Password managers for teams and business (2026)

The world's most widely deployed team password manager is a spreadsheet named logins_FINAL_v7.xlsx, in a shared drive everyone can read, updated by whoever joined last. It is free, it syncs, and it has no permissions, no audit trail, no revocation — which is why security teams hate it and small businesses run on it anyway. This guide is about replacing it without buying the wrong thing.

A password manager for teams is a different purchase, so this is a separate piece from our roundup of the best password managers in 2026. The individual question is "is the vault good?" The team question is "what happens when the intern leaves, the admin is on vacation, and the vendor portal wants a six-digit code at 2 a.m.?" Those answers exist, and a password manager for business is priced per seat.

What a team actually needs

The individual checklist — encryption, autofill, sync — still applies. A password manager for small business use adds what consumer reviews barely mention:

• Shared collections with per-item permissions. Share one credential with one contractor without sharing the folder it lives in. This is the feature that kills the spreadsheet.
• Roles beyond admin and everyone. Read-only for contractors, managers who can share but not delete, auditors who see usage but not secrets.
• Onboarding and offboarding automation. Directory sync and SCIM provisioning, so removing a person from the identity provider removes them from every vault. Offboarding is the test of a team tool; the rest is marketing.
• Single sign-on. SAML or OIDC against the company identity provider, so the vault answers to the same keys as everything else.
• Audit logs. Who retrieved which credential, when. Not because you distrust the team — because incidents need a timeline.
• Recovery without trust. When someone loses a master password, the path back should not involve an admin reading their vault.
• Breach monitoring for the org. Reports on which company credentials have appeared in breaches.
• Per-seat pricing with honest seat removal. What happens to a departed user's data when the seat is reclaimed is a question for the demo, not the invoice.

The field

1Password Business is the polished default. The Secret Key model scales up intact, and the business tier adds granular vault sharing, Watchtower across the org, reporting, and recovery designed so an admin can help a locked-out member without reading their data. A Teams Starter Pack covers ten users at a flat rate before per-seat Business pricing, and shared items can carry TOTP codes, which matters more than it sounds. The 1Password guide covers the model.

Bitwarden Teams and Enterprise are the value answer with the open-source advantage: the code your security reviewer wants to read is public, the audits yearly. Teams covers shared collections and the basics; Enterprise adds the SSO, provisioning, and audit-log layer, and the whole thing can run self-hosted. At prices that undercut most of the field, Bitwarden is the default for teams that need no persuading. The Bitwarden guide has the details.

Dashlane Business is the bundle: password management plus dark-web monitoring, sold under the Omnix banner now. The monitoring is genuinely the product's center of gravity, and the polish shows up in onboarding. Pricing has been rearranged recently enough that any figure is a snapshot — check current pricing — and it sits at the premium end.

Proton Pass for teams is the privacy-first newcomer to business tiers: open-source apps, Swiss jurisdiction, sharing and roles filling in fast. The honest read: newer to this market than anyone above, with a shorter enterprise track record. If the org already standardized on Proton, consolidation is its own argument.

NordPass Business is the simple one, which is a feature when half the team ignores anything complicated: XChaCha20 encryption, audited apps, and the SOC 2 and ISO 27001 paperwork in its business materials. Per-seat pricing, straightforward sharing, few decisions to get wrong.

Keeper Business is the compliance pick, aimed at regulated industries for years: granular delegation, zero-trust claims, and the certifications auditors ask for by name. Overkill for a five-person studio; right for a firm whose security questionnaire runs forty pages.

Passpack is the team-first veteran and the field's quiet bargain: shared vaults with per-person permissions, one-click handoff that never exposes the underlying password, and a team tier that costs a couple of dollars per user per month, as of late 2026. The interface is dated, the anti-phishing welcome image is older than some of your employees, and the model is sound. The Passpack guide covers the packing key.

Vaultwarden is not a vendor but a door: a community-built server implementing Bitwarden's API, so the official apps work against your own infrastructure. Free software, your hardware, your uptime, your backups. For the organization with a homelab habit or a data-residency rule, it converts the best-value manager into an in-house one. The self-hosting guide covers the adjacent territory.

The SSO tax

A pattern to know before buying: most vendors put SAML and SCIM behind the most expensive tier. 1Password's Starter Pack does not include SSO — you graduate to Business for it. Bitwarden keeps it for Enterprise, above Teams. The pattern is rational — organizations that need SSO have procurement budgets — but it means a ten-person startup can pay a multiple per seat for tidiness.

