Most small firms already have a password manager. It is a spreadsheet called “logins,” a sticky note on the office manager’s monitor, and the owner’s memory. That works until someone leaves, a vendor account gets taken over, or a cyber insurance application asks how shared credentials are controlled.
This guide compares the business password managers a small firm is most likely to shortlist, 1Password, Bitwarden, NordPass and Keeper, on the things that matter at 5 to 100 seats: who can see what, how fast you can cut off a leaver, whether it works with the sign-in system you already have, and what it costs. Prices were checked on each vendor’s own pricing page on November 4, 2026. Where a vendor’s page did not show a price we could read, we say so instead of guessing.
Why a business vault, not a spreadsheet
A shared spreadsheet fails in three predictable ways. Everyone with the file can see every password, so there is no way to give the bookkeeper the bank portal without also giving her the domain registrar. There is no record of who opened what. And when someone leaves, the only safe move is to change every password they could have seen, which nobody does.
A business password manager fixes those three things. Each person gets their own encrypted vault. Shared items live in shared vaults or folders that you grant by role. The admin console shows who has access, and removing a person removes their access to shared items in one step. The vendors in this guide all describe their products as end-to-end or zero-knowledge encrypted, meaning the vendor stores your data but cannot read it.
There is also a paperwork reason. Cyber insurance applications and client security questionnaires increasingly ask about shared accounts, MFA and offboarding. Our cyber insurance checklist covers those questions. A password manager with an admin console is the easiest way to answer them with evidence rather than a promise.
What a small business actually needs
Ignore the feature grids for a moment. At 5 to 100 people, these are the lines that decide the choice:
- Shared vaults or folders with permissions. Finance logins for finance, the website login for whoever runs the website. Every product here does this, but the granularity differs by plan.
- Fast offboarding. Removing a user should end their access to shared items immediately. Ideally it is automatic, driven by your identity provider.
- Works with your sign-in system. If you run Microsoft 365 (Entra ID) or Google Workspace, check that your plan supports single sign-on (SSO) or automated user provisioning (SCIM) with that system. This is where plan tiers matter most.
- Account recovery. Someone will forget their master password. An admin needs a way to recover the account without the vendor being able to read it.
- Activity or event logs. You want to be able to answer “who opened the bank login last week.”
- Breach and password health reports. Useful, not essential. They flag reused, weak and exposed passwords so you know where to start.
- A security record. Independent audits and certifications such as SOC 2 Type II and ISO 27001. All four vendors list at least one on their pricing pages.
The main options, compared
Annual billing, U.S. dollars, per user per month unless stated, as shown on each vendor’s pricing page on November 4, 2026. Taxes are extra. Plans and promotions change often; confirm on the vendor’s page before you buy.
Swipe the table sideways to see every column.
| Product | Small-team plan | Business plan | SSO / provisioning | Notes |
|---|---|---|---|---|
| 1Password | Teams Starter Pack: $24.95 a month flat for up to 10 members; up to 10 more seats at $4.99 each | Business: $8.99 | Business: Okta, Entra ID, OneLogin, Duo integrations; provisioning with Entra ID, Google Workspace, Okta and others | 14-day free trial of Business. SOC 2 Type II. Guest accounts: 5 on Starter Pack, 20 on Business. |
| Bitwarden | Teams: $4 | Enterprise: $6 | Teams: directory sync and SCIM. Enterprise: SSO integration, enterprise policies | Open source. Free plan for individuals. Enterprise can be self-hosted and includes a free Families plan for every user. SOC 2 Type II, ISO 27001. |
| NordPass | Teams: up to 10 users | Business and Enterprise: 5-user minimum | Teams: Google Workspace SSO. Enterprise: SSO with Entra ID, MS ADFS and Okta, plus automatic user management via Entra ID and Okta | Prices load dynamically on NordPass’s page and could not be read by our checker; see the page for the current rate. Trial without a card; 14-day refund window. Lists ISO 27001, SOC 2 Type 2 and a Cure53 audit. |
| Keeper | Business Starter | Business; Enterprise by quote | Enterprise: SAML 2.0 SSO, SCIM, Entra ID, Okta, Ping | Prices also load dynamically on Keeper’s page. Free Family plan for every user. SOC 2, ISO 27001; FedRAMP High on GovCloud. |
Two things stand out. First, the line that most often decides the plan is SSO and provisioning. Bitwarden includes directory sync and SCIM on its $4 Teams plan. 1Password puts identity-provider integrations on Business. NordPass and Keeper put Entra ID and Okta SSO on their Enterprise tiers. If you want leavers removed automatically when you disable them in Microsoft 365, check which tier gives you that before comparing prices.
Second, the “free family plan for every user” perk, offered by Bitwarden Enterprise and Keeper, is more useful than it sounds. Staff who reuse a work password on a personal account are a real risk, and a free personal vault removes the excuse.
What about the password manager built into Chrome, Edge or Apple devices? For one person it is far better than nothing. For a business it lacks the admin console, shared vault permissions and offboarding that are the reason to buy a business product.
What 12 people cost per year
An example, computed from the list prices above, for a 12-person firm paying annually. It is not a quote.
- 1Password Teams Starter Pack: $24.95 × 12 months = $299.40 for the first 10, plus 2 seats × $4.99 × 12 = $119.76. Total $419.16 a year.
