How We Scored the Best Business Password Managers (Methodology)
To find the best password manager for business, we scored each tool from 0 to 10 on six weighted criteria, multiplied each score by its weight and summed the results into a total out of 100. Scores rest on official vendor documentation, trust centres and pricing pages, checked on 8 November 2026. This is a documentation and pricing comparison, not a hands-on lab test, and every score follows the bands below.
| # |
Criterion |
Weight |
10 means |
5 means |
0 means |
| 1 |
Security architecture and track record |
25 |
Zero-knowledge, recent independent audits, public bug bounty, no vault-data breach |
Audits dated or limited |
Customer vault data stolen and/or regulator fine |
| 2 |
Admin and identity integration |
20 |
SSO, SCIM or directory sync, policies, audit logs and SIEM on a plan below the top tier |
See admin bands below |
No central admin |
| 3 |
Compliance and data sovereignty |
20 |
SOC 2 Type II, ISO 27001 and EU hosting verified, plus non-US jurisdiction and self-hosting |
Sovereignty without a verified attestation |
Nothing verifiable |
| 4 |
Price and value |
15 |
Cheapest tier with workforce SSO or SCIM for 25 seats at €3 or less per user |
About €6 per user |
€10 or more per user (scored 4) |
| 5 |
Usability and adoption |
10 |
Native apps everywhere, strong autofill, passkeys, free family plan for staff |
Fewer platforms or a technical interface |
Hard to roll out |
| 6 |
Deployment flexibility and openness |
10 |
Open source, self-hosting and an official CLI or API |
Proprietary, with an official CLI or API only |
Closed SaaS with no CLI, API or self-hosting |
Admin bands. The "top tier" is the vendor's most complete plan in that product line, including a contact-sales Enterprise plan; suite bundles (such as Proton Workspace) and volume-pricing variants of an existing plan do not count as a separate tier. 10: workforce SSO, SCIM or directory sync, audit logs and SIEM integration all documented on a plan below the top tier. 9: SSO and SCIM or directory sync both below the top tier, but SIEM export not documented on that plan. 8: one of SSO or SCIM below the top tier, the other only on the top tier. 7: SSO and SCIM or directory sync both only on the top tier. 6: SSO only on the top tier, with no directory provisioning verified on that plan.
Price bands. 10 (≤ €3), 9 (≤ €4), 8 (≤ €5), 7 (≤ €6), 6 (≤ €9) and 4 (≥ €10), with USD and EUR treated as equivalent. We price the cheapest tier with workforce SSO (Entra ID, Okta or generic SAML/OIDC) or SCIM, at 25 seats, because that is what a company actually buys. SSO limited to Google Workspace does not count, so NordPass is priced on Enterprise, not Teams; an AD or LDAP directory connector without SCIM or workforce SSO does not count either.
Compliance bands. 9: SOC 2 Type II, ISO 27001 and EU or Swiss hosting all documented on the vendor's own pages. 8: two of the three. 5: sovereignty (EU vendor or self-hosting) without a verified attestation. 3: a GDPR statement only. No tool reached 10.
Flexibility bands. 10: open source, self-hosting, and an official CLI or API. 6: open source clients and an official CLI or API, but no self-hosting. 5: proprietary SaaS with an official CLI or general-purpose API. 4: self-hosting offered, but no official CLI or general-purpose API. 0: closed SaaS with none of these. SCIM provisioning and SIEM connectors on their own are integrations, not a general API, so they do not lift a tool out of the bottom band.
"Plan gating is where password manager budgets go wrong," says Alfons Marques, founder of Technova Partners. "The headline price rarely includes SSO or SCIM, and those two features are what an auditor will ask about."
