging-related system claims specifically, not to feature performance, app security, or platform consistency, and this article doesn’t use them to support any claim about product quality.
The STACK View
NordVPN is a better VPN, a broader subscription and (at the outer edges) a busier product.
The core VPN has gained meaningful capability. NordWhisper, the post-quantum option, continued Linux development, Meshnet and the existing protocol and specialty-server controls show a product that is still being actively extended. Several of the features inside the NordVPN app also solve real problems rather than merely adding items to a marketing list.
But the benefit becomes less consistent as you move away from the core. The strongest scam, phishing and malware protection is limited to Windows and the direct-download Mac app. Some advanced features cannot be used together. Dedicated IP documentation conflicts in places. Plan names and bundled services change by region. NordPass, NordLocker, Incogni and the US identity service expand the subscription, but they remain separately operated products rather than one unified security experience.
That makes NordVPN genuinely better for users who benefit from its core VPN and selected in-app features. It makes the subscription broader for people who also want password management, storage, data removal or identity services. It becomes busier when those additions create more naming, platform and plan complexity than integrated value.
For a basic VPN user, the core controls and broadly available protection features are the part that matters most. Power users get more specialist capability, but they also need to check protocol conflicts and exact platform support. Security-suite buyers should treat the wider bundle as access to several related products, not as proof that everything works through one technically unified system.
NordVPN has earned credit for continuing to develop the VPN itself and for adding capabilities tied to identifiable practical use cases. It has not yet earned the description of a fully integrated security platform. The next test is not how many more features it can add. It is whether the features already there become easier to understand, combine and access consistently across devices, builds, plans and regions.