Every online form that demands a real name, home address and email has quietly become a liability. NordPass, the password management arm of Nord Security, has introduced a feature called Identity Masking that lets Premium, Family and Business subscribers generate plausible but entirely fictitious personal details to satisfy sign-up requirements on websites they don't trust. The goal is simple: stop handing real data to companies that have no genuine need for it.
How the masking actually works
The feature generates coherent synthetic identities - a name, a home address in one of twelve countries including the UK, Australia, Brazil, Canada and Switzerland, and a masked email address built on NordPass's existing Email Masking technology. Users choose a gender for the generated name and a location for the address, and the system assembles a profile that looks internally consistent enough to pass basic validation checks used by newsletters, loyalty schemes and app registrations. Crucially, the details are fabricated with enough care to avoid resembling a real person, which sidesteps the risk of accidentally impersonating someone else. The tool is accessible through the NordPass browser extension and its desktop and mobile apps, meaning the synthetic identity can be deployed at the exact moment a form demands it, without manual record-keeping.
Why forced data collection has become a liability
Many online services ask for far more personal information than they need to function. A streaming trial, a discount newsletter or a one-time software test rarely requires a verified legal name and street address, yet these fields are frequently mandatory. Once that information is submitted, control over it effectively disappears. It can be sold to data brokers, bundled into advertising profiles, or exposed in a breach - and the individual who supplied it bears the consequences, not the company that mishandled it. This dynamic has fuelled a broader shift toward data minimization, a principle embedded in regulations such as the EU's GDPR, which encourages organizations to collect only what is strictly necessary. Identity Masking operationalizes that principle from the user's side: rather than waiting for companies to collect less, individuals supply less truth to begin with.
A business security layer, not just a consumer convenience
For organisations, the feature addresses a quieter but persistent problem: employees routinely need to test products, register for trial services or access third-party resources, and doing so with corporate email addresses or real names can expose internal structures to outside tracking. Identity Masking allows teams to interact with unverified platforms while keeping professional identities, and by extension organisational footprints, out of external databases. This reduces the surface available for social engineering attacks, which often begin with publicly available employee details.
Expanded breach monitoring
Alongside the new masking tool, NordPass has broadened its Data Breach Scanner, previously focused on credentials, to monitor more sensitive identifiers such as Social Security numbers, passport numbers and national ID numbers for Premium and Family users. The expansion reflects a recognition that identity theft increasingly hinges not on passwords alone but on government-issued identifiers, which are far harder to reset once compromised. Together, the two updates represent a shift in strategy: rather than only reacting to breaches after they occur, the tools aim to limit how much real personal data is exposed to risk in the first place.