The 8 Best Password Managers for Business in 2026, Compared
Bitwarden leads our 2026 scorecard with 87/100, ahead of 1Password (84.5), Passbolt (82) and Proton Pass Business (80.5). Keeper (78), Dashlane (76), Psono (75.5) and NordPass (74.5) complete the top eight; of the eleven tools we scored, these eight made the cut.
| Tool |
HQ |
Cheapest tier with SSO/SCIM |
Security (25) |
Admin (20) |
Compliance (20) |
Price (15) |
Usability (10) |
Flexibility (10) |
Total /100 |
| Bitwarden |
USA |
Teams $4 (SCIM), Enterprise $6 (SSO) |
9 |
8 |
9 |
9 |
7 |
10 |
87.0 |
| 1Password |
Canada |
Business $8.99 |
9 |
10 |
9 |
6 |
10 |
5 |
84.5 |
| Passbolt |
Luxembourg |
Pro €4.50 |
8 |
9 |
8 |
8 |
6 |
10 |
82.0 |
| Proton Pass Business |
Switzerland |
Professional $4.99 |
9 |
7 |
9 |
8 |
8 |
6 |
80.5 |
| Keeper |
USA |
Enterprise $6.00 |
9 |
7 |
9 |
7 |
8 |
5 |
78.0 |
| Dashlane |
USA / France |
Omnix €8 |
8 |
9 |
8 |
6 |
8 |
5 |
76.0 |
| Psono |
Germany |
Enterprise €2.50 at 25 seats (free up to 10 users) |
7 |
9 |
5 |
10 |
5 |
10 |
75.5 |
| NordPass |
Lithuania |
Enterprise €5.39 (2-year plan) |
8 |
7 |
8 |
7 |
9 |
5 |
74.5 |
Criterion scores are 0 to 10; the weight of each criterion is in brackets, and the total is the weighted sum (score × weight ÷ 10). Security = security architecture and track record; Admin = admin and identity integration; Compliance = compliance and data sovereignty; Price = price and value; Usability = usability and adoption; Flexibility = deployment flexibility and openness. Per-user, per-month prices billed annually unless stated, as of November 2026, excl. VAT; currency varies by region. Check the linked vendor page before buying.
1. Bitwarden: best overall business password manager (87/100)
Bitwarden is an open source password manager that wins on the balance of security evidence, provisioning and price. It publishes annual source code audits and penetration tests, and states that it is "SOC2 Type II and SOC3 certified", ISO 27001 certified and HIPAA compliant, with GDPR coverage through EU standard contractual clauses (Bitwarden compliance). Data runs on Microsoft Azure in the US or the EU.
SCIM and Directory Connector are available on Teams as well as Enterprise (Bitwarden SCIM), so automatic offboarding does not require the top plan. SSO and self-hosting do, which is why Admin scores 8.
| Plan |
Price (Nov 2026) |
Key features |
| Teams |
$4 per user/month, billed annually |
Shared collections, SCIM, Directory Connector |
| Enterprise |
$6 per user/month |
SSO, self-hosting, free Families plan for all users |
| Secrets Manager add-on |
$6 (Teams) / $12 (Enterprise) per user/month |
Machine secrets for DevOps |
Source: Bitwarden business pricing. A free trial is available for business plans.
Ideal for: most SMEs and mid-market firms, and any team that wants open source plus the option to self-host later. Caveat: the interface is functional rather than polished, and SSO costs the Enterprise price.
2. 1Password: best user experience for scale-ups (84.5/100)
1Password is the commercial password manager with the strongest adoption story. Its dual-key model combines the account password with a 128-bit Secret Key, so a stolen server copy is not enough to attack a vault. The company states that it is "SOC 2 type 2 certified" (1Password security), holds ISO 27001:2022, 27017, 27018 and 27701 certifications, and runs what it calls "the industry's largest bug bounty" on HackerOne.
The Business plan, which sits below the contact-sales Enterprise tier, lists "Integrate with Okta, Entra ID, OneLogin, Duo, and more", automated user and group provisioning from your identity provider, and "Stream events to SIEM tools like Splunk, Elastic, Sumo Logic, and Panther" (1Password business pricing). SSO, provisioning, audit events and SIEM export below the top tier earn Admin 10. For European buyers, 1Password.eu keeps data hosted in the European Union with billing in euros (1Password regions).
| Plan |
Price (Nov 2026) |
Key features |
| Teams Starter Pack |
$2.49 per user/month, billed yearly |
10 users minimum, up to 20; free Families plan per user |
| Business |
$8.99 per user/month, billed yearly |
SSO, automated provisioning, SIEM event streaming, Watchtower, free Families plan per user |
| Enterprise |
Contact sales |
Personalised training, dedicated Customer Success Manager |
Source: 1Password business pricing. 14-day trial, no credit card.
