UNITED STATES EDITIONUS pricing. Source-backed comparisons.
system|compareChoose software with confidence.Cost calculator

US BUYER’S GUIDE · 2 PRODUCTS

Business password management

Can employees use business credentials while administrators control onboarding, sharing and departure?

Compare workforce vaults, controlled sharing, identity integration and auditable access.

Research desk · Oct 20, 2026 · Methodology

YOUR SHORTLIST STARTS HERE

Compare the options.

Highest documented score first. Fit adds up the 28 feature checks below, including AI, across documented plans. Entry price does not include every capability. Unknown evidence appears as a range.

Product / good fit forPricing contextDocumented fitNext step
1Password Business

1Password Business

US teams managing both employee logins and scoped developer or AI-agent credentials.

$8.99user/month · billed annuallyBusiness
88–100/100 documented fit
88% evidence coverage		Full research →
NordPass

NordPass

Companies consolidating employee passwords with managed onboarding and offboarding.

See pricinguser/monthBusiness
68–100/100 documented fit
68% evidence coverage		Full research →

BEYOND A FEATURE CHECKMARK

How deep does the capability go?

Choose up to 3 for a closer look →

28 weighted checks: core capabilities contribute 32 points and workflow depth contributes 68. AI is included at the weight shown for this category. Expand Evidence for scope and sources, or ask for the same demonstration from each supplier.

Showing fewer rows does not change the score.
Business password management features for all 2 products
Feature / base weight1Password Business
88–100/100 documented fit
Core capabilities32 / 32 pts10/10 checks with established status
Workflow depth55.5–68 / 68 pts13/18 checks with established status
NordPass
68–100/100 documented fit
Core capabilities27.2–32 / 32 pts8/10 checks with established status
Workflow depth40.8–68 / 68 pts8/18 checks with established status
Core capabilityEncrypted business vault3.2 points · Encrypted business vault. Verify the supported plan and demonstrated workflow.Supported3.2 / 3.2 pts
Evidence

Encrypted business vaults and device access.

Official documentation · Oct 20, 2026Source
Supported3.2 / 3.2 pts
Evidence

Encrypted business vault.

Official documentation · Oct 20, 2026Source
Core capabilityPassword and passphrase generation3.2 points · Password and passphrase generation. Verify the supported plan and demonstrated workflow.Supported3.2 / 3.2 pts
Evidence

Random-character and memorable-word generation.

Official documentation · Oct 20, 2026Source
Supported3.2 / 3.2 pts
Evidence

Password generation.

Official documentation · Oct 20, 2026Source
Depth checkPasskey storage4.8 points · Passkey storage. Verify the supported plan and demonstrated workflow.
Ask for a demonstration

Demonstrate passkey storage with a restricted test account.

A scenario to run with the supplier; not a completed product test.
Supported4.8 / 4.8 pts
Evidence

Store/use/share passkeys; export currently requires iOS/Android.

Official documentation · Oct 20, 2026Source
Supported4.8 / 4.8 pts
Evidence

Stored passkeys.

Official documentation · Oct 20, 2026Source
Depth checkAuthenticator-code storage4.8 points · Authenticator-code storage. Verify the supported plan and demonstrated workflow.
Ask for a demonstration

Demonstrate authenticator-code storage with a restricted test account.

A scenario to run with the supplier; not a completed product test.
Supported4.8 / 4.8 pts
Evidence

Store TOTP seeds and fill or copy rotating codes.

Official documentation · Oct 20, 2026Source
Supported4.8 / 4.8 pts
Evidence

Built-in authenticator codes.

Official documentation · Oct 20, 2026Source
Core capabilityShared team credentials4 points · Shared team credentials. Verify the supported plan and demonstrated workflow.Supported4 / 4 pts
Evidence

Shared vaults with individual and group access.

Official documentation · Oct 20, 2026Source
Supported4 / 4 pts
Evidence

Business shared folders.

Official documentation · Oct 20, 2026Source
Core capabilityBrowser and app autofill4 points · Browser and app autofill. Verify the supported plan and demonstrated workflow.Supported4 / 4 pts
Evidence

Browser/app filling of saved credentials.

