Best Password Manager for Small Business (2026): Admin Recovery, SSO and Real Per-Seat Costs

Last checked 2026-10-25.

Disclosure: This page currently has no affiliate links. If we add any later, we may earn a commission when you buy through them, at no extra cost to you, and we’ll say so here. Commissions never change the Fine Print boxes or the rankings. Bitwarden says it has no monetary referral program, and it’s still our top pick. How we make money

A password manager ends up holding every login your company has. The bank. Payroll. The client portals. The domain registrar nobody remembers the password for.

So the real questions aren’t about autofill. They’re these: if someone forgets their master password on a Monday morning, can you get them back in? When someone leaves, do their client logins leave with them? Where does the vault actually sit? And what will this cost after year one?

That’s what this guide reads for. Pricing pages, help centers and trust pages first. Feature lists second.

The short answer

Quick comparison

Chips: Yes / Conditional / No / Unknown. “Unknown” means the vendor’s public pages we checked don’t say. We don’t guess. Split into two tables for mobile reading.

Price & plans

List prices, excluding tax, checked 2026-10-25. NordPass: in our EU browser view the official page showed Teams €1.99 / Business €3.99 / Enterprise €5.99 per user/mo (1-year), with a footnote that “Payments are charged in USD.” We haven’t seen the USD figures on NordPass’s own page, so we don’t print them. Confirm at checkout. Proton’s yearly prices carry “60% off” (Essentials) and “36% off” (Professional) labels and no stated renewal price, so we treat them as first-year prices. Sources for every cell are in each product’s Fine Print box and in Sources.

Admin & privacy

Seat math at 5 / 10 / 25 users

Annual list prices only. Promos, tax and add-ons excluded.

1Password Starter Pack covers up to 10 users for one flat price; 11-20 users add $4.99 per extra seat. Proton Pass isn’t in the table because its displayed prices are promo-labeled and the renewal price isn’t published. At the displayed first-year price, 10 users would be $19.90/mo on Essentials or $44.90/mo on Professional. Budget for year two being higher until Proton says otherwise.

How we checked

• Primary sources only: each vendor’s business pricing page, help center, security or trust page, and privacy policy. Every claim carries a link and a check date.
• “Unknown” means the vendor didn’t say publicly on the pages we checked. UNVERIFIED prices stay out of the math.
• What we weighted for small offices, in order: recovery and offboarding plus zero-knowledge encryption, then price per seat (including what happens at renewal), then SSO, SCIM and audit logs, then features.
• Affiliate relationships don’t change scores. Bitwarden pays us nothing and says it has no monetary referral program. It’s ranked first anyway.
• What we didn’t do in this version: set up trial organizations hands-on. This guide is about what you’re agreeing to before you roll it out to the whole office.

The 4 password managers, reviewed

1. Bitwarden: best overall for IT-led small teams

Best for: offices with someone comfortable in an admin console who want open source, low per-seat cost, and user provisioning from day one.
Price: Teams $4/user/mo (annual) / Enterprise $6/user/mo (annual) / custom quote above that. Free individual plan. Enterprise includes a free Families plan for every user. source / checked 2026-10-25

We earn nothing if you pick Bitwarden. It has no monetary referral program. source / checked 2026-10-25

What it does well

• The cheapest business tier here that already includes SCIM and Directory Connector. That’s Teams, at $4. source / checked 2026-10-25
• Zero-knowledge and open source. When you add SSO on Enterprise, Bitwarden says “your Identity Provider cannot and will not have access to the decryption key.” source / checked 2026-10-25
• Event logs on Teams and Enterprise, with API and SIEM access. Data is kept indefinitely; you can view up to 367 days at a time. source / checked 2026-10-25
• US or EU cloud. Enterprise can self-host. source / checked 2026-10-25

Watch-outs

• Admin account recovery is Enterprise only. On Teams, if someone forgets their master password and loses their recovery code, you can’t let them back in. Recovery also doesn’t restore deleted accounts. source / checked 2026-10-25
• SSO is Enterprise only (SAML 2.0 / OIDC). source / checked 2026-10-25
• Region is picked at signup. Moving later means export and import. source / checked 2026-10-25

FINE PRINT / Bitwarden / checked 2026-10-25
Zero-knowledge and open source. SCIM and event logs on Teams, but SSO and admin account recovery need Enterprise.

