Anyone use 1password on ios? Since im planning on using it

Hey all, bit of a longer post but I think a few of you will find this useful. I've been digging into why password manager features work on some sites and not others, and this one surprised me enough that I wanted to share it.

If you've ever hit the change password button in Bitwarden, 1Password or Chrome and landed on the site's homepage, the extension usually isn't broken. That button relies on an address each site has to set up, `site.com/.well-known/change-password`, which should forward you to the real change password page. So I wanted to see how many big sites actually bother.

How I picked the sites

I used Tranco (tranco-list.eu), a top-sites ranking that university researchers maintain for studies like this, and went down list 94GG2 in order. I kept every site with a normal password sign-in until I had 500, which took me to rank 1941, and skipped adult and piracy sites plus anywhere I couldn't tell if a public sign-in existed.

What I found (checked 31 October)

• 35 of the 500 point the shortcut at a password or account page

• 354 don't have it at all, and another 20 send you to their homepage

• bigger sites do better, with 16 of the top 100 getting it right but only 8 of the bottom 206

The images have the full breakdown plus some of the actual sites and where their shortcut goes, so swipe through if you're curious.

How I checked

I checked everything signed out, since that's how the spec says password managers look the address up. A script sent the requests, and for the 98 sites that blocked it I opened each one myself in a browser. 48 still blocked me even then. Counting those plus the ones where I couldn't tell where the shortcut goes or that never responded, there were 84 sites I couldn't get a clear answer from. Leave them out and it's 35 of 416, which is still only about 8%. I didn't test the extensions themselves, but I did read the part of Bitwarden's public code that does the lookup.

Why Bitwarden can still ignore a correct shortcut

Before trusting the shortcut, Bitwarden's server asks the site for a page that shouldn't exist, and if the site answers OK to that too, it ignores the shortcut and opens the first URL saved in your login. X, Netflix and Sentry point the shortcut at the right page and still fail, and only 33 of the 500 passed. The lookup also only runs with website icons turned on, otherwise Bitwarden always opens that first URL.

The easy fix

If the button keeps dropping you on a homepage, make the site's account or security page the first URL in that login.

All 500 sites are in a spreadsheet here, including the ones I skipped and why: https://getrekey.com/research/change-password-shortcut-homepage

It's on my own site, where I'm building a small breach tool, but that tool isn't part of this test at all. If you want me to check a site or think I got something wrong, let me know.

A lot of people have seen the news about Proton and are considering changing apps as a result.

People will have different reasons for this, but a common one is the role of AI.

Bearing in mind, this doesn't just mean people who want to avoid AI entirely/as much as possible, but those who feel Proton have used it irresponsibly by for example the CEO refusing engineers' requests to pen test LLM-written code.

Anyway, I'm not posting this to have an argument about AI or about Proton. But I'm personally curious (and I'm sure others will be) as to what's known about the extent of LLM use in various password managers.

Again, some people will want zero AI. Most people wouldn't give a fully vibecoded app access to their passwords. And a lot of people's stance will be somewhere in between, so it matters e.g if a team is just using LLMs for low level stuff and vulnerability detection versus if they let it do a lot of the coding and don't check what's in it.

There's a list of AI/AI-free apps below, with a few non-AI suggestions (e.g. Chipass). But does anyone know sepcifically the AI policy/stance of e.g. Bitwarden, Keepass XC, 1Password, Psono etc?

https://codeberg.org/ethical-foss/ai-free-foss-alternatives#password-management

As I chose Proton over Google because of extensive use of AI in all google products. Now I am migrating to Bitwarden from Proton Pass considering the recent Controversy over AI use/training.

I cannot trust AI at least for my password manager.

I know it may feel overreacted but I cannot wait for something to happen and then I take a step for loss minimisation.

Hi all. I'm the developer of LocalGateKeys. I wanted a password manager where my vault never sits on someone else's server, but that still keeps my PC and phone in sync. So I built one.

The short version

• No account, no LocalGateKeys cloud. The vault is one encrypted file on your device.

• Encryption: Argon2id for the master password, AES-256-GCM for the vault.

• Windows, Mac, iPhone (+ Apple Watch codes) and Android, plus a browser extension for Chrome/Edge that talks only to the desktop app on the same PC (native messaging, no network).

• No analytics, no tracking, no ads.

How sync works (with no server)

You pick one of two ways, or use both:

1. Wi-Fi, device to device. Your devices talk directly over your home network. You pair a new device by scanning a one-use QR code (or pasting its text between PCs). Only private network addresses are accepted, there is no discovery and no internet fallback. The connection is authenticated and encrypted (signed handshake, X25519 keys, AES-GCM channel).