Official documentation · Oct 20, 2026Source
Supported4 / 4 pts
Evidence

Browser/app autofill.

Official documentation · Oct 20, 2026Source
Depth checkGranular vault permissions6 points · Granular vault permissions. Verify the supported plan and demonstrated workflow.
Ask for a demonstration

Demonstrate granular vault permissions with a restricted test account.

A scenario to run with the supplier; not a completed product test.
Supported6 / 6 pts
Evidence

Business separates item rights, vault management and client restrictions.

Official documentation · Oct 20, 2026Source
Supported6 / 6 pts
Evidence

Folder permission levels; inherited below top level.

Official documentation · Oct 20, 2026Source
Depth checkLeaver vault recovery or transfer6 points · Leaver vault recovery or transfer. Verify the supported plan and demonstrated workflow.
Ask for a demonstration

Demonstrate leaver vault recovery or transfer with a restricted test account.

A scenario to run with the supplier; not a completed product test.
Supported6 / 6 pts
Evidence

Recovery plus mailbox access permits pre-deletion transfer; deleted Employee vaults are unrecoverable.

Official documentation · Oct 20, 2026Source
Supported6 / 6 pts
Evidence

Owner transfer; unavailable over 2,100 items.

Official documentation · Oct 20, 2026Source
Core capabilityMobile vault access3.2 points · Mobile vault access. Verify the supported plan and demonstrated workflow.Supported3.2 / 3.2 pts
Evidence

iOS and Android vault applications.

Official documentation · Oct 20, 2026Source
Supported3.2 / 3.2 pts
Evidence

iOS/Android access.

Official documentation · Oct 20, 2026Source
Core capabilityDesktop vault access3.2 points · Desktop vault access. Verify the supported plan and demonstrated workflow.Supported3.2 / 3.2 pts
Evidence

Windows, macOS and Linux applications.

Official documentation · Oct 20, 2026Source
Supported3.2 / 3.2 pts
Evidence

Desktop applications.

Official documentation · Oct 20, 2026Source
Depth checkBusiness single sign-on4.8 points · Business single sign-on. Verify the supported plan and demonstrated workflow.
Ask for a demonstration

Demonstrate business single sign-on with a restricted test account.

A scenario to run with the supplier; not a completed product test.
Supported4.8 / 4.8 pts
Evidence

Business OIDC; one IdP, Owners excluded, offline biometric setup required.

Official documentation · Oct 20, 2026Source
Supported4.8 / 4.8 pts
Evidence

Enterprise Entra/Okta/AD FS; tier matters.

Official documentation · Oct 20, 2026Source
Depth checkDirectory provisioning4.8 points · Directory provisioning. Verify the supported plan and demonstrated workflow.
Ask for a demonstration

Demonstrate directory provisioning with a restricted test account.

A scenario to run with the supplier; not a completed product test.
Supported4.8 / 4.8 pts
Evidence

Business SCIM provisions/suspends users and groups; recovery-privileged groups excluded.

Official documentation · Oct 20, 2026Source
Supported4.8 / 4.8 pts
Evidence

Enterprise SCIM: Entra ID/Okta user/group lifecycle.

Official documentation · Oct 20, 2026Source
Core capabilityWeak or exposed credential checks3.2 points · Weak or exposed credential checks. Verify the supported plan and demonstrated workflow.Supported3.2 / 3.2 pts
Evidence

Watchtower flags weak/reused/exposed credentials; inaccessible vaults expose issue counts only.

Official documentation · Oct 20, 2026Source
Supported3.2 / 3.2 pts
Evidence

Business password health and breach checks.

Official documentation · Oct 20, 2026Source
Core capabilityEnforced security policies3.2 points · Enforced security policies. Verify the supported plan and demonstrated workflow.Supported3.2 / 3.2 pts
Evidence

Business enforces MFA, locking, sharing and sign-in restrictions.

Official documentation · Oct 20, 2026Source
Supported3.2 / 3.2 pts
Evidence

Password and MFA policies.

Official documentation · Oct 20, 2026Source
Depth checkAdministrative event history4.8 points · Administrative event history. Verify the supported plan and demonstrated workflow.
Ask for a demonstration

Demonstrate administrative event history with a restricted test account.