- 1Password Business: 12 × $8.99 × 12 = $1,294.56 a year.
- Bitwarden Teams: 12 × $4 × 12 = $576 a year.
- Bitwarden Enterprise: 12 × $6 × 12 = $864 a year.
- NordPass: Teams caps at 10 users, so a 12-person firm needs Business or Enterprise. Check the current per-user price on NordPass’s page and multiply by 12 seats and 12 months.
At this size the difference between the cheapest and dearest option is under $1,000 a year. That is less than an hour of incident response. Choose on fit and adoption, then on price.
Choosing for a team
A short way to decide:
- You want the lowest cost with SCIM, or you want to self-host: Bitwarden. Its Teams plan includes provisioning at $4, its code is open source, and Enterprise can run on your own servers if a client requires it.
- You want the most polished apps and expect developers to use it: 1Password. Business includes SSH key and Git commit signing, a CLI and SDKs, and the Teams Starter Pack is good value for exactly 10 people.
- You want a simple admin console, breach monitoring and a low per-seat price, and you run Google Workspace or plan to move to Enterprise for Entra ID: NordPass Business. Its Business tier adds password health, data breach monitoring and a Vanta integration, which helps if you are working toward SOC 2. Start a trial here: NordPass Business. Affiliate link: we may earn a commission at no cost to you.
- You need granular admin roles, delegated administration or government cloud: Keeper, whose Business and Enterprise tiers add delegated admin and policy controls, and which offers FedRAMP High on GovCloud.
Whichever you pick, run the free trial with three real users, the owner, the office manager and the least technical person in the firm, for one week before you buy seats for everyone. Adoption is the thing that fails, not encryption.
Owners and solo freelancers: your own accounts
If you work alone, or you are the owner whose personal email is the recovery address for half the company’s accounts, a team plan is not the first step. Your own accounts are. The owner’s email, bank, domain registrar and accounting logins are the ones an attacker wants, and they are often the ones protected by a password reused since 2015.
The job is small:
- Pick a personal password manager. Bitwarden has a free plan and a $19.80-a-year Premium plan. 1Password and Keeper have individual plans. NordPass has free and paid personal plans: NordPass personal plans. Affiliate link: we may earn a commission at no cost to you.
- Start with five accounts. Email, bank, domain registrar, accounting or payroll, and your phone carrier. Give each a new, generated password.
- Turn on MFA for those five, using an authenticator app or passkey rather than text messages where the site allows it.
- Write down recovery. Store your recovery codes and the password manager’s own emergency kit somewhere offline that a trusted person could find.
- Separate business from personal. If a client account or a shared login sits in your personal vault, move it to a business vault once you hire.
If you often work from hotel, airport or client Wi-Fi, a VPN adds a layer on networks you do not control. It does not replace MFA or a password manager, and most sites already encrypt traffic. If you want one, NordVPN is one option. Affiliate link: we may earn a commission at no cost to you.
A 30-day rollout
- Week 1: Trial with three users. Build the vault structure: one shared vault per function (finance, operations, marketing, IT admin) and a rule that personal vaults are for personal work logins.
- Week 2: Import the spreadsheet into the right shared vaults, then delete the spreadsheet and empty the trash. Connect SSO or provisioning if your plan has it.
- Week 3: Invite everyone. Hold a 20-minute session showing the browser extension and the phone app. Turn on the policy that requires MFA on the vault.
- Week 4: Run the password health or breach report. Change the reused and exposed passwords on shared accounts first. Write a one-paragraph offboarding rule: when someone leaves, the admin removes them on their last day and rotates any shared password they used.
Keep the evidence: a screenshot of the admin console user list, the MFA policy setting and the offboarding rule. That is most of what an insurer or client questionnaire will ask for.
Common mistakes
- Buying the tier without SSO and planning to “add it later.” Moving tiers later is possible, but manual offboarding in the meantime is how leavers keep access.
- One giant shared vault. It recreates the spreadsheet problem with better encryption.
- No admin recovery. Set up account recovery before the first person forgets a master password.
- Leaving the old spreadsheet in place. If it still exists, people will still use it.
- Choosing on price alone. At small-firm scale, the cheapest and dearest plans differ by a few hundred dollars a year. A tool nobody uses costs more.
FAQ
Is a free password manager good enough for a business?
For one person, a free plan such as Bitwarden’s is a real improvement. For a team, you need shared vault permissions, an admin console and offboarding, which come with paid business plans.
Is it safe to put every password in one place?
It concentrates risk, which is why the master password and MFA on the vault matter. The vendors here encrypt data on your device before it reaches their servers. The alternative, reused passwords and a shared spreadsheet, is the more common cause of trouble.
Do we need SSO?
Not to start. It becomes worth it when you have enough people that manual offboarding gets missed, or when a client or insurer asks how access is removed.
Which one do you use?
We do not rank a single winner, because the right answer depends on your sign-in system, team size and budget. The decision list in Choosing for a team is how we would pick.
Sources
- 1Password, Business and Teams pricing, checked November 4, 2026
- Bitwarden, business pricing, checked November 4, 2026
- NordPass, business plans, checked November 4, 2026
- Keeper, business and enterprise pricing, checked November 4, 2026
Rather hand it off? Password managers are a line item like any other. The Renewal Audit reviews up to 25 software renewals for a fixed $199 and returns a written report in 5 business days.