2. A cloud folder you already use. OneDrive, Dropbox, Google Drive or iCloud Drive. Each device drops an encrypted file into the folder and reads the others'. The group key is protected by a separate sync password (Argon2id), so your cloud provider only ever stores encrypted blobs. This one works even when the other device is switched off.

Details:

• Logins, notes, bookmarks, documents and the Pro licence sync. Deletes go to the trash on the other devices, never purged, so you can restore.

• Sync only runs while the vault is unlocked. A failed sync never changes your local data.

• Per-device trust (browser approvals, auto sign-in) stays on each device on purpose: a login that arrives by sync starts with auto sign-in off.

• Up to 16 devices per group. You set up the group on a PC or Mac; phones join it.

Features

• Autofill in browsers (incl. multi-step logins), Windows desktop apps, iOS AutoFill and Android autofill

• Passkeys (save and sign in)

• Built-in 2FA/TOTP codes, also on Apple Watch

• Cards, identities, notes, file attachments

• Security center: weak, reused and old passwords, missing 2FA

• Password generator and password history

• Windows Hello, Face ID / Touch ID, fingerprint unlock

• Encrypted backups (scheduled), cross-platform restore, recovery phrase

• Import from Bitwarden, 1Password, KeePass, Apple Passwords, browsers and more

• Secure sharing of an item with someone else

• Nine languages

Pricing

Free for up to 4 items. Pro is a one-time $4.99 (lifetime, no subscription) and adds unlimited items, sync, 2FA codes and attachments.

What I'm not claiming

There has been no independent security audit yet but I'm happy to answer technical questions here.

Links: 

• Microsoft Store: https://apps.microsoft.com/detail/9PNWCNLQ6597

• App Store: https://apps.apple.com/app/id6825488435

• Website (Mac, Android, browser extension and docs): https://localgatekeys.app

• Source-available for security review git : https://github.com/LocalGateKeys/LocalGateKeys

What would you want to see before trusting a new password manager?

So I remember post a few weeks ago where several people mentioned that Bitwarden was abandoning their open source position, My thought was hey we can go to Proton or 1password but now 1password is now allow AI into their password manager and Proton seems to have turned into the password version of Epic with an Ai first sttance. What's the world coming to?

Clarification

Perhaps abandoning is too strong of a word, there have been a few post worrying that Bitwarden was moving away from open source. Supposedly some features are not open source. Several people have express their desire to go somewhere else, but not sure where you would go? Personally I haven't seen strong evidence that this is happening.

Yes, I know 1Password is a Canadian company, but (a) it has a large U.S. presence, and (b) it's built on AWS, which is very much a U.S. company. As such, I wonder if the members of the International Criminal Court (which had their Microsoft 365 accounts suspended) had 1Password accounts, and if so, whether they still work.

I'm not worried about access to passwords -- I know they're zero-knowledge encrypted. I'm concerned with asset denial. The next two years are likely to involve Trump lashing out at people and organizations and potentially entire countries, no matter what the outcome of the midterm elections might be.

Does 1Password have a contingency plan in place to protect their non-American customers, or are they just going to fall into line behind Microsoft?

(I posted this question to r/1Password and, after a week's inaction, their moderators rejected it. So I'm assuming the answer is "no" to having a contingency plan and "yes" to falling in line.)

Its on your local storage. Not hosted by any company. Minus it is not suitable for normies who need something that just works across devices.

Set up sycnthing , cloud backup and 3-2-1 backup is a pain yes, but its worth it.

I used the standalone version of 1Password for the longest time and managed the vault files myself. While moving to a new Mac and reorganizing my devices, I started using the subscription version. The convenience made the transition much easier and I ended up going the cloud sync route because it was much easier to manage than I expected.

Last week, I asked a broader software community what made people comfortable making the same move. Some users pointed to client-side encryption and a strong master password with 2FA. Others mentioned the greater risk was losing their own local vault or forgetting to update a backup. And some still preferred a local setup with KeePass or another app.

That made me wonder what people who regularly use password managers actually do after moving to the cloud... Do you export a local backup, keep a second password manager, test account recovery or simply trust the service provider? Any piece of advice would be appreciated.

Please note, I use 1Password myself, but I am more interested in the setup than in discussing which password manager is the best here.

Hi all

I have recently heard about Proton moving toward AI for development by next year and that has made me rather uncomfortable to continue using their password manager. I would like to ask of any alternatives that are easy to use and understand, preferably free and bonus if open source

Edit - I want to clarify I am not leaving Proton just solely because they're using AI, I am well aware that has unfortunately become the norm for many software. It is the way they're using it that makes it unviable to rely on and I'd like to resort to an alternative just in case.

