In short
Keeper vs 1Password comes down to sign-in model and plan structure. 1Password adds a 128-bit Secret Key to your account password, while Keeper derives its key from your master password and offers SAML 2.0 single sign-on and Active Directory sync on Enterprise. Keeper Business and 1Password Business both give every user a personal account outside the work vault.
Want an impartial recommendation?
Tell us about your users, systems and priorities and we will tell you which option fits, and why.
Keeper vs 1Password at a glance
| Keeper | 1Password | |
|---|---|---|
| Made by | Keeper Security, Inc., headquartered in Chicago | AgileBits Inc. |
| Vault encryption | AES-256 GCM, encrypted and decrypted on your device (zero knowledge) | AES 256-bit end-to-end encryption, with Secure Remote Password sign-in |
| Unlocking the vault | Master password (key derived on the device with PBKDF2), biometrics, or SAML 2.0 single sign-on on Enterprise | Account password plus a 128-bit Secret Key (Two-Key Derivation); Unlock with SSO on 1Password Business |
| Business plans | Business Starter (5 to 10 seats), Business (minimum 5 seats), Enterprise; KeeperMSP for IT providers | Teams Starter Pack (10 users minimum, up to 20), 1Password Business (1 user minimum), Enterprise Password Manager (quote only) |
| Single sign-on and provisioning | Enterprise: SAML 2.0 SSO, SCIM provisioning, AD and LDAP sync; Entra ID, Okta, Google Workspace and Ping | 1Password Business: Unlock with SSO over OpenID Connect; SCIM provisioning with Entra ID, Google Workspace, Okta, OneLogin and JumpCloud |
| SIEM | SIEM integration add-on (requires Advanced Reporting & Alerts) | Event streaming to SIEM tools including Splunk, Microsoft Sentinel, Elastic and Sumo Logic |
| Breach and password monitoring | BreachWatch dark web monitoring, an add-on | Watchtower alerts for breaches and weak, reused or expiring passwords |
| Business trials | Free trials of Business and Enterprise | 14-day free trial, no credit card |
| Certifications named | ISO 27001, 27017 and 27018; SOC 2 Type 2; FIPS 140-3 validated encryption | SOC 2 Type 2; ISO 27001, 27017, 27018 and 27701 |
Sources: Keeper Enterprise (opens in a new tab), Keeper security (opens in a new tab), 1Password security (opens in a new tab) and 1Password Unlock with SSO (opens in a new tab). Both providers publish more detail on their own sites; the sections below explain what the differences mean in use.
Still not sure which way to go? Ask us
Tell us what matters most to you and we will recommend one, with the trade-offs explained.
Security model: master password or Secret Key
Both are zero-knowledge designs: your vault is encrypted and decrypted on your own device, and neither company can read what is in it. The difference is what protects the key.
Keeper says vault data "is encrypted on the user's device locally using AES-256 GCM", and that when you log in with a master password, "PBKDF2 is utilised on the local device to derive a 256-bit AES key for decryption". Its security page describes PBKDF2 with 1,000,000 iterations, and data in transit uses "TLS 1.3 with an additional layer of encryption in the payload" (Keeper security (opens in a new tab)).
1Password adds a second secret. Your Secret Key is "34 letters and numbers, separated by dashes", is stored on the devices you have signed in on and in your Emergency Kit, and has "128 bits of entropy"; 1Password says "We have no record of your Secret Key and can't recover it" (1Password (opens in a new tab)). In its words, the account password "protects your data on your devices", and the Secret Key "protects your data off your devices".
Where your data is held. Keeper lets organisations "host their Keeper tenant in their preferred primary region", including Europe (EU). 1Password accounts are created on 1Password.com (United States), 1Password.ca (Canada) or 1Password.eu (European Union) (1Password regions (opens in a new tab)). In both cases, choose the region before you start. See are password managers safe? for what these models protect against.
Business plans, single sign-on and admin
| Keeper | 1Password | |
|---|---|---|
| Plans and seats | Business Starter (5 to 10 seats), Business (minimum 5 seats), Enterprise; KeeperMSP for IT providers | Teams Starter Pack (10 users minimum, up to 20), 1Password Business (1 user minimum), Enterprise Password Manager (quote only) |
| Sign-in and provisioning | Enterprise: SAML 2.0 SSO, SCIM provisioning, AD and LDAP sync; Entra ID, Okta, Google Workspace and Ping | 1Password Business: Unlock with SSO over OpenID Connect; SCIM provisioning with Entra ID, Google Workspace, Okta, OneLogin and JumpCloud |
| Sharing | Shared team folders on Business and Enterprise; one-time sharing with people who have no Keeper account; time-limited access | Shared vaults with role-based permissions, guest accounts, and sharing items with anyone, even without 1Password |
| Policies and admin | Policy engine by user, role or team; delegated administration on Business; vault transfer when someone leaves | Custom policies, recovery of team members' accounts, Travel Mode controls and custom business reports |
| Reporting and SIEM | SIEM integration add-on (requires Advanced Reporting & Alerts) | Event streaming to SIEM tools including Splunk, Microsoft Sentinel, Elastic and Sumo Logic |
| Breach monitoring | BreachWatch dark web monitoring, an add-on | Watchtower alerts for breaches and weak, reused or expiring passwords |
| Family benefit for staff | Free Family Plan for every user on Business and Enterprise, for up to 5 family members | Free 1Password Families membership for every 1Password Business user |
| Trial | Free trials of Business and Enterprise | 14-day free trial, no credit card |
Single sign-on works differently. Keeper Enterprise lists SAML 2.0 single sign-on, SCIM provisioning and Active Directory and LDAP sync, with identity providers such as "Entra ID (formerly Azure AD), Okta, Google Workspace, Ping, AD FS and more" (Keeper Enterprise (opens in a new tab)). 1Password Business offers Unlock with SSO, which "is only available using the OpenID Connect (OIDC) protocol", with one identity provider per account (1Password (opens in a new tab)); provisioning is a separate set-up that creates users and groups and suspends users from Google Workspace, JumpCloud, Microsoft Entra ID, Okta or OneLogin (1Password provisioning (opens in a new tab)).
