The 10 best business password managers in 2026

1. 01

   Movitera

   Origin: Brazil

   Best for
   An in-house IT team that wants the vault inside the product it already uses for tickets and inventory — same account, same permissions — instead of a fifth subscription with its own administrator.

   Movitera's Vault holds logins, notes and `.env` blocks with group sharing, TOTP, single-use share links and browser autofill. What it has that a standalone vault does not is an address: it is the same product the team already uses for tickets and devices, with the same people, the same groups and one administrator — rather than a fifth subscription with its own access process. It also has the screens nobody asks for in a demo and everybody needs during the first incident: an audit log you can filter to one person and export, plus the access and offboarding screens that answer what one person can reach.

   What it delivers

   • The vault lives in the same workspace as the help desk, the inventory and the vendor contracts — one account, one set of groups, one administrator
   • Audit log of views, reveals, edits and shares, filterable per person and exportable to CSV
   • Access and offboarding screens: they answer "what can this person reach in the vault?" and walk the offboarding item by item, instead of somebody trying to remember
   • A rotation queue that ranks credentials by risk, combining age with how many people can see each one, with a configurable age limit
   • Browser extension that fills credentials and generates TOTP, plus single-use links for handing a secret to somebody outside the vault
   • AI included in the seat rather than sold as a credit pack

   Where it stops

   • We publish neither a zero-knowledge architecture nor a third-party audit report. Data is encrypted in transit and at rest, with role-based access and a trail — but Bitwarden publishes an independent cryptography audit and 1Password publishes audit results. If that is your deciding criterion, they win it and we do not.
   • It is not a secrets manager: no runtime injection into CI pipelines, no short-lived dynamic credentials, no machine identity. That is Doppler, Infisical or HashiCorp Vault, alongside.
   • Rotation is a review queue that surfaces what is old and widely visible; replacing the value is manual. There is no automatic rotation against the target system.
   • We do not document single sign-on or automatic user provisioning from your directory. If your offboarding control depends on deactivating someone in the directory and having vault access fall with it, ask before assuming — several vendors here charge dearly for that, and they charge because they deliver it.
   • It is not PAM: no just-in-time elevation and no administrator session recording.
   • Billing is in Brazilian reais only. If your finance department needs a USD or EUR invoice, that is a hard constraint rather than a detail.

   How it bills Per-seat subscription billed in Brazilian reais, from R$ 9 to R$ 129 per month depending on access type. 7 days free, no card.

   Explore Movitera
2. 02

   Bitwarden

   Origin: United States

   Best for
   A technical team that would rather read the code and the audit than trust a security page — and, if it wants, host the vault itself.

   Bitwarden is the strongest answer on the one criterion Movitera loses. The code is open, the audits are annual and published, and the cryptography has been examined by an academic applied-cryptography group against a threat model where the server itself is hostile. For anyone buying security on evidence rather than assurance, it is the category benchmark.

   What it delivers

   • Open source and auditable, with third-party audits published every year
   • Cryptography reviewed by an independent academic group, with the result public
   • Real self-hosting for teams that must keep the vault on their own infrastructure
   • A separate secrets-manager product for teams that also need pipeline coverage

   Where it stops

   • SSO sits on the top tier, so a team that needs single sign-on pays the most expensive step to get it.
   • The interface is the least polished among the majors, and the Android experience is reported as weaker than iOS.
   • Full self-hosting needs somebody comfortable operating it — the licence is free, the operational work is not.

   How it bills Per user per month, with a free personal tier. SSO is gated to the top tier; self-hosting carries no extra licence cost.

3. 03

   1Password

   Origin: Canada

   Best for
   A company that wants the vault people will actually use, with SSO and automatic user provisioning already in the entry business tier.

   1Password is the most finished product in the category and the one that argues least with people outside IT — which matters more than it sounds, because a vault that annoys people becomes a spreadsheet again. It publishes third-party audit results and, unlike several competitors here, does not treat SSO and provisioning as elite-tier items.

   What it delivers

   • The best day-to-day experience on the list, which is what keeps the shared spreadsheet from coming back
   • SSO and automatic user provisioning in the entry business tier rather than gated to the top
   • Publishes independent audit results and runs a bug bounty programme
   • Command-line tooling for teams that want to reach the vault from a script

   Where it stops

   • The company detected in September 2023 and disclosed in October an incident: an employee's session at its identity provider was accessed during the breach of Okta's support system. 1Password states the access was confined to its internal employee environment and that customer vaults were not accessed. It is a vendor-disclosed incident, and that distinction matters.
   • The flat-fee pack for small teams caps at a user count, and crossing it moves the account to full per-seat billing.
   • No self-hosted option, which rules it out where the vault must stay on your own infrastructure.

