UNITED STATES EDITIONUS pricing. Source-backed comparisons.
system|compareChoose software with confidence.Cost calculator

US PRODUCT RESEARCH

1Password Business

1Password combines workforce vaults with developer secret access. Business adds directory lifecycle, policies and audit reporting. Service accounts let custom AI agents retrieve credentials under explicit vault and action scopes. Offboarding needs a documented transfer or recovery process before an Employee vault is deleted.

Checked Oct 20, 2026 · 16 official sources · Desk research
Business password management
A GOOD FIT WHEN

US teams managing both employee logins and scoped developer or AI-agent credentials.

  • Separate vault and item permissions
  • SCIM and OIDC identity integration
  • Scoped runtime secrets with service-account attribution
LOOK MORE CLOSELY WHEN

You need employee-vault recovery after permanent deletion or turnkey autonomous agents without development work.

  • Employee vault deletion permanently removes its contents.
  • SSO supports one identity provider and excludes Owners; data export requires disabling SSO for the user.
  • Watchtower freshness depends on an authorised user's sign-in.
  • Agent runtime integration requires implementation; service-account rate/usage allowances still need confirmation.

CATEGORY-SPECIFIC EVIDENCE

Capabilities, controls and depth.

Scores combine core capabilities and workflow depth. Full support earns full points; limited support earns half. Unverified features create a range, and paid-plan requirements are shown in the evidence. How scoring works →

Business password management · 28 features
88–100/100 documented fit
Core capabilities32 / 32 pts10/10 checks with established status
Workflow depth55.5–68 / 68 pts13/18 checks with established status
Showing fewer rows does not change the score.
Business password management · 28 weighted capability checks
Feature / weightSupport, evidence & points
Core capabilityEncrypted business vaultEncrypted business vault. Verify the supported plan and demonstrated workflow.
3.2 points maximum		Supported3.2 / 3.2 pts

Encrypted business vaults and device access.

Official documentation · Oct 20, 2026Source
Core capabilityPassword and passphrase generationPassword and passphrase generation. Verify the supported plan and demonstrated workflow.
3.2 points maximum		Supported3.2 / 3.2 pts

Random-character and memorable-word generation.

Official documentation · Oct 20, 2026Source
Depth checkPasskey storagePasskey storage. Verify the supported plan and demonstrated workflow.
4.8 points maximum
Ask for a demonstration

Demonstrate passkey storage with a restricted test account.

A scenario to run with the supplier; not a completed product test.
Supported4.8 / 4.8 pts

Store/use/share passkeys; export currently requires iOS/Android.

Official documentation · Oct 20, 2026Source
Depth checkAuthenticator-code storageAuthenticator-code storage. Verify the supported plan and demonstrated workflow.
4.8 points maximum
Ask for a demonstration

Demonstrate authenticator-code storage with a restricted test account.

A scenario to run with the supplier; not a completed product test.
Supported4.8 / 4.8 pts

Store TOTP seeds and fill or copy rotating codes.

Official documentation · Oct 20, 2026Source
Core capabilityShared team credentialsShared team credentials. Verify the supported plan and demonstrated workflow.
4 points maximum		Supported4 / 4 pts

Shared vaults with individual and group access.

Official documentation · Oct 20, 2026Source
Core capabilityBrowser and app autofillBrowser and app autofill. Verify the supported plan and demonstrated workflow.
4 points maximum		Supported4 / 4 pts

Browser/app filling of saved credentials.

Official documentation · Oct 20, 2026Source
Depth checkGranular vault permissionsGranular vault permissions. Verify the supported plan and demonstrated workflow.
6 points maximum
Ask for a demonstration

Demonstrate granular vault permissions with a restricted test account.

A scenario to run with the supplier; not a completed product test.
Supported6 / 6 pts

Business separates item rights, vault management and client restrictions.

Official documentation · Oct 20, 2026Source
Depth checkLeaver vault recovery or transferLeaver vault recovery or transfer. Verify the supported plan and demonstrated workflow.
6 points maximum
Ask for a demonstration

Demonstrate leaver vault recovery or transfer with a restricted test account.

A scenario to run with the supplier; not a completed product test.
Supported6 / 6 pts

Recovery plus mailbox access permits pre-deletion transfer; deleted Employee vaults are unrecoverable.

Official documentation · Oct 20, 2026Source
Core capabilityMobile vault accessMobile vault access. Verify the supported plan and demonstrated workflow.
3.2 points maximum		Supported3.2 / 3.2 pts

iOS and Android vault applications.