Field	What we found	Source
Encryption / zero-knowledge	Yes: zero-knowledge encryption; open source. SSO keeps zero-knowledge (IdP has no access to the decryption key)	pricing / SSO
Admin account recovery	Conditional: “available for Enterprise organizations”. Doesn’t restore deleted accounts. Teams users rely on their own recovery codes	doc
Offboarding	Unknown (not documented on pages checked)	—
SSO	Enterprise only: SAML 2.0 / OIDC, JIT	doc
SCIM / provisioning	Yes on Teams and Enterprise (SCIM + Directory Connector)	doc
Audit / event logs	Teams and Enterprise. Retained indefinitely; view up to 367 days at a time. API + SIEM	doc
Sharing model	Unknown (not checked this pass)	—
Where data lives	US or EU cloud, picked at signup; move = export/import. Self-host on Enterprise	doc
Certifications	ISO 27001, SOC 2 Type II, SOC 3. GDPR / CCPA / DPF stated in FAQ. HIPAA: claimed (vendor FAQ) / BAA: Unknown	pricing FAQ
Price: intro vs renewal	Teams $4 / Enterprise $6 per user/mo, annual. Monthly: Unknown. No promo shown	pricing
Free plan / trial	Free individual plan. Free 2-user organization limits: Unknown (not checked)	pricing
AI / agent features	Secrets Manager “AI agent access” exists. Not reviewed in this version	—
Heads-up	None found	—
IT take	On Teams, run a sealed recovery-code process on day 1, because you can’t rescue a locked-out user. If that scares you (it should a little), budget the extra $2 per user per month for Enterprise.	—

Not legal advice. Verify current terms and get a signed DPA/BAA from the vendor before relying on this for compliance.

Try Bitwarden →

2. 1Password: best for teams under 10 who want it to just work

Best for: small offices without a full-time IT person, where the main risk is someone getting locked out.
Price: Teams Starter Pack $24.95/mo flat for up to 10 users (add up to 10 more at $4.99 each; cap 20) / Business $8.99/user/mo annual ($107.88/user/yr; 1-user minimum) / Enterprise: contact sales. 14-day free trial, no card. source / checked 2026-10-25

What it does well

• Admins can recover locked-out users on both Starter Pack and Business. The user gets a new Secret Key and sets a new password; 2FA is reset. This is the one that saves your Monday morning. source / checked 2026-10-25 / source / checked 2026-10-25
• End-to-end AES-256 on all vault data, including URLs and titles. Your password plus a Secret Key both go into the key. source / checked 2026-10-25
• Business adds SSO (Okta, Entra ID, OneLogin, Duo and more) and provisioning (Entra ID, Google Workspace, Okta, OneLogin, Rippling, JumpCloud). source / checked 2026-10-25
• US, Canada or EU region. source / checked 2026-10-25

Watch-outs

• No SSO on Starter Pack. source / checked 2026-10-25
• The audit log is Business only. Starter Pack can start a free trial of the audit log and reports. Custom reports, policy monitoring, usage alerts and SIEM streaming are “Not Included” on Starter Pack. Business keeps 365 days of events; stream to a SIEM for longer. source / checked 2026-10-25
• Starter Pack caps out at 20 users. Past that, you’re on Business.
• Region follows your billing currency, so choose the currency with care. source / checked 2026-10-25
• Older reviews say Business is $7.99. It’s $8.99 now.

FINE PRINT / 1Password / checked 2026-10-25
End-to-end encrypted, including URLs and titles. Admin recovery on both plans. SSO, provisioning and the audit log are Business only. Region follows your billing currency.

Field	What we found	Source
Encryption / zero-knowledge	Yes: AES-256 end-to-end on all vault data incl. URLs and titles; Two-Secret Key Derivation; SRP	pricing
Admin account recovery	Yes on Starter Pack and Business. Admins, owners or a group with “Recover Accounts” start it; user gets a new Secret Key; 2FA reset. Bulk via CLI. Choosing who gets recovery notifications: Business only	pricing / doc (2026-08-03)
Offboarding	Unknown (not documented on pages checked)	—
SSO	Business: “Unlock with SSO” (Okta, Entra ID, OneLogin, Duo and more). No on Starter Pack	pricing
SCIM / provisioning	Business: Entra ID, Google Workspace, Okta, OneLogin, Rippling, JumpCloud	pricing
Audit / event logs	Conditional: Business only, 365 days; SIEM via Events API. Starter Pack: free trial only	audit doc (2026-08-17) / pricing
Sharing model	Unknown (not checked this pass)	—
Where data lives	US (1Password.com), Canada (.ca) or EU (.eu); follows billing currency	doc
Certifications	SOC 2 Type II; third-party audits (both plans). HIPAA: Unknown / BAA: Unknown	pricing
Price: intro vs renewal	Starter Pack $24.95/mo flat; Business $8.99/user/mo annual. Monthly Business: Unknown. No promo shown	pricing
Free plan / trial	14-day trial, no card. Business includes a free Families plan per user	pricing
AI / agent features	“1Password for Agents” exists. Not reviewed in this version	—
Heads-up	None found (incident history not reviewed against a primary source in this version)	—
IT take	Give recovery rights to two people, not one. If you’re on Starter Pack, start the audit-log trial in week one so you see what you’d be missing.	—