   How it bills Per user per month, with no free business tier. A flat-fee pack with a user cap exists for small teams and converts to per-seat billing once exceeded.

4. 04

   Keeper

   Origin: United States

   Best for
   A company in a regulated sector that needs compliance reporting, SIEM integration and the option of keeping part of the deployment in its own environment.

   Keeper is built for the administrator who has to prove control to an auditor, not for the user who wants a password filled in. That shows in both directions: the depth of reporting and integration is greater than most, and the experience for someone who just wants to log into a site is harder.

   What it delivers

   • Advanced reporting and SIEM integration for teams that must take evidence to an audit
   • Broad compliance certification coverage
   • Separate secrets-manager and remote-access modules for consolidating onto one vendor
   • Granular policy control per group

   Where it stops

   • The entry price misleads: SSO, automatic provisioning and several essential modules are billed separately or gated to the top tier.
   • The experience is that of an administration console, and users outside IT feel it.
   • Consumer and small-team reviewers consistently describe themselves as the wrong audience for it.

   How it bills Per user per month billed annually, with add-on modules sold separately. SSO and automatic provisioning sit on the top tier.

5. 05

   Doppler

   Origin: United States

   Best for
   An engineering team that needs to stop passing `.env` files around and wants secrets injected into the pipeline per environment.

   Doppler does not compete with anything above it here: it is the other category. It solves the problem no people-vault solves — the same configuration synchronised across development, staging and production and injected into the process at runtime, without ever becoming a file in the repo.

   What it delivers

   • Runtime secret injection, so the secret never lands in the repository
   • Per-environment scoping with promotion from development through staging to production
   • CLI and integrations designed for pipelines rather than browsers
   • A free tier with a small user cap that is genuinely enough to evaluate it

   Where it stops

   • It is not a people vault: no browser autofill, no sharing a portal password with the team, no TOTP for someone logging into a site.
   • SSO and role-based access start at the team tier, with enterprise above it, and the free tier keeps only a few days of audit history.
   • A single organisational layer, which gets awkward across multiple clients or clouds.

   How it bills Per seat per month with a free tier capped by user count. SSO and role-based access start at the team tier.

6. 06

   Infisical

   Origin: United States

   Best for
   A team that wants Doppler's job done by an open-source product it can inspect or self-host.

   Infisical is the open-source answer in the secrets-manager slot, and the most interesting billing model on this page: it charges per identity, where an identity is a person or a machine. That is honest about what the product actually serves, and it is also the thing to model before you buy — a CI fleet counts.

   What it delivers

   • Open source, with self-hosting for teams that need the secrets store in their own infrastructure
   • Kubernetes operator, SDKs and CLI aimed at real deployment rather than demos
   • Per-environment scoping, versioning and secret rotation on the paid tier
   • A free tier with a small identity cap, including full CLI and integrations

   Where it stops

   • Billing per identity means machine identities count like people: a large CI fleet can multiply the bill in a way seat-based pricing would not.
   • A younger, smaller ecosystem than HashiCorp Vault, so unusual requirements land at the API.
   • Like Doppler, it is not a people vault — no autofill, no group password sharing, no TOTP.

   How it bills Per identity per month, counting humans and machine identities together, with a free tier capped by identity count. SAML SSO, RBAC and rotation sit on the paid tier.

7. 07

   Proton Pass

   Origin: Switzerland

   Best for
   An organisation that treats privacy as a first-order requirement and already uses the rest of the Proton suite.

   Proton Pass inherits the privacy posture of the mail product from the same house: client-side encryption, Swiss jurisdiction, and a product culture where privacy is not a top-tier feature. It does less than the leaders on business administration, and it is explicit about who it was built for.

   What it delivers

   • Client-side encryption as a product premise, under Swiss jurisdiction
   • Sold bundled with mail, VPN and storage, cutting the number of vendors
   • Built-in email aliases, useful for reducing exposure surface
   • An entry business tier that is easier to understand than several competitors'

   Where it stops

   • SSO starts at the middle business tier, and the business tiers carry a user minimum.
   • A narrower integration catalogue and thinner administration features than 1Password or Keeper.
   • Switzerland is outside the EU, which is a question worth asking if your compliance review is strict about jurisdiction even with an adequacy arrangement.

   How it bills Per user per month with a user minimum on the business tiers, billed in USD by default with other currencies available. SSO starts at the middle tier.

8. 08

   Dashlane

   Origin: United States

   Best for
   A small team that wants a vault with breach monitoring and very little adoption friction.

