Every online sign-up form that demands a real name, address, or phone number creates another data trail that users can never fully erase. NordPass, the password manager built by the team behind NordVPN, announced on October 22 the launch of two new features - Identity Masking and expanded ID Monitoring - designed to limit how much personal information people are forced to hand over to websites and apps they do not fully trust.
Why forced disclosure has become a privacy liability
Much of the modern internet runs on mandatory registration. Newsletters, loyalty programs, trial subscriptions, and even some AI tools routinely require a full name and home address before granting access, regardless of whether that information is actually needed for the service to function. Once submitted, that data enters a company's database, where it can be mishandled, sold to brokers, or exposed in a breach - consequences the user bears even though the company controls the storage and security decisions. Karolis Arbaciauskas, head of product at NordPass and parent company Nord Security, describes this as "a privacy problem" built into how most sign-up systems are designed, one that leaves individuals with little leverage over data they are compelled to share.
How Identity Masking works
Identity Masking, available to Premium, Family, and Business subscribers, lets users generate synthetic but coherent personal details - a name, a home address, and an email address powered by NordPass's existing Email Masking tool - to use on low-trust or unverified platforms. The generated information is realistic enough to satisfy standard form validation, but it is deliberately disconnected from the user's actual identity, which reduces the risk of cross-site tracking, profiling, and impersonation. Users can choose a male or female name and select an address from twelve supported locations, including the UK, Australia, Brazil, Canada, and Switzerland. The feature is accessible through the NordPass browser extension and its desktop and mobile apps, making it usable at the exact moment a form demands information the service does not strictly need.
This approach sits within a broader category of data minimization tools that includes temporary email aliases and virtual card numbers - mechanisms that let people interact with online services without exposing a stable, traceable identity. The logic mirrors how a VPN obscures an IP address: rather than preventing data collection outright, it ensures that whatever is collected cannot be easily tied back to the real person behind it.
Monitoring now extends to government-issued IDs
Alongside Identity Masking, NordPass has upgraded its Data Breach Scanner, a feature that previously focused on alerting users when their login credentials appeared in known leaks. Premium and Family users can now also monitor sensitive identification numbers, including Social Security numbers, passport numbers, and national ID cards, for exposure in breach databases. This shift reflects a wider trend in identity protection: credentials can be changed after a leak, but government-issued identification numbers generally cannot, making early detection far more consequential when it comes to preventing fraud or identity theft.
A narrower but meaningful layer of protection
Neither feature eliminates the underlying problem of excessive data collection by websites and apps, and synthetic identities are not a substitute for verified accounts where genuine verification is legally or practically required, such as banking or healthcare services. Their value lies in the lower-stakes majority of sign-ups - contests, trial accounts, discount codes - where real identity information was never necessary in the first place. As data protection regulations tighten globally and breach disclosures grow more frequent, tools that let individuals control the accuracy of what they share, rather than relying solely on companies to protect it after the fact, are likely to become a more routine part of everyday online behavior.