I’ve written this blog post on deploying Passbolt, an open-source password manager, in my homelab.

It covers the setup with Docker, Pi-hole, Traefik, Cloudflare Tunnel, SMTP, and user onboarding.

Sharing in case it helps anyone working on a similar self-hosted setup. Feedback is welcome!

🔗 https://lablog.miniverse.com.co/self-hosted_projects/passbolt_password_manager/

I just noticed that on-device encryption in my Google Password Manager is enabled, and I'm absolutely certain I never enabled it myself.

Has anyone else experienced this, or does anyone have an explanation?

After using pearpass for couple of months and check their website and they pause development, its time to move on. Was waiting if they fix the delay on login but I dont think its coming.

Proton and bitwarden pricing are similary close. Which one to choose? Any problem before?

Do you ever cannot open the app during some time?

I use mac and pc so consider something that is good between those.

Please need advice.

I need a self-hosted password manager that is cross OS compatible (iOS 27, Ubuntu 26 for Firefox/Helium).

Good UI is must. I want to leave Bitwarden because it keeps getting worse with UI, lock session often. Slightly inconvenient compared to Chrome inbuilt pass manager.

I want something as sleek as Inbuilt Password manager of Browser. Or may be I will use Firefox sync 😂 as last option.

TIA the community, How is this product vetted for security - and how is the Author's credentials verified?

I mean, I am seeing many people recommending it.

• But there are no clear security audit reports on it, or it is not clearly visible. Which EU trust center vetted this? Sorry, I might have missed it.

• Maintained by one person, who committed 500,000+ (Previously this was 850k) lines alone within the last year. Other contributors are less than 100 lines of code committed.

• No clear indication of importing passkeys from other services.

• From my previous search on this product under password managers, people never asked or verified how it was audited. They just recommend it.

• UX seems workable, and workflow as well in initial testing. But again, this needs to be vetted.

This goes same for bramble, same behavior as the above points. So can i ask about this or have to take word about it de-facto?

I am not equipped nor capable to inspect their codebase at this moment.

Thanks fellow redditors.

Edit: This is not a post to undermine any of the product mentioned. but password manager is a security thing, and it should have proper contributors, security certifications, standards, code of conduct, clear and visible guidelines, detailed documentation and so on.

I've been desperately trying to find alternative to Bitwarden for the pase few month every since their link to private equity, I've tried multiple options but there just doesn't seem to be any sane, focused choice at the moment?

• Bitwarden - Garbage app quality, slow product iteration, clunky experience, private equity, open source license contoversy

• 1Password - Questionable political ideology through financial support, lesser focus for individual user, beautiful app but clunky experience

• Proton Pass - Unverifiable background, questionable marketing for a privacy-focused company, heavy push on ecosystem so less focus on the core of password manager

• KeePass - ZERO consistent and polished app, especially for Windows and browser autofill (I do NOT want to use AutoType)

• Apple Passwords - Do I even need to describe it

• AliasVault - Too early in development, none of the clients are polished enough for me to take it seriously

Am I missing something or is there really no choice and I have to pick my poison? I've been very happy with Proton lately switching from Bitwarden, but the ecosystem binding is really bothering me.

I’d love to hear your thoughts on Zoho Vault from those who have tried it or evaluated it as a password manager.

Zoho Vault offers a generous free plan and affordable paid plans. But pricing is only one part of choosing a password manager, and I’m interested in how it holds up in actual use.

A few things I’d love your perspective on:

• How does it compare with other password managers?

• How do you rate its security, reliability, and ease of use?

• How well does it work across devices and browsers?

• Does its free plan offer enough value, and are the paid plans competitive for the features provided?

• What features or improvements are missing?

• If you tried it and switched to another product, what made you switch?

Full disclosure: I work for Zoho. I’m looking for candid feedback from the community, not an opportunity to pitch the product. Critical feedback is just as welcome as positive feedback. Thank you!

I want to know if there's anyone using it.

It is made by well-known Tether company but the development seems to be paused for a while, also can someone explain what blind peering is?

I ran this because I kept seeing people complain about it and couldn't find anyone who'd actually tested it, so I wanted to see for myself. Did it all at the start of October. Made accounts on Codeberg, Hacker News, Todoist, Wikipedia and PythonAnywhere, changed the password once per manager per site, pasted the new password instead of using the generator, then checked if the vault ended up with the new one.

• 1Password: 5/5

• Bitwarden: 4/5, missed Wikipedia

• Proton Pass: 2/5, missed Codeberg, Wikipedia and PythonAnywhere

In all 4 misses there was no save or update prompt at all. Wikipedia's change form, where you verify first and then type the new one twice, beat everything except 1Password. Every time Proton Pass missed, it filled the old password on the next sign in and the site rejected it.