Not legal advice. Verify current terms and get a signed DPA/BAA from the vendor before relying on this for compliance.

Start a 1Password free trial →

3. NordPass: good security story, confirm the price at checkout

Best for: teams that want a US or EU data center and a simple Google Workspace SSO on the small-team plan, and don’t mind confirming the final price themselves.
Price: USD list prices: Unknown. In our EU browser view, NordPass’s official page showed Teams €1.99 / Business €3.99 / Enterprise €5.99 per user/mo on 1-year billing, with the footnote “Payments are charged in USD.” Teams is a fixed 10-user pack; Business and Enterprise need at least 5 users. 14-day trial, no card. source / checked 2026-10-25

What it does well

• Zero-knowledge; data is encrypted on your device before it leaves. source / checked 2026-10-25
• You pick a US or EU data center at purchase or trial. source / checked 2026-10-25
• Google Workspace SSO on Teams; Entra ID, MS ADFS and Okta on Enterprise. source / checked 2026-10-25
• ISO 27001, SOC 2 Type 2 and a Cure53 audit. source / checked 2026-10-25

Watch-outs

• We couldn’t verify USD prices on NordPass’s own page. The page renders by region, and the figures we saw were EUR. We’re not printing USD numbers until we’ve seen them there. Check the checkout total.
• No region migration. Picking the wrong data center means exporting and starting a new organization. Accounts in different regions can’t share items. source / checked 2026-10-25
• You can’t downgrade from Business to Teams. source / checked 2026-10-25
• SCIM-style user management (Entra ID, Okta) is Enterprise only. source / checked 2026-10-25

FINE PRINT / NordPass / checked 2026-10-25
Zero-knowledge. US or EU data center chosen at purchase, with no migration. Google SSO on Teams; Entra ID / Okta on Enterprise. USD prices UNVERIFIED.

Field	What we found	Source
Encryption / zero-knowledge	Yes: zero-knowledge; encrypted on device. Algorithm names per whitepaper: not re-verified, so not printed	zero-knowledge
Admin account recovery	Yes (owner-approved recovery when a member loses both Master Password and Recovery Code)	doc
Offboarding	Unknown (not documented on pages checked)	—
SSO	Teams: Google Workspace only. Enterprise: Entra ID, MS ADFS, Okta	plans
SCIM / provisioning	Enterprise: automatic user access management via Entra ID and Okta	plans
Audit / event logs	Teams: user activity monitoring. Business: audit logs. Enterprise: Sentinel / Splunk	plans
Sharing model	Unknown, except: no sharing across US/EU regions	DC FAQ
Where data lives	US or EU, picked at purchase or trial. No migration (export to a new org)	DC FAQ
Certifications	ISO 27001, SOC 2 Type 2, Cure53 audit. HIPAA: Unknown / BAA: Unknown	plans
Price: intro vs renewal	USD: UNVERIFIED. EUR shown in our region (Business €3.99 1-yr / €5.99 monthly); “Payments are charged in USD”. Renewal: Unknown on the official page. A 20%-off code shown during our check is a promo, not list price	plans
Free plan / trial	14-day business trial, no card; 14-day refund	plans
Heads-up	No Business-to-Teams downgrade	plans
IT take	Decide US vs EU before you click “start trial”, because the trial already sets the region. Screenshot the checkout total, including the renewal line, before you pay.	—

Not legal advice. Verify current terms and get a signed DPA/BAA from the vendor before relying on this for compliance.