Official documentation · Oct 20, 2026Source
Core capabilityDesktop vault accessDesktop vault access. Verify the supported plan and demonstrated workflow.
3.2 points maximum		Supported3.2 / 3.2 pts

Windows, macOS and Linux applications.

Official documentation · Oct 20, 2026Source
Depth checkBusiness single sign-onBusiness single sign-on. Verify the supported plan and demonstrated workflow.
4.8 points maximum
Ask for a demonstration

Demonstrate business single sign-on with a restricted test account.

A scenario to run with the supplier; not a completed product test.
Supported4.8 / 4.8 pts

Business OIDC; one IdP, Owners excluded, offline biometric setup required.

Official documentation · Oct 20, 2026Source
Depth checkDirectory provisioningDirectory provisioning. Verify the supported plan and demonstrated workflow.
4.8 points maximum
Ask for a demonstration

Demonstrate directory provisioning with a restricted test account.

A scenario to run with the supplier; not a completed product test.
Supported4.8 / 4.8 pts

Business SCIM provisions/suspends users and groups; recovery-privileged groups excluded.

Official documentation · Oct 20, 2026Source
Core capabilityWeak or exposed credential checksWeak or exposed credential checks. Verify the supported plan and demonstrated workflow.
3.2 points maximum		Supported3.2 / 3.2 pts

Watchtower flags weak/reused/exposed credentials; inaccessible vaults expose issue counts only.

Official documentation · Oct 20, 2026Source
Core capabilityEnforced security policiesEnforced security policies. Verify the supported plan and demonstrated workflow.
3.2 points maximum		Supported3.2 / 3.2 pts

Business enforces MFA, locking, sharing and sign-in restrictions.

Official documentation · Oct 20, 2026Source
Depth checkAdministrative event historyAdministrative event history. Verify the supported plan and demonstrated workflow.
4.8 points maximum
Ask for a demonstration

Demonstrate administrative event history with a restricted test account.

A scenario to run with the supplier; not a completed product test.
Supported4.8 / 4.8 pts

Business audit records attributable changes; 365-day retention.

Official documentation · Oct 20, 2026Source
Depth checkExportable security eventsExportable security events. Verify the supported plan and demonstrated workflow.
4.8 points maximum
Ask for a demonstration

Demonstrate exportable security events with a restricted test account.

A scenario to run with the supplier; not a completed product test.
Supported4.8 / 4.8 pts

Business audit CSV plus Events API/SIEM streaming.

Official documentation · Oct 20, 2026Source
Core capabilityDeveloper secret toolingDeveloper secret tooling. Verify the supported plan and demonstrated workflow.
2.4 points maximum		Supported2.4 / 2.4 pts

CLI, SDKs, SSH/Git signing and development integrations.

Official documentation · Oct 20, 2026Source
Core capabilityRuntime secrets for AI agentsRuntime secrets for AI agents. Verify the supported plan and demonstrated workflow.
2.4 points maximum		Supported2.4 / 2.4 pts

SDK retrieves agent credentials at runtime; custom integration required.

Official documentation · Oct 20, 2026Source
Depth checkRestricted AI-agent credential scopeRestricted AI-agent credential scope. Verify the supported plan and demonstrated workflow.
3.6 points maximum
Ask for a demonstration

Demonstrate restricted ai-agent credential scope with a restricted test account.

A scenario to run with the supplier; not a completed product test.
Supported3.6 / 3.6 pts

Service accounts restrict vaults and permitted operations; up to 100 accounts.

Official documentation · Oct 20, 2026Source
Depth checkAttributable AI-agent access historyAttributable AI-agent access history. Verify the supported plan and demonstrated workflow.
3.6 points maximum
Ask for a demonstration

Demonstrate attributable ai-agent access history with a restricted test account.

A scenario to run with the supplier; not a completed product test.
Supported3.6 / 3.6 pts

Business usage report attributes secret access to service accounts within permitted vaults.

Official documentation · Oct 20, 2026Source
Depth checkGrant emergency access after a waiting periodDemonstrate: Grant emergency access after a waiting period. State the plan, limits and behaviour on failure. Use dummy credentials, never production secrets.
2.5 points maximum
Ask for a demonstration

Demonstrate: Grant emergency access after a waiting period. State the plan, limits and behaviour on failure. Use dummy credentials, never production secrets.