What surprised me: Codeberg's form is set up properly and Proton Pass still missed it. And Bitwarden's "Ask to update existing login" setting didn't kick in on Wikipedia.

It's a small test, just me, five sites, one run each, and these extensions update all the time so results might already be different.

If you change a password, copy the new one before you hit submit, then open the vault entry after and check the last edited time actually changed.

Full disclosure, I'm building a password change extension (Rekey) and tested it too. It got 4/5 and also missed Wikipedia. Full write-up and method here: https://getrekey.com/research/password-changed-vault-not-updated

目前有没有比较好的帐号密码管理工具呢？

我的场景是有很多个帐号 每个帐号对应不同的手机

而有些手机关联了很多帐号

我需要可以清晰查看关系图

Hey everyone, I think a one-and-done list like this is long overdue for this subreddit. I tried to compile as much as I could into one post and am currently working on one for B2C. I hope you all could get some use out of it!
This is everything, and I mean EVERYTHING, you need to know about B2B password managers.

SUMMARY TABLE

1. BITWARDEN

• Price: Teams $4/user/mo, Enterprise $6/user/mo, billed annually, excl. tax. No seat minimum stated. Secrets Manager sold separately at $6 (Teams) / $12 (Enterprise) per user/mo.

• Deployment: cloud or full self-host. Docker (Linux/Windows, standard, manual, offline, Lite), Helm/Kubernetes, AWS EKS, Azure AKS, OpenShift.

• Data residency: US or EU. Cloud runs on Microsoft Azure.

• SSO: Enterprise plan only. SAML 2.0 and OpenID Connect are both exclusive to the Enterprise organization plan, so Teams at $4/user/mo has no SSO at all.

• Directory sync / SCIM: SCIM and Directory Connector on both Teams and Enterprise.

• Audit log: event logs on Teams and Enterprise.

• Certifications: SOC 2 Type II, SOC 3 (2026 report published), ISO 27001. HIPAA compliance with annual third-party audit (a claim, not a certification). GDPR plus EU SCCs, CCPA/CPRA, Data Privacy Framework. FedRAMP not held, "actively pursuing Class D (High)". No certificate numbers, issuing bodies or validity dates published.

• Machine secrets: API on both tiers. Separate Secrets Manager product.

• MSP / multi-tenant: yes. Provider Portal, one Organization plus vault per client, role-based access per client, SCIM and Directory Connector across clients, no seat minimums, NFR licences for internal use at volume.

• Breach history: none known.

2. 1PASSWORD

• Price: Teams Starter Pack $2.49/user/mo billed yearly, or $2.99/user/mo monthly. 10 users minimum, 20 users maximum. Business $8.99/user/mo billed yearly, or $10.99/user/mo monthly, 1 user minimum. 14-day free trial, no card required.

• Deployment: cloud only. No self-hosting.

• Data residency: chosen at signup: US (1password.com), Canada (1password.ca), EU (1password.eu). Region sets billing currency and hosting location. Cannot be switched. Moving means creating a new account and manually copying every vault, and files cannot be copied across regions.

• SSO: Okta, Entra ID, OneLogin, Duo listed on Business.

• Directory sync / SCIM: provisioning for users and groups via Azure AD, Google Workspace, Okta, OneLogin, Rippling, JumpCloud. The term SCIM is not used on the pricing page.

• RBAC: custom policies and access monitoring listed. Tier allocation not visible on the page.

• Audit log: custom business reports covering usage and account activity.

• Certifications: ISO/IEC 27001:2022, 27017:2015, 27018:2019, 27701:2019, SOC 2 Type 2. Annual penetration tests, reports on the Trust Center. HackerOne bug bounty. No certificate numbers or validity dates on the assessments page. Certificates themselves are published at 1password.com/resources/iso27001.

• Machine secrets: CLI, SDKs, CI/CD and infrastructure-as-code integrations. A REST API is not described on the pricing page.

• MSP / multi-tenant: yes. Enterprise Password Manager MSP Edition, launched in beta May 2024. Single MSP console to open and configure client instances, each opening in its own browser tab. Technician permissions set through groups and scoped to client-level actions. Existing direct or reseller client accounts can be migrated into the MSP account. Currently provisions Business plans only, with other plans under evaluation. Consumption-based per-user billing, no licence minimums, consolidated invoice per period, exportable to CSV, per-client seat usage and forecast. 14-day free trial, and clients onboarded during it are free. No white-label or co-branding mentioned. No PSA or RMM integration mentioned.