A scenario to run with the supplier; not a completed product test.
Supported4.8 / 4.8 pts
Evidence

Business audit records attributable changes; 365-day retention.

Official documentation · Oct 20, 2026Source
Supported4.8 / 4.8 pts
Evidence

Administrative activity history.

Official documentation · Oct 20, 2026Source
Depth checkExportable security events4.8 points · Exportable security events. Verify the supported plan and demonstrated workflow.
Ask for a demonstration

Demonstrate exportable security events with a restricted test account.

A scenario to run with the supplier; not a completed product test.
Supported4.8 / 4.8 pts
Evidence

Business audit CSV plus Events API/SIEM streaming.

Official documentation · Oct 20, 2026Source
Supported4.8 / 4.8 pts
Evidence

Enterprise Activity Log API.

Official documentation · Oct 20, 2026Source
Core capabilityDeveloper secret tooling2.4 points · Developer secret tooling. Verify the supported plan and demonstrated workflow.Supported2.4 / 2.4 pts
Evidence

CLI, SDKs, SSH/Git signing and development integrations.

Official documentation · Oct 20, 2026Source
Not verified0–2.4 / 2.4 pts
Evidence

Not established in the reviewed documentation.

Not verified · Oct 20, 2026Source
Core capabilityRuntime secrets for AI agents2.4 points · Runtime secrets for AI agents. Verify the supported plan and demonstrated workflow.Supported2.4 / 2.4 pts
Evidence

SDK retrieves agent credentials at runtime; custom integration required.

Official documentation · Oct 20, 2026Source
Not verified0–2.4 / 2.4 pts
Evidence

Not established in the reviewed documentation.

Not verified · Oct 20, 2026Source
Depth checkRestricted AI-agent credential scope3.6 points · Restricted AI-agent credential scope. Verify the supported plan and demonstrated workflow.
Ask for a demonstration

Demonstrate restricted ai-agent credential scope with a restricted test account.

A scenario to run with the supplier; not a completed product test.
Supported3.6 / 3.6 pts
Evidence

Service accounts restrict vaults and permitted operations; up to 100 accounts.

Official documentation · Oct 20, 2026Source
Not verified0–3.6 / 3.6 pts
Evidence

Not established in the reviewed documentation.

Not verified · Oct 20, 2026Source
Depth checkAttributable AI-agent access history3.6 points · Attributable AI-agent access history. Verify the supported plan and demonstrated workflow.
Ask for a demonstration

Demonstrate attributable ai-agent access history with a restricted test account.

A scenario to run with the supplier; not a completed product test.
Supported3.6 / 3.6 pts
Evidence

Business usage report attributes secret access to service accounts within permitted vaults.

Official documentation · Oct 20, 2026Source
Not verified0–3.6 / 3.6 pts
Evidence

Not established in the reviewed documentation.

Not verified · Oct 20, 2026Source
Depth checkGrant emergency access after a waiting period2.5 points · Demonstrate: Grant emergency access after a waiting period. State the plan, limits and behaviour on failure. Use dummy credentials, never production secrets.
Ask for a demonstration

Demonstrate: Grant emergency access after a waiting period. State the plan, limits and behaviour on failure. Use dummy credentials, never production secrets.

A scenario to run with the supplier; not a completed product test.
Not verified0–2.5 / 2.5 pts
Evidence

This specific check has not been verified. Missing evidence does not mean the capability is absent. Ask for a demonstration in the proposed plan.

Not verified · Oct 21, 2026Source
Not verified0–2.5 / 2.5 pts
Evidence

This specific check has not been verified. Missing evidence does not mean the capability is absent. Ask for a demonstration in the proposed plan.

Not verified · Oct 21, 2026Source
Depth checkRecord justified exceptions to credential-risk warnings2.5 points · Demonstrate: Record justified exceptions to credential-risk warnings. State the plan, limits and behaviour on failure. Use dummy credentials, never production secrets.
Ask for a demonstration

Demonstrate: Record justified exceptions to credential-risk warnings. State the plan, limits and behaviour on failure. Use dummy credentials, never production secrets.