A scenario to run with the supplier; not a completed product test.
Not verified0–2.5 / 2.5 pts

This specific check has not been verified. Missing evidence does not mean the capability is absent. Ask for a demonstration in the proposed plan.

Not verified · Oct 21, 2026Source
Depth checkRecord justified exceptions to credential-risk warningsDemonstrate: Record justified exceptions to credential-risk warnings. State the plan, limits and behaviour on failure. Use dummy credentials, never production secrets.
2.5 points maximum
Ask for a demonstration

Demonstrate: Record justified exceptions to credential-risk warnings. State the plan, limits and behaviour on failure. Use dummy credentials, never production secrets.

A scenario to run with the supplier; not a completed product test.
Not verified0–2.5 / 2.5 pts

This specific check has not been verified. Missing evidence does not mean the capability is absent. Ask for a demonstration in the proposed plan.

Not verified · Oct 21, 2026Source
Depth checkStore encrypted files with vault itemsDemonstrate: Store encrypted files with vault items. State the plan, limits and behaviour on failure. Use dummy credentials, never production secrets.
2.5 points maximum
Ask for a demonstration

Demonstrate: Store encrypted files with vault items. State the plan, limits and behaviour on failure. Use dummy credentials, never production secrets.

A scenario to run with the supplier; not a completed product test.
Supported2.5 / 2.5 pts

Vault items support secure file attachments. Business documents and attachments; administrators can disable storage; size limits apply. Global capability evidence; local plan availability and interface language are not inferred.

Official documentation · Oct 21, 2026Source
Depth checkRestore a previous credential versionDemonstrate: Restore a previous credential version. State the plan, limits and behaviour on failure. Use dummy credentials, never production secrets.
2.5 points maximum
Ask for a demonstration

Demonstrate: Restore a previous credential version. State the plan, limits and behaviour on failure. Use dummy credentials, never production secrets.

A scenario to run with the supplier; not a completed product test.
Supported2.5 / 2.5 pts

Item history restores earlier credential versions. Business vaults; permitted users can restore earlier versions. Global capability evidence; local plan availability and interface language are not inferred.

Official documentation · Oct 21, 2026Source
Depth checkControl item exports and disclose enforcement limitsDemonstrate: Control item exports and disclose enforcement limits. State the plan, limits and behaviour on failure. Use dummy credentials, never production secrets.
2.5 points maximum
Ask for a demonstration

Demonstrate: Control item exports and disclose enforcement limits. State the plan, limits and behaviour on failure. Use dummy credentials, never production secrets.

A scenario to run with the supplier; not a completed product test.
Supported2.5 / 2.5 pts

Export restrictions are client-enforced and have explicit limits. Export controls are client-enforced, not a cryptographic boundary against a hostile authorised reader. Global capability evidence; local plan availability and interface language are not inferred.

Official documentation · Oct 21, 2026Source
Depth checkRevoke an active device session remotelyDemonstrate: Revoke an active device session remotely. State the plan, limits and behaviour on failure. Use dummy credentials, never production secrets.
2.5 points maximum
Ask for a demonstration

Demonstrate: Revoke an active device session remotely. State the plan, limits and behaviour on failure. Use dummy credentials, never production secrets.

A scenario to run with the supplier; not a completed product test.
Not verified0–2.5 / 2.5 pts

This specific check has not been verified. Missing evidence does not mean the capability is absent. Ask for a demonstration in the proposed plan.

Not verified · Oct 21, 2026Source
Depth checkRead the vault securely without network accessDemonstrate: Read the vault securely without network access. State the plan, limits and behaviour on failure. Use dummy credentials, never production secrets.
2.5 points maximum
Ask for a demonstration

Demonstrate: Read the vault securely without network access. State the plan, limits and behaviour on failure. Use dummy credentials, never production secrets.

A scenario to run with the supplier; not a completed product test.
Not verified0–2.5 / 2.5 pts

This specific check has not been verified. Missing evidence does not mean the capability is absent. Ask for a demonstration in the proposed plan.

Not verified · Oct 21, 2026Source
Depth checkRotate managed application passwords automaticallyDemonstrate: Rotate managed application passwords automatically. State the plan, limits and behaviour on failure. Use dummy credentials, never production secrets.
2.5 points maximum
Ask for a demonstration

Demonstrate: Rotate managed application passwords automatically. State the plan, limits and behaviour on failure. Use dummy credentials, never production secrets.

A scenario to run with the supplier; not a completed product test.
Not verified0–2.5 / 2.5 pts

This specific check has not been verified. Missing evidence does not mean the capability is absent. Ask for a demonstration in the proposed plan.