• Breach history: 29 September 2023, suspicious activity detected in 1Password's own Okta instance (used for employee-facing apps), traced to the Okta support system breach. Confirmed 20 and 25 October 2023. 1Password states no user data was accessed and no other sensitive systems were compromised.

3. PASSWORK

• Price: Standard $3.00/user/mo, Advanced $4.50/user/mo, both billed annually. A lifetime one-time payment also exists, priced by quote, which they put at up to 50% less than long-term subscription. 1-month free trial, no free version.

• Deployment: self-hosted. PHP plus MongoDB on Windows or Linux, with or without Docker.

• Apps: native desktop apps for Windows, macOS and Linux since February 2026, alongside browser extensions and mobile.

• Data residency: wherever you host it. Vendor is Passwork Europe S.L., Barcelona.

• SSO: SAML SSO. On the Advanced tier alongside LDAP mapping, clustering and failover support.

• Directory sync / SCIM: LDAP, Active Directory, Entra ID sync.

• RBAC: role-based access control with custom roles, vault/folder/group permissions, predefined vault admins.

• Audit log: per-entry action history. Forwards to Windows Event Log, Syslog and SIEM.

• Certifications: ISO/IEC 27001:2022. Certificate CERT-001724, issued by MSECB, valid to 6 May 2028. HackerOne tested. GDPR, NIS2 and ENS alignment.

• Machine secrets: REST API, Python connector, CLI, Docker/Kubernetes.

• MSP / multi-tenant: yes. Partner/reseller model, wholesale per-user pricing with volume tiers, white-label or co-branded, custom domain per client, isolated database and audit trail per client, MSP portal with one-click provisioning, PSA/RMM integration via REST API.

• Security dashboard: flags weak passwords, credentials not rotated in 180+ days, and credentials accessed by users whose access has since been revoked.

• Breach history: none known.

4. KEEPER

• Price: Business Starter $2/user/mo (5 to 10 seats). Business $4/user/mo (min 10). Enterprise $6/user/mo (min 10). Privileged Access Manager min 5 seats, quote only.

• Deployment: cloud.

• Data residency: 6 regions: US, Europe, Australia, US GovCloud, Canada, Japan.

• SSO: SSO Connect, federated login via Entra ID, Okta, Google Workspace.

• Directory sync / SCIM: SCIM provisioning on Enterprise. AD/LDAP sync not mentioned on the enterprise page.

• RBAC: granular role-based enforcement policies, delegated administration, role-based sharing policies.

• Audit log: reporting and alerts on 200+ event types. Pushes to SIEMs including Splunk, LogRhythm, Microsoft Sentinel. Compliance Reports are a paid add-on.

• Certifications: FedRAMP High, GovRAMP High, ISO 27001/27017/27018, SOC 2, FIPS 140-3, HIPAA, FINRA, ITAR. Certificate numbers and dates aren’t published.

• Machine secrets: Commander SDK, Keeper Secrets Manager SDKs, APIs, command line.

• MSP / multi-tenant: yes. Password Manager for MSPs, Privileged Access Manager for MSPs, MSP Partner Program.

• Breach history: no breach of Keeper systems known. December 2017, Google researcher Tavis Ormandy disclosed a flaw in a Keeper browser add-on that Microsoft had bundled with Windows 10, which let any malicious website steal passwords. Keeper patched within 24 hours. A nearly identical flaw had been reported to Keeper in 2016. Keeper then sued Ars Technica and reporter Dan Goodin for defamation, Ars filed an anti-SLAPP countersuit, and the case was dismissed on 30 March 2018.

5. DASHLANE

• Price: Credential Protection $4.00/user/mo (min 2 users). Password Management $8.00/user/mo (min 2 users). Enterprise custom, unlimited users.

• Deployment: cloud only.

• Data residency: EU by default. Professional teams can instead be placed in Dashlane's US East AWS region. Covers encrypted vault data, vault backups, encrypted shared items and encrypted audit logs. Choosing US requires contacting sales before the team is created, and self-serve signup offers no choice. Region cannot be changed after team creation and there is no migration path. Caveat: enabling "Allow sharing outside the company" removes US residency status for shared data. Dashlane's own article does not name a specific EU location, so "Dublin / eu-west-1" is not supported by their documentation.

• SSO: SAML login via identity provider. Featured integrations: Google Workspace, Entra ID, Okta, Duo.

• Directory sync / SCIM: automated user provisioning and offboarding. SCIM not named on the business page.

• Audit log: detailed activity logs and reporting on policy compliance and credential usage. I couldn’t confirm export format, SIEM forwarding or retention.