   Dashlane is solid at the basics and invests in what a user notices quickly: alerts for leaked credentials, a password health dashboard, adoption without training. It is less deep in the administration console than the two leaders, and priced above the aggressive alternatives.

   What it delivers

   • Monitoring for credentials exposed in breaches, with a password health dashboard
   • Easy adoption, with little resistance from people outside IT
   • Well-resolved autofill and assisted password-change flows
   • An administration console that is enough for a small team

   Where it stops

   • Less administrative and reporting depth than 1Password or Keeper.
   • Perceived as expensive for what it delivers next to Bitwarden and the value-priced alternatives.
   • Its consumer-oriented extras read as surplus to IT teams buying purely for business use.

   How it bills Per user per month with no persistent free business tier — a trial only.

9. 09

   NordPass

   Origin: Lithuania

   Best for
   A team already inside the Nord ecosystem that wants a competitively priced vault and does not need deep compliance tooling.

   NordPass is the value entry among the credible business vaults, with the shortest distance between signing up and having the team inside it. It is also the clearest SSO-tax case on this page, and worth reading the tier table carefully before comparing its price to anything else.

   What it delivers

   • Aggressive pricing, especially on longer commitments
   • Straightforward rollout, with centralised onboarding for a small team
   • Fits naturally where the organisation already buys other Nord products
   • Modern encryption implementation with local encryption of vault data

   Where it stops

   • The business tier ships one narrow SSO option; full single sign-on and automatic provisioning require the enterprise tier. Comparing its entry price against a competitor that includes SSO compares different things.
   • Less mature audit and compliance tooling than 1Password, Bitwarden or Keeper.
   • Autofill regressions on Android are a recurring user complaint, and organisational structure options are thinner than competitors'.

   How it bills Per user per month, priced against multi-year commitments. Full SSO and automatic provisioning sit on the enterprise tier above business.

10. 10

    LastPass

    Origin: United States

    Best for
    Almost nobody in 2026 — it is here because it is the story that explains why this page's first criterion exists.

    LastPass is still sold and still works. It is last because no serious comparison in this category can leave out what happened to it, and because the lesson is precisely the published-architecture criterion: what separates one vault from another is not the feature list, it is what happens on the worst day.

    What it delivers

    • A mature product with a large installed base and administration many people already know
    • Broad platform coverage and integrations accumulated over years
    • Published public analysis of its own incidents, which not every vendor does

    Where it stops

    • In 2022 the company disclosed two related incidents: in August, access to a development environment with source code exfiltrated; in November, the use of that data to reach a cloud storage service holding customer vault backups. Litigation continued into 2025, when a class-action settlement was reached. These are facts the vendor itself disclosed.
    • The incident is from 2022, but the practical effect is that every evaluation starts there — and that is what comes up in the purchasing meeting.
    • Nothing about the current product answers the architecture criterion better than Bitwarden or 1Password already do.

    How it bills Per user per month on business tiers.

Billing models, not list prices: vendors reprice, and models change slowly. Confirm the current rate and which tier holds SSO on the vendor's page before deciding.

What decides your purchase is being able to read the cryptography audit rather than trust a security page.

Bitwarden. Open source, published annual audits and an independent academic review of the cryptography. Movitera publishes nothing equivalent, and we are not going to pretend otherwise.

Your IT team supports users and wants the vault inside the same product as the tickets and the inventory, without another contract and another administrator.

Movitera — provided your finance team can process an invoice in Brazilian reais, which is the constraint stated in our entry.

The problem is `.env` files passed around in chat and secrets in the pipeline, not portal passwords.

Doppler or Infisical — Infisical if you want it open source or self-hosted, and model the machine identities first because they are billed like people. If you are already on HashiCorp, note that the managed secrets-only product was discontinued, reaching end of life in July 2026, so the migration is to a different offering.

You need privileged accounts with recorded sessions and just-in-time elevation.

CyberArk, Delinea or BeyondTrust. That is PAM — a different category, not a more expensive team vault — and implementation is a project rather than a signup.

You have forty people outside IT who will abandon anything difficult.

1Password. Adoption is the feature, and a vault people avoid becomes a spreadsheet again — which is the problem you set out to solve.

You have to take evidence of control to an auditor in a regulated sector.

Keeper, for reporting depth and SIEM integration. Confirm which tier holds SSO and provisioning first, because it changes the bill.

Passwords are in a spreadsheet today and there is no approved budget.

Start on Bitwarden's free tier or any trial on this list, but start this week. A spreadsheet has no trail, no revocation and no rotation — and the GitGuardian data shows exposed secrets are rarely revoked afterwards.