When do you actually need it? If your team already runs an identity provider — Entra ID, Okta, a managed Google Workspace — and offboarding speed matters, SSO makes revocation instant and audit trails coherent. If your identity story is an admin panel and discipline, the entry tiers carry you further than the tax will cost you. And SSO is not a second factor; the MFA relationship runs the other way, as the guide to MFA factors lays out.

The shared 2FA problem

Team password sharing, the industry has largely solved. Shared 2FA is where it gets sloppy. Teams share logins — the social account, the vendor portal, the single-user admin console — and half of them demand a six-digit code, so the team shares the TOTP seed too, usually by pasting the enrollment QR into a chat and hoping.

The managers handle this two ways. 1Password and Bitwarden let a TOTP field live on a shared item, so everyone with access sees the same rotating code — the best mainstream answer. LastPass generates TOTP on its team tiers. Passpack does not store TOTP at all, which teams solve by keeping codes elsewhere — accidentally landing on the factors-separated arrangement security people recommend.

The honest caveat, from the people who build a 2FA vault: a shared TOTP seed is a shared secret with no attribution. Anyone who has seen it can generate codes forever, and no audit log can say which human typed the code that worked. Where the service allows it, enroll 2FA per person — a TOTP secret is just a string, and most systems will issue separate seeds to separate people.

Our position, stated plainly: 2FA by DependsiT has personal vaults today, and one team sharing one account is an anti-pattern we will not pretend is a feature. What we do offer is the guest generator: paste a Base32 secret, an otpauth link, or a QR image, and see the code with zero setup — nothing stored, nothing sent. It is the right tool for verifying a shared seed still works before a migration, not for running one.

A decision framework

Three variables decide most of it:

• Size. Under ten people: a Starter Pack, Bitwarden Teams, or Passpack's team tier — small fixed costs, no procurement. Ten to a hundred: the per-seat Business tiers, chosen by polish and ecosystem. Beyond that: the enterprise password manager end, where Keeper and Bitwarden Enterprise live.
• Compliance. A regulated firm should weight audit logs, certifications, and SSO. A design studio should weight adoption, because the tool nobody opens is the spreadsheet's best friend.
• Budget and DIY capacity. Bitwarden Teams is the value default; Vaultwarden is free if infrastructure is a strength; the premium tiers buy polish and a support contract.

Whatever lands on the shortlist, run the offboarding test during the trial: add a seat, share something, revoke the seat, read the audit log. The best business password manager is the one whose worst day — a departure, a lockout, a breach scare — you have already rehearsed.

Frequently asked questions

What is the best password manager for a small business?

For value, Bitwarden Teams: open source, audited, priced below the field. For polish, 1Password's Starter Pack, which covers ten users at a flat rate. Passpack is the budget veteran for firms that want sharing without an enterprise platform. The honest answer depends on whether your team will actually adopt the tool — an interface question more than a security one.

How much does a business password manager cost?

Expect per-seat pricing from the low single digits to around ten dollars per user per month, with team tiers at the bottom and SSO-bearing enterprise tiers on top; Vaultwarden is the free self-hosted exception. Prices move often enough that any figure is a snapshot — check current pricing on the vendor's page, and negotiate at renewal, where the discounts live.

How do teams share 2FA codes?

Badly, by default — usually a QR code in a chat thread. The better options: 1Password and Bitwarden store TOTP fields on shared items so everyone sees the same rotating code with an audit trail, and LastPass generates TOTP on its team tiers. Wherever the service allows it, enroll 2FA per person instead, because a shared secret has no attribution.

Do we need SSO for our password manager?

Only if you already run an identity provider and need revocation to be instant — that is what SSO buys, plus coherent audit logs. Most vendors gate SAML and SCIM behind their top tier, and a ten-person team usually gets more from disciplined seat removal than from paying the tax. SSO never replaces MFA on the accounts behind it.

Is Vaultwarden safe to run for a team?

Yes, with the usual self-hosting caveats: it is a mature community implementation of Bitwarden's API running the official apps, but you inherit TLS, backups, updates, and the pager. With real ops capacity and a reason to keep data in-house, it is a strong route to the best-value manager at zero license cost. If not, Bitwarden's official plans are the same product with someone else on call.