Ideal for: scale-ups and knowledge-worker teams where adoption decides success. Caveat: the most expensive mainstream SSO tier, and no self-hosting. An official CLI and APIs exist, but the code is proprietary, so Flexibility scores 5.
3. Passbolt: best for EU sovereignty and DevOps teams (82/100)
Passbolt is an open source (AGPLv3) password manager for teams, built in Luxembourg on OpenPGP. It is the strongest option for organisations that want credentials never to leave EU-controlled infrastructure: you can self-host it, use Passbolt Cloud in Belgium and Germany on Google Cloud, or choose Cloud Sovereign, hosted in a Luxembourg sovereign private data centre (Passbolt Cloud pricing).
Passbolt holds a SOC 2 Type II report and a Cure53 audit. It describes itself as ISO 27001 aligned; it is not ISO 27001 certified, which is why it scores 8 rather than 9 on compliance. The Pro plan, below the custom Enterprise tier, adds LDAP sync, SSO and audit logs; we found no documented SIEM export on Pro, so Admin scores 9.
| Plan |
Price (Nov 2026) |
Key features |
| Community (self-hosted) |
Free, unlimited users |
Core sharing |
| Pro (self-hosted) |
€4.50 per user/month, billed annually, 10 users minimum |
LDAP, SSO (Microsoft, Google, OpenID), account recovery, audit logs |
| Cloud Business |
€4.50 annual or €5 monthly, 10 users minimum |
Hosted in Belgium and Germany, 7-day trial |
| Cloud Sovereign |
€7 per user/month, annual |
Luxembourg sovereign data centre |
Source: Passbolt pricing. Enterprise is custom, with a 4-hour SLA.
Ideal for: public bodies, DevOps and engineering teams, NIS2-scoped entities with strict sovereignty demands. Caveat: the OpenPGP-based UX is more technical for non-IT staff.
4. Proton Pass Business: best for privacy and Swiss jurisdiction (80.5/100)
Proton Pass Business comes from Proton AG in Geneva, the company behind Proton Mail, and it pairs Swiss jurisdiction with one of the deepest admin feature sets per dollar in this list. The clients are open source and audited by Cure53. Proton obtained ISO 27001 certification in May 2024 and a SOC 2 Type II attestation by Schellman in July 2025 (Proton SOC 2); the SOC 2 report covers the company as a whole.
The Professional plan includes "SSO and SCIM", "detailed activity logs", "enterprise policies" and "SIEM integration", plus a CLI and an SSH agent. Proton's pricing page shows no Pass tier above Professional (Workspace Standard is a suite bundle, and larger buyers are sent to a generic contact-sales form), so under our bands SSO and SCIM sit on the top Pass tier and Admin scores 7. The low price of that top tier is rewarded in the Price score instead (8 at $4.99). Open source clients plus a CLI, with no self-hosting, put Flexibility at 6.
| Plan |
Price (Nov 2026) |
Key features |
| Pass Essentials |
$1.99 per user/month, annual |
Shared vaults, "passkey support on all devices", no SSO or SCIM |
| Pass Professional |
$4.99 per user/month, annual |
SSO, SCIM, activity logs, policies, SIEM, CLI |
| Workspace Standard |
$12.99 per user/month |
Mail, Drive, VPN and Pass bundle |
Source: Proton Pass for Business. The page states 3-user minimums.
Ideal for: European companies and law, health or advisory firms that want non-US jurisdiction without self-hosting, on a tight budget. Caveat: the admin console is younger than those of the market leaders, and there is no self-hosting.
5. Keeper: best for regulated industries and government (78/100)
Keeper Security is the most certified vendor in this list. The company states that it is "SOC 2 Certified, ISO27001 Certified, FedRAMP High Authorized and StateRAMP Authorized" (Keeper security), holds ISO 27017 and 27018, and says it has more than 10 years of SOC 2 compliance. It hosts in several AWS regions including the EU, plus GovCloud for government.
Business adds shared team folders, delegated administration and a free family plan per user. SSO/SAML, SCIM and AD/LDAP arrive only on Enterprise, Keeper's top published tier, which is why Admin scores 7 despite the depth of its RBAC and APIs. Those developer APIs earn Flexibility 5; the password manager is proprietary and cannot be self-hosted.
| Plan |
Price (Nov 2026) |
Key features |
| Business Starter |
$2.00 per user/month, billed annually |
5 to 10 users |
| Business |
$4.00 per user/month |
Shared team folders, delegated admin, free family plan |
| Enterprise |
$6.00 per user/month |
SCIM, AD/LDAP, SSO/SAML, RBAC, APIs |
Source: Keeper business pricing. Free trial on all plans; secrets manager, remote access and advanced reporting are paid add-ons.