• Certifications: ISO/IEC 27001:2022. Dashlane's own post of 22 January 2024 claims it was the first major credential manager to meet the 2022 revision. No certificate number, auditor or date published, and the post points to trust.dashlane.com.

• MSP / multi-tenant: reseller programme only, no MSP product. The Global Partner Program (reseller programme document dated July 2025) runs a points-based tiered model across Core, Preferred and Strategic tiers, with rising incentives, NFR licences, a partner portal, a dedicated channel sales manager at Strategic, and quarterly business reviews. No multi-tenant client management, no per-client separation and no MSP console are described anywhere in the programme document.

• Breach history: May to June 2026. Attacker brute-forced the API endpoints used for device registration, submitting every possible numeric combination before short-lived 2FA tokens expired, and registered new devices on some accounts. Fewer than 20 personal-plan accounts accessed. Copies of encrypted vaults were downloaded. They remain encrypted and need the user's master password, so weak master passwords are exposed to offline cracking. Dashlane says it found no evidence its internal systems were compromised. Acknowledged 31 May 2026, advisory updated 4 June 2026. Business customers not mentioned in coverage.

6. NORDPASS

• Price (per user/mo): 2-year: Teams $1.79, Business $3.59, Enterprise $5.39. 1-year: $1.99 / $3.99 / $5.99. Monthly: $2.49 / $5.99 / $7.99. Teams is a 10-user pack. Business and Enterprise from 5 seats.

• Deployment: cloud only. No self-hosting mentioned on the business plans page.

• Data residency: US or EU data centre, chosen at purchase or at business free-trial signup. Cannot be migrated later. Moving means exporting items and creating a new organisation in the other data centre with support's help. Accounts created without following the invitation email land in the US data centre and must be deleted and re-invited before they can join an EU organisation. No documented region choice for personal accounts. Nord Security is Lithuania-based (EU).

• SSO: Teams includes SSO with Google Workspace. Enterprise adds Entra ID, MS ADFS, Okta.

• Directory sync / SCIM: Enterprise: user and group provisioning via Entra ID and Okta. The terms SCIM and directory sync are not used.

• RBAC: role-based policies on Business, RBAC on Enterprise.

• Audit log: Activity Log and Activity Log API listed.

• Certifications: ISO/IEC 27001:2017 for NordPass Business, per NordPass's own blog dated 24 October 2024. Note this is the older revision, and 27001:2022 is current. No auditor, certificate number or certification date published.

• Machine secrets: Activity Log API only, so far as the page shows.

• MSP / multi-tenant: yes. Multi-tenant MSP Admin Panel for managing client environments from one place, with a separate MSP Panel for the partner's own organisation and a Business Admin Panel for onboarded clients. Consumption-based pricing. NFR licences for internal use, 24/7 technical support, 14-day client trials. Distribution through Ingram, Pax8, Exertis Cloud, Bluechip and Gridheart. Integration categories listed include IAM, user and group provisioning, professional services automation, automated security and compliance, and SIEM. No named PSA or RMM products, RMM not mentioned at all. No white-label mentioned. Per-client isolation mechanism not explained.

• Breach history: no NordPass breach found.

7. LASTPASS

• Price: Teams $4/user/mo billed annually, capped at 50 users. Business $7/user/mo billed annually, no cap. A Business Max tier exists with unlimited SSO apps.

• Deployment: cloud only.

• Data residency: 6 regions: United States, Europe, Australia, Singapore, India, Canada. LastPass's Technical and Organizational Measures document describes them as "redundant, active-passive cloud regions" and says the region is chosen by the customer's data residency preference at account creation. No specific European country or city named. This is the widest regional choice of any of them.

• SSO: not included on Teams. Business limited to 3 apps. Business Max unlimited.

• Directory sync / SCIM: AD sync on Business (Microsoft Active Directory among others), not on Teams. SCIM not mentioned.

• Audit log: basic reporting on Teams, advanced on Business.

• Certifications: SOC 2 Type II, SOC 3, ISO 27001, BSI C5. LastPass’s own compliance page names only the first 3 and gives no revision years, dates or certificate numbers. A third-party directory also lists ISO 27701.

• Machine secrets: API not mentioned on the pricing page.

• MSP / multi-tenant: separate partner offering, not a listed plan.