A scenario to run with the supplier; not a completed product test.
Not verified0–2.5 / 2.5 pts
Evidence

This specific check has not been verified. Missing evidence does not mean the capability is absent. Ask for a demonstration in the proposed plan.

Not verified · Oct 21, 2026Source
Not verified0–2.5 / 2.5 pts
Evidence

This specific check has not been verified. Missing evidence does not mean the capability is absent. Ask for a demonstration in the proposed plan.

Not verified · Oct 21, 2026Source
Depth checkStore encrypted files with vault items2.5 points · Demonstrate: Store encrypted files with vault items. State the plan, limits and behaviour on failure. Use dummy credentials, never production secrets.
Ask for a demonstration

Demonstrate: Store encrypted files with vault items. State the plan, limits and behaviour on failure. Use dummy credentials, never production secrets.

A scenario to run with the supplier; not a completed product test.
Supported2.5 / 2.5 pts
Evidence

Vault items support secure file attachments. Business documents and attachments; administrators can disable storage; size limits apply. Global capability evidence; local plan availability and interface language are not inferred.

Official documentation · Oct 21, 2026Source
Not verified0–2.5 / 2.5 pts
Evidence

This specific check has not been verified. Missing evidence does not mean the capability is absent. Ask for a demonstration in the proposed plan.

Not verified · Oct 21, 2026Source
Depth checkRestore a previous credential version2.5 points · Demonstrate: Restore a previous credential version. State the plan, limits and behaviour on failure. Use dummy credentials, never production secrets.
Ask for a demonstration

Demonstrate: Restore a previous credential version. State the plan, limits and behaviour on failure. Use dummy credentials, never production secrets.

A scenario to run with the supplier; not a completed product test.
Supported2.5 / 2.5 pts
Evidence

Item history restores earlier credential versions. Business vaults; permitted users can restore earlier versions. Global capability evidence; local plan availability and interface language are not inferred.

Official documentation · Oct 21, 2026Source
Not verified0–2.5 / 2.5 pts
Evidence

This specific check has not been verified. Missing evidence does not mean the capability is absent. Ask for a demonstration in the proposed plan.

Not verified · Oct 21, 2026Source
Depth checkControl item exports and disclose enforcement limits2.5 points · Demonstrate: Control item exports and disclose enforcement limits. State the plan, limits and behaviour on failure. Use dummy credentials, never production secrets.
Ask for a demonstration

Demonstrate: Control item exports and disclose enforcement limits. State the plan, limits and behaviour on failure. Use dummy credentials, never production secrets.

A scenario to run with the supplier; not a completed product test.
Supported2.5 / 2.5 pts
Evidence

Export restrictions are client-enforced and have explicit limits. Export controls are client-enforced, not a cryptographic boundary against a hostile authorised reader. Global capability evidence; local plan availability and interface language are not inferred.

Official documentation · Oct 21, 2026Source
Not verified0–2.5 / 2.5 pts
Evidence

This specific check has not been verified. Missing evidence does not mean the capability is absent. Ask for a demonstration in the proposed plan.

Not verified · Oct 21, 2026Source
Depth checkRevoke an active device session remotely2.5 points · Demonstrate: Revoke an active device session remotely. State the plan, limits and behaviour on failure. Use dummy credentials, never production secrets.
Ask for a demonstration

Demonstrate: Revoke an active device session remotely. State the plan, limits and behaviour on failure. Use dummy credentials, never production secrets.

A scenario to run with the supplier; not a completed product test.
Not verified0–2.5 / 2.5 pts
Evidence

This specific check has not been verified. Missing evidence does not mean the capability is absent. Ask for a demonstration in the proposed plan.

Not verified · Oct 21, 2026Source
Not verified0–2.5 / 2.5 pts
Evidence

This specific check has not been verified. Missing evidence does not mean the capability is absent. Ask for a demonstration in the proposed plan.

Not verified · Oct 21, 2026Source
Depth checkRead the vault securely without network access2.5 points · Demonstrate: Read the vault securely without network access. State the plan, limits and behaviour on failure. Use dummy credentials, never production secrets.
Ask for a demonstration

Demonstrate: Read the vault securely without network access. State the plan, limits and behaviour on failure. Use dummy credentials, never production secrets.