Ideal for: financial services, healthcare, public sector suppliers. Caveat: SSO and SCIM only on Enterprise, and no self-hosting for the password manager.
6. Dashlane: best for credential-risk detection (76/100)
Dashlane, headquartered in New York with roots in Paris, has repositioned its business offer around its Omnix platform. SSO and SCIM are included in the password management plan rather than kept for the custom Enterprise tier (Admin 9), and a separate Credential Protection module adds risk detection and phishing alerts. Dashlane's pricing page lists SIEM and SOAR integration under Credential Protection, not under the password management plan, so Admin stays at 9. Dashlane publishes an annual SOC 2 Type II report (period November 2024 to October 2025) and holds ISO/IEC 27001:2022, per its Trust Center. We did not find an EU hosting region documented on its public pages, hence 8 on compliance. Dashlane also publishes an official CLI whose business commands let admins manage members, pull audit logs and reports, and run AD sync, using credentials generated in the Admin Console's Developer Access page (Dashlane CLI for business). The product is proprietary and cannot be self-hosted, so Flexibility scores 5.
| Plan |
Price (Nov 2026) |
Key features |
| Omnix Password Management |
€8 + VAT per user/month, billed annually |
SSO, SCIM, 14-day free trial |
| Credential Protection |
€4 + VAT per user/month, sales only |
Credential risk detection, phishing protection |
| Enterprise |
Custom |
Larger deployments |
Source: Dashlane pricing. The older Standard plan for 10 seats no longer appears on the official page, despite still being quoted on third-party sites.
Ideal for: security teams that want password management and credential-risk alerts in one product. Caveat: one of the higher per-user prices, and no self-hosting.
7. Psono: best free self-hosted password manager for small teams (75.5/100)
Psono is an open source, self-hosted password manager from esaqa GmbH in Vorra, Germany. Its business edition is "Free for up to 10 users with complete feature set", including LDAP, SAML and OIDC single sign-on, audit logging, policies and an SSH, RDP and VNC gateway (Psono pricing). Above 10 users, Enterprise costs €2.50 per user, which is what we priced for a 25-seat company.
| Plan |
Price (Nov 2026) |
Key features |
| Community |
€0, unlimited users |
Open source core |
| Free business edition |
€0, up to 10 users |
Full feature set incl. SSO and audit logs |
| Enterprise |
€2.50 per user/month, billed annually, 25 users minimum |
Support and SLAs |
A SaaS option also exists. Psono publishes a Trust Center at trust.esaqa.com; we could not verify a SOC 2 report or ISO 27001 certificate, so it scores 5 on compliance despite strong data sovereignty when you host it yourself.
Ideal for: technical SMEs and IT teams under 10 people that can run their own server. Caveat: smaller vendor, no verified certification, and the security of the deployment depends on your own hosting.
8. NordPass Business: easiest rollout (74.5/100)
NordPass Business, from Nord Security in Vilnius, Lithuania, is the password manager that non-technical staff pick up fastest. It encrypts with XChaCha20, holds ISO/IEC 27001:2022 (renewed in December 2025 with no nonconformities) and a SOC 2 Type 2 report (NordPass SOC 2), and has a Cure53 audit and a HIPAA assessment. Press coverage reports an EU data centre option, but we did not find it documented on NordPass's own pages, so it scores 8 on compliance. Entra and Okta SSO plus provisioning sit on Enterprise only (Admin 7). Since October 2026 an official NordPass CLI has been available on all Business and Personal plans, and vault actions taken through it appear in the admin Activity Log (NordPass CLI). That earns Flexibility 5; the service stays proprietary and cloud-only.
| Plan |
Price (Nov 2026, 2-year plan) |
Key features |
| Teams |
€1.79 per user/month |
10-user pack only, Google Workspace SSO |
| Business |
€3.59 per user/month, 5 users minimum |
Breach monitoring, Vanta integration |
| Enterprise |
€5.39 per user/month |
SSO with Entra ID, MS ADFS and Okta; provisioning; Sentinel and Splunk |
Source: NordPass business plans, rendered in EUR. One-year and monthly plans cost more. Free trial available.
