How to uninstall NordVPN on Mac

Quit NordVPN before removing it. NordVPN ships a direct download from nordvpn.com and a separate Mac App Store app; this guide covers the direct download, which the Homebrew cask nordvpn also installs. On first launch the direct download installs a root-owned privileged helper that stays behind when the app goes and that Mole never lists, so plan for that step.

Direct download and App Store are separate installs

NordVPN's instructions for moving from the App Store app to the direct download have you move the App Store app to the Trash, restart the Mac, then install the website version. Treat them as two different apps. NordVPN: switch from the App Store app to the sideloaded version

Quit and remove the app

Quit NordVPN from its menu bar icon, then move NordVPN.app from Applications to the Trash. NordVPN's own uninstall article points to Apple's general instructions rather than a NordVPN uninstaller. NordVPN: How to uninstall NordVPN software

The package registers a login item named NordVPN; if it is still listed afterwards, turn it off in System Settings › General › Login Items & Extensions.

Where NordVPN keeps its data

The table paths come from Homebrew's zap and uninstall lists for NordVPN; the helper and a Firebase preferences file hidden by the "nordvpn" name were recorded in the test.

To remove the helper tools by hand you need an administrator account: delete the three files above in Finder after NordVPN is gone, or, if NordVPN came from Homebrew, let brew uninstall --cask nordvpn do it.

Check the result

pgrep -ilf nordvpn
launchctl list | grep -i nordvpn
ls -l /Library/PrivilegedHelperTools/ | grep -i -e nordvpn -e ovpn
pkgutil --pkgs | grep -i nordvpn

No output from pgrep means no NordVPN process is running. A com.nordvpn line from launchctl list means a NordVPN job is still loaded in your session. Lines from the ls command are helper files still on disk; no output means they are gone. com.nordvpn.macos from pkgutil --pkgs means the installer receipt is still registered.

If you installed it with Homebrew

Mole skips --zap when its list reaches unchecked or shared data, or cannot be fully checked, and still cleans the leftovers you selected.

The nordvpn cask's plain uninstall step unloads com.nordvpn.macos.helper and com.nordvpn.NordVPN.Helper, quits the app and its launcher, removes the login item, forgets the com.nordvpn.macos receipt, and deletes the three helper tools. Its zap list is the ~/Library paths in the table; brew uninstall --cask --zap nordvpn moves them all to the Trash, whatever you ticked in Mole. When Mole removes a Homebrew install, it checks each zap path that exists on disk: Logs/NordVPN and the com.nordvpn.NordVPN.* containers carry the protected name, so if either exists Mole leaves --zap out; otherwise the zap list only reaches rows named after the bundle id, which Mole selects anyway. Homebrew nordvpn cask

brew uninstall --cask nordvpn

What Mole lists

• Leaves named after the bundle id com.nordvpn.macos under ~/Library are listed and selected by default.
• Any other path with "nordvpn" in its name, the containers under Containers/com.nordvpn.NordVPN.* and the helper tools in /Library/PrivilegedHelperTools are never listed. Mole treats NordVPN files as VPN state, whichever way NordVPN was installed.

What this test covered

On September 19, 2026, NordVPN 10.11.0 from the official download was placed in Applications, opened, and uninstalled with a Preview build of Mole 1.15 (build 277), with no Homebrew receipt. On first launch it installed /Library/PrivilegedHelperTools/com.nordvpn.macos.helper, and Mole's startup list showed that helper as a protected vendor or security service. The app went to the Trash; a Firebase preferences file stayed hidden because of the "nordvpn" name, and the helper was left in place. The App Store build, signing in and connecting were not tested.