Plan sizing. Keeper Business Starter is for 5 to 10 seats and Business starts at 5 seats; 1Password's Teams Starter Pack starts at 10 users and goes up to 20, while 1Password Business has a one-user minimum. Beyond these, 1Password sells Enterprise Password Manager as a quote-only product, and Keeper adds KeeperMSP for IT providers and add-ons such as BreachWatch (opens in a new tab).
Weighing up the options?
We can compare them against your own requirements and recommend what fits.
Which suits you?
Match the facts to your situation:
- You manage staff in Active Directory or LDAP on premises: Keeper Enterprise lists AD and LDAP sync through Keeper Bridge
- You want SSO and provisioning without an enterprise plan: 1Password Business includes Unlock with SSO and SCIM provisioning
- Your identity provider only offers SAML: Keeper Enterprise uses SAML 2.0; 1Password's Unlock with SSO uses OpenID Connect
- You are a team of 5 to 10: Keeper Business Starter is sized for 5 to 10 seats; 1Password's Teams Starter Pack starts at 10 users
- You want a second secret on every device: 1Password's Secret Key is added to every account automatically
- You want breach alerts across the organisation: Keeper sells BreachWatch dark web monitoring as an add-on; 1Password Business includes Watchtower alerts for breaches and weak, reused or expiring passwords
Both offer business trials: free trials of Keeper Business and Enterprise, and 14-day trials of 1Password's Teams Starter Pack and Business with no credit card.
Moving between Keeper and 1Password
Both import from the other. Keeper's documentation includes an import from 1Password (Keeper import (opens in a new tab)), and 1Password lists Keeper among the apps it imports from (1Password import (opens in a new tab)).
- Set up the new account first, including two-step verification
- Export from the old vault on a trusted computer
- Import into the new vault and check that shared folders or vaults arrived as expected
- Delete the export file, because it is not encrypted
- Close the old account once everyone has moved
Our switching guide covers each export and import screen, and what each one leaves behind.
Buying Keeper or 1Password for your organisation
We can quote Keeper and 1Password for your business, so we can help you choose between them rather than steer you to one; the plan and terms are confirmed at quote. We can:
- Help you choose between Keeper and 1Password against your identity platform (Microsoft Entra ID, Google Workspace or Okta), your team size and how your teams share logins
- Set up single sign-on and user provisioning on the plans that include them, so accounts are created and removed from your directory
- Set policies and build shared folders or vaults for each team before staff are invited
- Import passwords from browsers, spreadsheets or the other password manager
- Keep licensing in one place: licences can be billed monthly, with terms confirmed at quote
See our Keeper and 1Password business pages for each plan in detail. Contact us for free advice on which fits, or a quote.
Frequently asked questions
Is Keeper or 1Password more secure?
Both encrypt your vault on your own device so the provider cannot read it. Keeper derives the key from your master password with PBKDF2 on the device and holds ISO 27001, 27017 and 27018 and SOC 2 Type 2 certification. 1Password adds a 128-bit Secret Key to your account password and holds SOC 2 Type 2 and ISO 27001, 27017, 27018 and 27701. Our guide are password managers safe? explains the models.
Can we trial both?
Yes. Keeper offers free trials of Keeper Business and Enterprise. 1Password offers 14-day free trials of its Teams Starter Pack and 1Password Business, with no credit card required. We can help you set up a pilot group on each.
Do Keeper and 1Password both keep staff's personal logins separate from the work vault?
Yes. Keeper Business includes a Family Plan for every user, separate from the work vault. 1Password Business users get a complimentary 1Password Families membership, linked to the business account only by subscription status (1Password (opens in a new tab)).
Do they work with Microsoft Entra ID?
Yes. Keeper Enterprise integrates with Entra ID for SAML 2.0 single sign-on and SCIM provisioning. 1Password Business unlocks with SSO through Entra ID over OpenID Connect, and provisioning creates and suspends users from Entra ID.
Which is better for a small team?
It depends on size and sign-in. Keeper Business Starter covers 5 to 10 seats; 1Password's Teams Starter Pack covers 10 to 20 users, and 1Password Business has a one-user minimum. If you want directory sign-in, compare Keeper Enterprise with 1Password Business.
Still deciding?
Ask us and a member of our team will get back to you.
More password manager guides
KeeperKeeper Security's business plans and add-ons, and how we can quote and set up Keeper for your business.
1Password1Password's business plans, Secret Key security model and wider Unified Access range, and how we can quote and set up 1Password.Compare password managersKeeper, 1Password, NordPass and LastPass business plans side by side on published facts.LastPass vs KeeperLastPass and Keeper business plans compared on security model, seats, sharing, SSO and admin.NordPass vs 1PasswordNordPass and 1Password business plans compared on security model, seats, sharing, SSO and admin.Switching password managerHow to move passwords between password managers and off browsers or spreadsheets, safely.