Ideal for: companies that need fast adoption and breach monitoring with little IT effort. Caveat: closed SaaS with no self-hosting.
Three well-known tools fell below the top eight, each for a different reason: Zoho Vault on plan gating and price, RoboForm on unverified compliance, and LastPass on its breach record.
| Tool |
Security (25) |
Admin (20) |
Compliance (20) |
Price (15) |
Usability (10) |
Flexibility (10) |
Total /100 |
| Zoho Vault |
6 |
8 |
9 |
6 |
7 |
5 |
70.0 |
| RoboForm |
6 |
9 |
3 |
9 |
8 |
4 |
64.5 |
| LastPass |
0 |
10 |
8 |
6 |
8 |
5 |
58.0 |
Zoho Vault (70.0/100) has strong compliance coverage: Zoho says it is SOC 2 Type 2 compliant, holds ISO/IEC 27001 for its cloud services, lists Vault among its SOC 2 + HIPAA services and runs EU data centres in Amsterdam and Dublin (Zoho compliance). AD/LDAP and Azure AD integration arrive on Professional (€4.50, 5 users minimum), but single sign-on, Okta/OneLogin integration and SIEM integration need Enterprise at €7.20 per user (Standard €0.90), Zoho's most complete plan; the Flex plan is volume pricing on request (Zoho Vault pricing). That is Admin 8, and Price is set by the Enterprise tier, since a directory connector alone does not count as SSO or SCIM. Professional and Enterprise also include a command line interface, so Flexibility scores 5.
RoboForm (64.5/100) is excellent value at $3.33 per user with SSO, SCIM and policies included, but we found only a GDPR statement, no SOC 2 or ISO 27001 evidence. Self-hosting is reserved for 1,000+ users and we found no official CLI or public admin API, hence Flexibility 4.
LastPass (58.0/100) states that it holds "ISO 27001, SOC2 Type II, SOC3, BSI C5" (LastPass security), yet its record sets its security score to 0. In August 2022 attackers compromised a development environment, and by December 2022 they had stolen encrypted vault backups covering around 30 million users. In December 2025 the UK ICO fined LastPass £1.2M for failing to implement sufficiently robust technical and security measures, in a breach affecting up to 1.6 million UK users (ICO; BleepingComputer). TRM Labs has since traced more than $35M of crypto theft through 2025 to vaults cracked from that data (The Hacker News, December 2025). On features alone it would rank much higher: Business (€6.50 per user, below Business Max at €10) lists federated login, SCIM provisioning, directory integrations with Entra ID, Okta, Google Workspace and Active Directory, and SIEM integrations with Splunk and Microsoft Sentinel, which earns Admin 10; Teams (€4.42) has none of these (LastPass pricing). LastPass also maintains an official open source CLI (lastpass-cli), so Flexibility scores 5. Feature depth does not offset the breach record.
KeePass and KeePassXC remain a free, offline reference point, but a local database file offers no central administration, provisioning or audit trail, so we did not score them.
1Password vs Bitwarden for Business: Which Should You Choose?
Choose Bitwarden if price, open source and self-hosting matter most; choose 1Password if user adoption and polish matter most. Both have SOC 2 Type II, ISO 27001 and an EU hosting option, so compliance alone rarely decides it.
|
Bitwarden |
1Password |
| Plan with SSO |
Enterprise, $6 |
Business, $8.99 |
| Cheapest plan with SCIM |
Teams, $4 |
Business, $8.99 |
| EU hosting |
Azure EU region |
1Password.eu |
| Self-hosting |
Yes, Enterprise |
No |
| Source code |
Open source |
Proprietary |
| Encryption model |
Zero-knowledge, master password |
Zero-knowledge, password plus Secret Key |
| Free family plan for staff |
Yes, Enterprise |
Yes, Teams Starter Pack and Business |
| SIEM event export |
Not assessed (Admin capped at 8 by Enterprise-only SSO) |
Business, to Splunk, Elastic, Sumo Logic, Panther |
For a 25-person company that wants SSO, the licence gap is $2.99 per user per month, or about $897 a year. Engineering-heavy teams are comfortable with Bitwarden; mixed sales, finance and operations teams adopt 1Password with less training.