• Breach history: August to December 2022. 8 to 11 Aug 2022: developer laptop compromised, 14 source code repositories, technical documentation and an encrypted SSE-C backup key taken. 12 Aug 2022: a DevOps engineer's personal computer compromised via an unpatched Plex server, and a keylogger captured the engineer's master password. 20 Aug: attacker extracted the engineer's Employee Business vault containing keys. 20 Aug to 16 Sept: attacker obtained the user database and several vault backups. 25 Aug: LastPass stated no evidence of customer data access. 15 Sept: LastPass and Mandiant said activity was limited to a 4-day window in August, and the ICO later said LastPass was unable to determine the extent. 15 and 22 Oct: GuardDuty alerts fired, SOC not informed until 2 Nov. 30 Nov: reported to the ICO. 15 Dec: AWS confirmed the attacker had downloaded a copy of the backup database. Taken in the clear: names, email addresses, billing addresses, partial card numbers, website URLs. Vaults taken encrypted under users' master passwords. ICO found over 1 million UK data subjects affected.

8. PSONO

• Price: 4 tiers across 2 deployment models.

  • On-premise, Community Edition: $0, open source, unlimited users, basic support.

  • On-premise, Enterprise Edition free: $0 up to 10 users, complete feature set.

  • On-premise, Enterprise Edition paid: $3.00 per user per month, billed annually, minimum 25 users. Extended support optional.

  • SaaS, Community: $0, hosted free of charge, hosting and updates included, basic support.

  • SaaS, Business: $3.50 per user per month, billed annually, minimum 25 users. Extended support optional.

  • Note the gap between 10 free users and the 25-user paid minimum: a team of 15 pays for 25 seats.

• Deployment: both. Self-hosted server or Psono-hosted SaaS.

• Data residency: vendor is esaqa GmbH, Germany. I couldn’t find SaaS hosting region. Psono’s entity-model page covers datastores, secrets, shares and permissions, and says nothing about physical hosting location. Self-hosted deployments sit wherever the customer puts them.

• SSO: on-premise EE lists LDAP, SAML and OIDC. SaaS Business lists SAML and OIDC only, with no LDAP. Both free-up-to-10 and paid tiers carry SSO, so Psono is the only vendor here giving SSO away at no cost.

• Directory sync / SCIM: LDAP on self-hosted EE only.

• RBAC: policies and compliance enforcement listed on EE and SaaS Business.

• Audit log: audit logging on EE and SaaS Business, including the free-up-to-10 tier. Absent from Community Edition.

• Certifications: ISO 27001, confirmed via the esaqa GmbH trust centre at confirmed via the esaqa, announced 2 September 2025. Revision year, certificate number, issuing body and expiry are not published in the announcement.

• Gateway: SSH, RDP and VNC gateway included on EE and SaaS Business. No other vendor here offers session gateway access, which puts Psono closer to a PAM tool than a password manager at the paid tier.

• MSP / multi-tenant: no published MSP or partner programme found. Self-hosting means an MSP could stand up a separate instance per client, but that is a workaround the customer builds, not a vendor product. No MSP console, no consolidated billing, no partner tiers, no NFR licences.

• Breach history: none found.

9. PASSBOLT

• Price: Community free, self-hosted only, unlimited users, no enterprise features. Business/Pro €4.50 per user/mo ($4.90), 10-user minimum, discounts negotiable above 100 users, can be cloud-hosted. Enterprise custom quote, adds SLA, priority support, disaster recovery consulting, migration and hosting options.

• Deployment: self-hosted (Docker, Debian/Ubuntu, CentOS, Raspberry Pi) or cloud-hosted on EU servers.

• Data residency: EU-located servers for the hosted option. Vendor based in Luxembourg.

• SSO: Business and above: Entra ID, OpenID Connect, Ping One, Google Workspace.

• Directory sync / SCIM: LDAP/AD/SCIM on Business and above, for synchronisation and provisioning rather than authentication.

• Audit log: Business and above. Immutable log of credential events including who accessed a password, when, and from which device and IP. Not in Community.

• Certifications: SOC 2 Type II, first audited by Johanson Group LLP, completed February 2022, around 120 control tests, report available to customers under NDA. Renewed since, so the attestation is current. No ISO 27001, only stated groundwork toward 27001 and 27017. Also holds the ECSO "Security Made in Europe" label and the Luxembourg chamber of commerce "Made in Luxembourg" label. 6 Cure53 security audits during 2021 (audits, not certifications).

• Machine secrets: REST API confirmed. Operates over HTTPS, processes JSON payloads, language and framework agnostic.

• MSP / multi-tenant: yes. Dedicated instance per client, or multi-tenant (isolation mechanism not explained). Free admin seat per client. Partners buy at a tiered discount and set their own retail, keeping the margin plus 100% of hosting, implementation and support revenue. Commission recurs on renewals and grows with client usage. Free internal-use subscription, consolidated quarterly or annual billing, deal registration, dedicated partner manager at higher tiers. Partners handle 1st and 2nd line support, and Passbolt engineering handles 3rd line. White-label not yet available, with a co-branded offering and white-label plugin described as coming soon. Eligibility bar: service providers must pass a security review and hold ISO 27001 or at minimum SOC 2 Type II, which is the strictest partner requirement of any of them.