Start a NordPass free trial →

4. Proton Pass: best for EU and privacy-first offices

Best for: offices whose clients ask “where is it stored?” first, and who want admin recovery without paying for an enterprise tier.
Price: Pass Essentials $1.99/user/mo (3-30 users; billed $23.88/yr) / Pass Professional $4.49/user/mo (3+ users; billed $53.88/yr). Both yearly prices carry discount labels (“60% off” / “36% off”). Renewal price: Unknown. 14-day trial; 30-day money-back. source / checked 2026-10-25

What it does well

• Account recovery is “Included” on all business plans, including Essentials. source / checked 2026-10-25
• End-to-end encrypted and open source. source / checked 2026-10-25
• Servers are “exclusively located in Switzerland, Germany or Norway” (Pass privacy policy). source / checked 2026-10-25
• SSO (SAML; Okta, Entra ID, OneLogin, Google) and SCIM from Professional. source / checked 2026-10-25
• ISO 27001 and SOC 2 Type II, stated at company level on Proton’s Business Trust Center. source / checked 2026-10-25

Watch-outs

• Renewal price isn’t published. Proton’s terms say a renewal is charged at “the then-current price valid at the time of the renewal.” Plan for year two costing more. source / checked 2026-10-25
• Activity log, usage reporting and SIEM start at Professional. Essentials doesn’t list them. source / checked 2026-10-25
• Certifications are company-wide; the Trust Center doesn’t give a Pass-specific scope.
• HIPAA is claimed on the pricing table. Proton publishes a model BAA and signs one on request, but whether it covers Pass is Unknown. source / checked 2026-10-25

FINE PRINT / Proton Pass / checked 2026-10-25
End-to-end encrypted and open source. Servers in Switzerland, Germany or Norway. Admin recovery on every plan; SSO and SCIM from Professional. Renewal price Unknown.

Field	What we found	Source
Encryption / zero-knowledge	Yes: E2EE; open source	pricing
Admin account recovery	Yes: “Account recovery: Included” on all 4 business plans	pricing
Offboarding	Unknown (not documented on pages checked)	—
SSO	Professional and up: SAML (Okta, Entra ID, OneLogin, Google)	doc
SCIM / provisioning	Professional and up: SCIM for Okta / Entra ID	doc
Audit / event logs	Activity log + usage reporting on Professional and up; SIEM on Professional. Essentials: not listed	pricing
Sharing model	Unknown (not checked this pass)	—
Where data lives	Switzerland, Germany or Norway (privacy policy, modified 2025-07-31). Region choice: Unknown	policy
Certifications	ISO 27001 + SOC 2 Type II (company-level; Pass scope not stated). HIPAA: claimed on pricing table / BAA: Conditional (model BAA published; signed on request via privacy@support.proton.me; Pass coverage Unknown)	trust / BAA
Price: intro vs renewal	Essentials $1.99 / Professional $4.49 per user/mo yearly, promo-labeled. Monthly: Unknown. Renewal: Unknown; ToS: “then-current price”	pricing / terms
Free plan / trial	14-day trial; 30-day money-back	pricing
Heads-up	Year-two price not published	terms
IT take	If you need logs or SSO, skip Essentials and go straight to Professional. Put a calendar reminder 30 days before renewal to check the new price.	—

Not legal advice. Verify current terms and get a signed DPA/BAA from the vendor before relying on this for compliance.

Start a Proton Pass free trial →

Day-1 rollout checklist for a 5-50 person office

The first week decides whether people trust the vault or quietly go back to the spreadsheet. This is the order we’d do it in.

1. Pick the data region before you sign up. Bitwarden and NordPass set it at signup or trial, and NordPass can’t migrate. 1Password follows billing currency.
2. Sort out recovery before anyone needs it. If your plan has admin recovery (1Password, Proton Pass, NordPass, Bitwarden Enterprise), give it to two trusted people. If it doesn’t (Bitwarden Teams), collect recovery codes in a sealed, written process.
3. Require two-factor for everyone. Follow your vendor’s own help docs for how.
4. Build shared vaults or collections by team. Client logins go in shared spaces, not personal vaults, so they don’t leave when a person does.
5. Write the offboarding runbook now. Remove the user, then rotate every shared credential they could see. None of the four vendors documented the “what the admin keeps” part on the pages we checked, so test it in your trial.
6. Connect SSO or SCIM if your plan has it. Check that zero-knowledge is kept (Bitwarden states it is).
7. Do an export test. Make sure you can get your data out before you put everything in.

Which one should you pick?

