How to choose the best password manager for your business

A selection guide, not a league table

Search for the best password manager for business and you will find ranked lists and scores. This page takes a different approach. It covers four password managers, Keeper, 1Password, NordPass and LastPass, and compares them only on facts each vendor publishes, so you can match them against your own requirements. How we gather and check those facts is on the how we compare page.

The UK's National Cyber Security Centre puts the principle plainly in its guidance on password managers (opens in a new tab): "The best password manager to choose is the one that best meets your needs, and which you find easiest to use." For a business, "your needs" usually comes down to six questions:

If you already know you need a plan for a small team, the password manager for small business guide goes straight to the entry plans. Larger organisations can jump to the enterprise password manager guide.

Start with your identity platform

Most organisations already manage staff accounts in Microsoft Entra ID, Google Workspace or Okta. Connecting the password manager to that directory means people unlock their vault with their work identity (single sign-on, SSO) and accounts are created and suspended automatically (provisioning, usually through the SCIM standard). This is the question that most often settles which plan, and which vendor, you need.

Two details are worth checking before you commit. 1Password's Unlock with SSO is "an authentication method only": provisioning is set up separately, and the two together give you the full joiner and leaver flow. And if you run Google Workspace, NordPass gives you SSO on its entry Teams plan, while the other three put directory sign-in on their mid or top plans.

Whichever you choose, set SSO up before inviting staff. It is much easier for people to enrol once with their work identity than to create a master password and switch later.

Team size and seat rules

Each vendor's entry plan has its own seat rule, and those rules decide more small-business choices than any feature list.

So a team of 12 is past Keeper Business Starter and NordPass Teams but inside 1Password's Teams Starter Pack and LastPass Teams, while a team of 4 would buy the minimum of 5 seats on Keeper Business or NordPass Business. NordPass also notes that you can upgrade from Teams to Business at any time but cannot downgrade from Business to Teams. Licences are per user on every mid and top plan, so we quote the seats you need, within each plan's minimum.

Sharing and offboarding

Sharing is why businesses buy a password manager rather than letting staff use personal ones. Every vendor here lets you share logins by team with view or edit rights, and the names differ: Keeper shared team folders, 1Password shared vaults, NordPass Shared Folders and LastPass shared folders. NordPass describes the benefit well: "When a password changes, it updates automatically for everyone with access" (NordPass (opens in a new tab)).

The harder question is what happens when someone leaves:

• Keeper Account Transfer moves a leaver's vault to a colleague. Keeper's documentation says it "should be configured by the Keeper Administrator during the initial deployment phase", because each user must log in and accept the policy before a transfer can happen (Keeper (opens in a new tab))
• 1Password suspends users when you deprovision them in your identity provider (1Password (opens in a new tab)), and team administrators and owners can recover accounts for team members who cannot sign in (1Password (opens in a new tab))
• NordPass includes Item Transfer and recovery of locked accounts on all three business plans (NordPass business plans comparison)
• LastPass ties vault access to your directory through federated login, for automated onboarding (LastPass (opens in a new tab))

Whichever you pick, decide the offboarding route on day one. Our share passwords securely guide covers how to structure shared folders so team logins stay with the team.

Policies, reporting and SIEM

Policies apply your rules to everyone; reports show whether they are being followed. If you send security events to a SIEM (security information and event management) tool, check the plan that includes it.

If you are working towards Cyber Essentials (opens in a new tab), v3.3 of the requirements (opens in a new tab) names "a password manager" as an example of the usable secure storage organisations should provide, alongside no forced password expiry and no complexity rules. A password manager helps you meet those points; it is not a requirement in itself. The business password policy guide shows how to write the rules your password manager will enforce.

Security model and assurance

All four use zero-knowledge designs, where vault data is encrypted on the user's device and the vendor cannot read it. Each describes its own protections and certifications:

The NCSC's advice when choosing a third-party password manager is to "pick a reputable company with a strong security track record" and enable two-step verification (2SV) (NCSC (opens in a new tab)). Our guide to whether password managers are safe covers how the encryption works and what to set up on day one.

Data region

If your contracts or policies say where data must be held, check the hosting options early.

• Keeper lets organisations host their tenant in a preferred primary region: United States, US Government Cloud, Europe, Australia, Japan or Canada. A UK organisation would usually choose Europe (Keeper (opens in a new tab))
• 1Password accounts are created in one of three regions, with secure data hosted in the United States (1Password.com), Canada (1Password.ca) or the European Union (1Password.eu). The region also sets the billing currency (1Password (opens in a new tab))
• NordPass and LastPass: we confirm the hosting location for your tenant when we quote

If you are weighing up running a password manager on your own servers instead, see self-hosted vs cloud password managers.

Personal accounts for staff

A separate personal account for each member of staff keeps personal logins out of the work vault, so the vault the organisation keeps holds only work credentials.

• Keeper: lists a "Free Family Plan for every user" on its business plans, with the exact plan confirmed at quote (Keeper (opens in a new tab))
• 1Password Business: "a complimentary 1Password Families membership", with only the subscription status linked to the business account (1Password (opens in a new tab))
• LastPass Business and Business Max: a free Families account with 5 licences for family and friends; LastPass says employers can never access that personal data (LastPass (opens in a new tab)). LastPass Teams does not include it
• NordPass Business and Enterprise: the plan table lists a "Free Premium plan for all users"

The four side by side

The facts above in one table. Plan names are as each vendor writes them; prices depend on seats and plan, so ask us for a quote.

For trial details see business password manager free trials; for a wider set of features, the compare password managers page, or each vendor's own page: Keeper, 1Password, NordPass and LastPass.

How we help you choose

Because we can supply all four, we can recommend the one that fits your organisation rather than the only one we sell. We can:

• Compare the four against your identity platform, team size, sharing needs and reporting requirements, and shortlist the plan that fits
• Help you run a trial with a pilot group so staff can tell you which they find easiest to use
• Set up single sign-on and provisioning, policies and shared folders, and import passwords from browsers, spreadsheets or your old password manager
• Quote the licences, which can be billed monthly, with the plan and terms confirmed at quote

Contact us for free advice or a quote. The password management software guide explains each feature in more depth.