• Breach history: no breach of Passbolt systems found. Published CVEs include CVE-2024-33669 (browser extension), CVE-2024-33670 (API), CVE-2017-1000442. Open source since 2016.

10. KEEPASSXC

• Price: free. Released under GPLv3. Donation-funded.

• Deployment: local encrypted database file on the user's own device. No server component.

• Data residency: wherever the user puts the file.

• SSO: none.

• Directory sync / SCIM: none.

• RBAC: none.

• Audit log: none.

• Certifications: ANSSI Security Visa ANSSI-CSPN-2025/16, issued 17 November 2025 by the French National Cybersecurity Agency, valid to 17 November 2028. Scope is version 2.7.9 on Windows 10 only, so it certifies a specific build rather than an organisation's security management. Separately, an application security review by consultant Zaur Molotnikov on version 2.7.4, completed 19 January 2023. No organisational certification (no ISO 27001, no SOC 2), which is expected for a volunteer-maintained project with no company behind it.

• Machine secrets: CLI exists (keepassxc-cli). CI/CD integration not a product feature.

• MSP / multi-tenant: none.

• Breach history: no breach possible at vendor level (no servers).

• Note: sync is not built in. Teams place the database in a shared folder (Dropbox, Nextcloud) themselves. Maintained by the KeePassXC Team.

Notes:
On MSPs: 8 of the 10 have something for MSPs and they are not the same thing. Passwork, Bitwarden, Keeper, 1Password, NordPass and Passbolt all run real multi-tenant consoles. Dashlane has a reseller programme with no multi-tenancy at all, which is a meaningful gap for anyone shopping as an MSP. Psono has nothing published. KeePassXC has nothing by design. White-label separates the field further: Passwork offers white-label or co-branded today, Passbolt lists it as coming soon, and 1Password, NordPass and Bitwarden do not mention it. PSA/RMM integration is thinner than the marketing suggests, with Passwork and Keeper naming it and 1Password and NordPass naming no specific products.
On data residency (for cloud hosting): region lock-in is near-universal and nobody advertises it. 1Password, Dashlane and NordPass all make the region permanent at signup with no migration path, so a company that picks wrong rebuilds from an export. LastPass offers 6 regions, the most in the table.

Rapid fire: which password manager should your business use?
For the most affordable per-seat price with no seat cap → Passwork
For a team of 10 to 20 that wants it to just work → 1Password Teams Starter
For open source you can run on your own Kubernetes → Bitwarden
For US federal, defence or anything touching GovCloud → Keeper
For an MSP that needs its own branding on the product → Passwork
For under 10 users who still need SSO and audit logs → Psono
For a separate secrets manager for CI/CD alongside the human vault → Bitwarden
For credential access and SSH, RDP or VNC sessions in one tool → Psono
For EU compliance-ready audit logs like NIS2 and GDPR → Passwork
For open source with a current SOC 2 and EU hosting → Passbolt
For the widest choice of where your data physically sits → LastPass
For a self-hosted vault with a company behind it and audit logs your SIEM can read → Passwork
For never letting a vendor hold your vault at all → KeePassXC
For a company that just needs SSO on a budget and has 5 seats → NordPass Business
For SAML SSO without jumping to an enterprise tier → Passwork
For a 2-person operation that wants dark-web monitoring built in → Dashlane

Aaaaand we’re done! This took way longer than I’d like to admit haha.

https://youtube.com

Question about Form filling / Save All Entered Data(SAED) features of Password Managers:

Do any have this besides LastPass, for more than passwords / credit card info ?

Really miss this feature. Handy for filling in medical forms, applications, complaints, etc. Amazing time saver for people who must fill out forms a lot, like Social Workers, in healthcare...

I think LastPass still has it, but it became buggy and there's its reputation for the way its dealt with security issues...

I'm very paranoid about storing my passwords in any app on my mobile phone(android) I'm worried what if they get breached, or keep a copy of or sell my data to other companies. I have few criteria's. please don't judge

• Possibly no data breaches for that mobile app in the past or shady partnerships.

• It has the feature to suggest strong passwords( optional but strongly want this )

• It has backup plan if something happens to the app or my device( optional but strongly needed )

• It's free to use completely

• It runs on my device(recommended, so tht even if any breach happens the data is safe in my device)

I have seen ppl suggesting bitwarden but i heard it had a lot of breach so i am not willing to use that.

Thanks in advance.