Not verified · Oct 21, 2026Source
Compare in Business password management →

AI CAPABILITY CHECK

What does its AI actually do?

Through an integration

SDKs and service accounts provide scoped runtime secrets to custom agents; this is access infrastructure rather than an included task-performing agent.

Official AI source

Documented capabilities

  • Runtime secret retrieval
  • Vault/action scopes
  • Service-account attribution

Limits to check

  • Agent implementation and external models are separate.
  • Maximum 100 service accounts; rate/usage allowance not established.
  • Secure Agentic Autofill remains early access.

Understand the full price

$8.99/user/month billed annually ($107.88/year); one-user minimum. Teams Starter is a distinct 10-member bundle.

Billing basis: annual. Unit: user/month. Currency: USD.

    Verify current pricing with the vendor

    Integrations and deployment

    • Microsoft Entra ID
    • Okta
    • Google Workspace
    • OneLogin
    • JumpCloud
    • Splunk

    Security claims require the relevant agreement and technical evidence. This is a review of public documentation.

    US buying context

    USD plans and eligible US ACH billing are explicitly documented.

    The evidence record

    Business: separate view/create/edit/archive/delete and manage-vault rights.

    Official evidence

    Passkey export is currently mobile-only.

    Official evidence

    Authenticator codes can accompany shared login records.

    Official evidence

    One OIDC provider; Owners keep independent sign-in.

    Official evidence

    Unlock with SSO must be disabled for account-data export.

    Official evidence

    SCIM creates groups/users and suspends access.

    Official evidence

    Groups with recovery or all-group management rights are excluded.

    Official evidence

    Authorised recovery requires the employee mailbox.

    Official evidence

    Move Employee-vault work items before irreversible deletion.

    Official evidence

    MFA, auto-lock, sign-in limits and firewall policies.

    Official evidence

    Administrative events retained 365 days; CSV export.

    Official evidence

    SDK retrieves runtime secrets without hardcoding.

    Official evidence

    Service-account vault and action boundaries; maximum 100.

    Official evidence

    Usage reports identify service-account item access.

    Official evidence

    Reports show issue counts for vaults the viewer cannot open.

    Official evidence

    Vault reports refresh after user sign-in, at most daily.

    Official evidence

    Secure Agentic Autofill policy is explicitly early access.

    Official evidence

    Source library

    1. USD business pricing and plan comparison
    2. Password and memorable-word generation
    3. Passkey support and export limits
    4. Authenticator workflow
    5. Shared vault permission model
    6. Employee departure and recovery
    7. OIDC single sign-on limitations
    8. SCIM lifecycle and excluded groups
    9. Watchtower and service-account usage reporting
    10. Enforced business and agentic policies
    11. Audit retention and export
    12. Service-account scopes and account limit
    13. Documented runtime AI-agent integration
    14. Detailed capability documentation
    15. Detailed capability documentation
    16. Detailed capability documentation

    Research is based on documentation, not a hands-on performance test. Report a correction.

    EXPLORE THE ALTERNATIVES

    Keep your options open.

    Business password management alternatives · highest documented score first.

    NordPass
    68–100/100 documented fit

    NordPass

    NordPass centralises workforce credentials, passkeys and shared access. Business adds shared folders, while Enterprise extends identity provisioning and security integrations. Folder permissions inherit from the top level. Departing-user transfers have documented limits that should be tested before relying on them.

    Good fit forCompanies consolidating employee passwords with managed onboarding and offboarding.
    See pricinguser/month
    View research

    Plans and feature boundaries

    The feature score covers the product across documented plans. This table shows package differences; it does not claim that every scored feature is included in the starting price.

    PlanPublished priceDocumented inclusionsLimits and conditions
    Teams Starter Pack
    Plan source ↗    		USD 24.95
    Annual commitment / prepayment · Confirm billing unit in source
    • Shared vaults
    • Developer tools
    • 5 limited-access guests
    		Per team/month for 10 members ($299.40/year); up to 10 extra seats at $4.99 each/month.
    Business
    Plan source ↗    		USD 8.99
    Annual commitment / prepayment · Confirm billing unit in source
    • Directory integrations
    • Advanced vault administration
    • Business reporting
    		Per user/month; one-user minimum; 20 limited-access guests.

    Your privacy choices

    Optional Google Analytics runs only with your permission. Your saved shortlist stays in this browser.

    Read the privacy policy