“We’re under 10 people and nobody here is ‘the IT person’.”
1Password Teams Starter Pack. Flat price, and an admin can rescue a locked-out colleague. → Start a 1Password free trial

“Someone here is IT-minded, and we want open source and the cheapest SCIM.”
Bitwarden Teams at $4. Know that recovery and SSO need Enterprise. → Try Bitwarden

“We use Okta or Entra ID and want SSO without enterprise pricing.”
1Password Business ($8.99), or Proton Pass Professional (first-year $4.49; renewal Unknown). → 1Password / Proton Pass

“Our EU clients ask where the data lives.”
Proton Pass (Switzerland, Germany, Norway), or the EU region on Bitwarden, NordPass or 1Password. Choose it at signup. → Proton Pass / Bitwarden

“Our biggest fear is someone getting locked out.”
Look at the admin recovery column, not the logo. 1Password and Proton Pass include it on their small-team plans. Bitwarden only on Enterprise.

FAQ

What’s the best password manager for a small business?

For IT-led teams, Bitwarden: $4/user/mo on Teams with SCIM and event logs, open source, and no monetary referral program. For offices under 10 people without IT staff, 1Password Teams Starter Pack at $24.95/mo flat, because admins can recover locked-out users.

Can an admin recover a locked-out employee’s vault?

Depends on the plan. 1Password: yes on Starter Pack and Business. Proton Pass: yes on all business plans. NordPass: owner-approved recovery when a member loses both Master Password and Recovery Code. Bitwarden: Enterprise only; Teams users rely on their own recovery codes.

Which password managers include SSO below Enterprise?

1Password Business ($8.99), Proton Pass Professional, and NordPass Teams (Google Workspace only). Bitwarden SSO is Enterprise only. For a 10-person team, SSO is nice to have; two-factor and a solid offboarding process cover most of the risk.

Can the password manager company see my passwords?

All four say no. Bitwarden, 1Password, NordPass and Proton Pass each describe zero-knowledge or end-to-end encryption, and Bitwarden and Proton Pass are open source. That’s the vendor’s statement; we didn’t audit the code.

Where is my vault stored, and can I choose the EU?

Bitwarden: US or EU, picked at signup. 1Password: US, Canada or EU, following your billing currency. NordPass: US or EU, picked at purchase, no migration. Proton Pass: Switzerland, Germany or Norway.

What happens to the price after the first year?

Bitwarden and 1Password show list prices with no promo labels. Proton Pass shows discount labels and doesn’t publish a renewal price; its terms say you pay “the then-current price.” NordPass’s official page didn’t show renewal wording in our check. Read the checkout page before you pay.

Is Bitwarden good enough for business?

Yes, for most small offices. Teams includes SCIM and event logs, and it holds ISO 27001, SOC 2 Type II and SOC 3. The two gaps are admin account recovery and SSO, which need Enterprise at $6/user/mo.

1Password vs NordPass for business: which is cheaper for 10 users?

1Password Teams Starter Pack is $24.95/mo flat for up to 10 users. We can’t give you a verified NordPass USD figure yet: its official page showed EUR in our region (Business €3.99/user/mo on 1-year billing) and charges in USD. A full head-to-head is coming in our Bitwarden vs 1Password vs NordPass comparison.

What should I do when an employee leaves?

Remove them from the organization, then change every shared password they had access to. Keep client logins in shared vaults so nothing important lives only in a personal vault. If you have SCIM, removing them in your directory removes them here too.

Is a free password manager OK for a business?

For a solo freelancer, maybe. For a team, the business plans add the parts that protect you when people leave or forget things: shared vaults, admin controls, logs and, on some plans, recovery. Bitwarden Teams starts at $4/user/mo.

Sources

All checked 2026-10-25 unless noted.

Bitwarden: business pricing & FAQ / account recovery / about SSO / about SCIM / event logs / server geographies / blog: no monetary referral program
1Password: business pricing / account recovery (published 2026-08-03) / audit log (published 2026-08-17) / regions
NordPass: business plans & FAQ / zero-knowledge architecture / account recovery for business users / multiple data centers FAQ
Proton Pass: business pricing / SSO & SCIM setup / Pass privacy policy (modified 2025-07-31) / Business Trust Center / model BAA (modified 2026-07-17) / terms of service (modified 2026-10-09)

Not legal advice. Verify current terms and get a signed DPA/BAA from the vendor before relying on this for compliance.

---

Related: Best AI meeting note-takers for small business / Bitwarden vs 1Password vs NordPass (coming soon)