"Most password manager projects fail on offboarding, not on encryption," says Alfons Marques. "Every serious vendor encrypts well. The question an auditor will ask is how fast a leaver lost access to the shared finance vault, so connect SCIM to your identity provider on day one."
What Is the Best Self-Hosted Password Manager for Business?
The best self-hosted password manager for business is Bitwarden Enterprise if you want a mainstream product with SOC 2 and ISO 27001 behind it, Passbolt if you want an EU-built, open source tool with SSO from €4.50, and Psono if you have fewer than 10 users and want business features for free.
Self-hosting gives you control over where data lives, which matters for public bodies, defence suppliers and companies with strict sovereignty clauses. It also makes patching, backups, availability and monitoring your job, and an auditor will ask for evidence of each.
| Tool |
Licence |
Self-hosting on |
SSO on self-hosted |
Verified attestations |
| Bitwarden |
Open source |
Enterprise, $6 |
Yes |
SOC 2 Type II, ISO 27001 |
| Passbolt |
AGPLv3 |
Community (free) and Pro, €4.50 |
Pro |
SOC 2 Type II, ISO 27001 aligned only |
| Psono |
Open source |
All editions, free to 10 users |
Yes |
None verified |
| RoboForm |
Proprietary |
1,000+ users only |
Yes |
None verified |
EU Data Residency, GDPR and Where Your Vault Lives
For GDPR purposes, a password manager is a processor of employee personal data, so you need a data processing agreement and a clear answer on hosting location. Zero-knowledge encryption means the vendor cannot read vault contents, but account metadata, names, emails and logs still sit on its servers.
| Tool |
EU/EEA or adequate-country hosting |
Vendor jurisdiction |
| Bitwarden |
Azure EU region, or self-host |
USA |
| 1Password |
1Password.eu |
Canada |
| Proton Pass Business |
Switzerland (EU adequacy decision) |
Switzerland |
| Passbolt |
Belgium/Germany cloud, Luxembourg sovereign cloud, or self-host |
Luxembourg |
| Keeper |
AWS EU region |
USA |
| Psono |
Self-host anywhere |
Germany |
| Dashlane |
Not documented on public pages |
USA / France |
| NordPass |
EU data centre option (press reports) |
Lithuania |
Switzerland is not in the EU, but it holds an EU adequacy decision, so transfers to Proton do not need extra safeguards under GDPR. If US jurisdiction is a concern for your sector, Proton, Passbolt and Psono remove it at vendor level; Bitwarden removes it at infrastructure level when you self-host, and documents EU SCCs and the EU-US Data Privacy Framework.
How a Password Manager Supports NIS2 and ISO 27001
A business password manager is one of the cheapest ways to evidence access-control requirements under NIS2 and ISO 27001. NIS2 Article 21(2)(i) requires "human resources security, access control policies and asset management", and Article 21(2)(j) requires "the use of multi-factor authentication or continuous authentication solutions, ..." where appropriate (Directive (EU) 2022/2555).
| Requirement |
What the password manager provides |
| NIS2 Art. 21(2)(i), access control policies |
Shared vaults by role, SCIM offboarding, admin policies |
| NIS2 Art. 21(2)(j), MFA |
Enforced MFA on the vault, SSO with your identity provider, passkeys |
| ISO 27001:2022 A.5.15 Access control |
Role-based vault and collection permissions |
| ISO 27001:2022 A.5.17 Authentication information |
Generated unique passwords, secure sharing, rotation |
| ISO 27001:2022 A.5.18 Access rights |
Provisioning and deprovisioning through SCIM or directory sync |
| ISO 27001:2022 A.8.5 Secure authentication |
SSO, MFA and passkey enforcement |
| ISO 27001:2022 A.8.15 Logging |
Audit logs exported to a SIEM |
If you are scoping NIS2 or preparing certification, our NIS2 compliance service and ISO 27001 implementation service include the password manager in the control evidence pack.
Which Business Password Manager Fits Your Company?