A scenario to run with the supplier; not a completed product test.
Not verified0–2.5 / 2.5 pts
Evidence

This specific check has not been verified. Missing evidence does not mean the capability is absent. Ask for a demonstration in the proposed plan.

Not verified · Oct 21, 2026Source
Not verified0–2.5 / 2.5 pts
Evidence

This specific check has not been verified. Missing evidence does not mean the capability is absent. Ask for a demonstration in the proposed plan.

Not verified · Oct 21, 2026Source
Depth checkRotate managed application passwords automatically2.5 points · Demonstrate: Rotate managed application passwords automatically. State the plan, limits and behaviour on failure. Use dummy credentials, never production secrets.
Ask for a demonstration

Demonstrate: Rotate managed application passwords automatically. State the plan, limits and behaviour on failure. Use dummy credentials, never production secrets.

A scenario to run with the supplier; not a completed product test.
Not verified0–2.5 / 2.5 pts
Evidence

This specific check has not been verified. Missing evidence does not mean the capability is absent. Ask for a demonstration in the proposed plan.

Not verified · Oct 21, 2026Source
Not verified0–2.5 / 2.5 pts
Evidence

This specific check has not been verified. Missing evidence does not mean the capability is absent. Ask for a demonstration in the proposed plan.

Not verified · Oct 21, 2026Source

WHAT WE MEASURE

The criteria behind the score.

The established 20 checks contribute 80 points. Eight new operational checks contribute 20 points. AI checks are included in their own group and are excluded when AI priority is set to zero. These assess documented capability scope, not measured performance. Adjust group priorities in the comparison tool.

See the complete calculation →
  1. Credential coverage 16%

    Store modern sign-in methods alongside generated passwords.

  2. Controlled use and handover 20%

    Share work access without losing ownership on departure.

  3. Devices and identity lifecycle 16%

    Reach employees and connect access to the business directory.

  4. Security oversight 16%

    Apply policies and retain independent evidence of access changes.

  5. Developer and AI-agent access 12%

    Agent readiness requires supported secret retrieval, narrow scope and attribution.

  6. Operational detail 20%

    Specific workflow, integration and control checks beyond the established rubric.

THE PRACTICAL BUYER’S GUIDE

How to choose business password management.

Workforce password vaults differ from developer secret managers. The AI section checks agent runtime access, restricted scope and attribution; ordinary autofill is not sufficient.

Selection question 1

Test access removal and ownership transfer with a departing user.

Selection question 2

Verify what a shared-folder viewer can reveal or copy.

Selection question 3

Export a real administrative event before selecting the audit tier.

What changes the total cost?

  • Minimum seats and subscription term
  • SSO, provisioning and audit tier
  • Data-region and deployment requirements

Where purchases go wrong

  • Nested folders may inherit broader permissions.
  • Recovery does not guarantee selective ownership transfer.
  • A business vault is not automatically an AI-agent secret broker.

Bring these questions to the demo

  • Demonstrate passkey storage with a restricted test account.
  • Demonstrate authenticator-code storage with a restricted test account.
  • Demonstrate granular vault permissions with a restricted test account.
  • Demonstrate leaver vault recovery or transfer with a restricted test account.
  • Demonstrate business single sign-on with a restricted test account.
  • Demonstrate directory provisioning with a restricted test account.
  • Demonstrate administrative event history with a restricted test account.
  • Demonstrate exportable security events with a restricted test account.
  • Demonstrate restricted ai-agent credential scope with a restricted test account.
  • Demonstrate attributable ai-agent access history with a restricted test account.

Questions buyers ask

Are passkeys and passwords the same comparison?

Both can be managed in a workforce vault, but supported platforms and transfer paths differ.

What should an offboarding test include?

Remove sign-in access, inspect shared-item permissions and transfer the business records that must remain.

Why assess AI here?

Agents need narrowly scoped credentials and attributable access. Those controls must be documented separately.

Research sources

  1. NordPass sharing model
  2. NordPass offboarding

Your privacy choices

Optional Google Analytics runs only with your permission. Your saved shortlist stays in this browser.

Read the privacy policy