Pick by company profile, not by headline price. The matrix below reflects our scores and plan gating.
| Company profile |
First choice |
Alternative |
| SME, 10-50 staff, Microsoft 365 or Google Workspace |
Bitwarden Teams |
Proton Pass Professional |
| Scale-up, mixed non-technical teams |
1Password Business |
Dashlane |
| Regulated (finance, health, public-sector supplier) |
Keeper Enterprise |
1Password Business |
| EU-sovereignty requirement or NIS2 essential entity |
Passbolt (sovereign cloud or self-hosted) |
Proton Pass Professional |
| Privacy-focused professional firm |
Proton Pass Professional |
Bitwarden Enterprise (EU) |
| Under 10 users, in-house IT |
Psono free business edition |
Bitwarden Teams |
| Currently on LastPass |
Migrate to Bitwarden or 1Password |
Proton Pass Professional |
A password manager is one layer of a wider programme; our enterprise cybersecurity guide covers the rest, our SME cybersecurity guide sets priorities for smaller teams, our enterprise network security guide explains how to segment the servers a self-hosted vault runs on, and our cybersecurity services can help you select and roll it out.
Frequently Asked Questions About Business Password Managers
What is the best password manager for business in 2026?
Bitwarden scored highest in our November 2026 comparison at 87/100, thanks to open source code, SOC 2 Type II and ISO 27001, EU hosting or self-hosting, and SCIM from $4 per user. 1Password (84.5) is the best choice for user experience, Passbolt (82) for EU sovereignty, and Proton Pass Business (80.5) for privacy under Swiss jurisdiction.
How much does a business password manager cost per user?
Expect about $1 to $10 per user per month, billed annually (prices as of November 2026, excl. VAT). Entry plans start at €0.90 (Zoho Vault Standard), $1.99 (Proton Essentials) or $2.00 (Keeper Starter), but SSO usually costs more: $4.99 at Proton, $6 at Bitwarden and Keeper, $8.99 at 1Password, up to €10 for LastPass Business Max. Psono and Passbolt Community are free if you self-host.
Which business password managers include SSO and SCIM on a mid-priced plan?
Proton Pass Professional ($4.99) includes SSO, SCIM, activity logs and SIEM integration, although it is the top Pass plan. 1Password Business ($8.99) adds SSO, provisioning and SIEM event streaming below its Enterprise tier, and Dashlane Omnix (€8) includes SSO and SCIM. Bitwarden puts SCIM on Teams ($4) and SSO on Enterprise ($6), while Keeper and NordPass keep both for Enterprise.
What is the difference between a business and an enterprise password manager?
A business plan covers shared vaults, basic policies and admin for small teams. An enterprise plan adds workforce SSO, SCIM or directory sync, audit log export to a SIEM, role-based access and sometimes self-hosting. Many vendors gate SSO to the enterprise tier, so compare plans, not brands.
Do business password managers support passkeys?
Increasingly, yes, but confirm it on each vendor's documentation. Proton lists "passkey support on all devices" on its $1.99 Pass Essentials plan (proton.me/business/pass), and Zoho Vault's free plan covers "unlimited passwords, passkeys and storage" (zoho.com/vault/pricing). With 87% of surveyed US and UK companies rolling out passkeys (FIDO Alliance, 2024 survey), check that your vault syncs them across every platform staff use.
Is a self-hosted password manager more secure than a cloud one?
Not automatically. Self-hosting gives you control over data location, but you take over patching, backups, availability and monitoring. A certified SaaS vault with zero-knowledge encryption is often safer than a self-hosted server nobody maintains. Choose self-hosting when sovereignty rules demand it, and staff it properly.
Is LastPass still safe for business use?
LastPass lost encrypted vault backups for around 30 million users in 2022, and the UK ICO fined it £1.2M in December 2025. TRM Labs has traced more than $35M of crypto theft through 2025 to vaults cracked from that data (The Hacker News, 2025). We rank it last of the eleven tools we scored and recommend migration plus rotation of critical credentials.
Do password managers help with NIS2 compliance?
Yes. NIS2 Article 21(2)(i) and (j) require access control policies and multi-factor authentication. A business password manager with SSO, enforced MFA, SCIM offboarding and audit logs provides direct evidence for both, and also maps to ISO 27001:2022 controls 5.15, 5.17, 5.18, 8.5 and 8.15.
Need help choosing, migrating or documenting a password manager for NIS2 or ISO 27001? Talk to us and we will map it to your controls.
