Let your sign-in setup narrow the list. If you run Microsoft Entra ID, Okta or Google Workspace and want new hires added and leavers removed automatically, look first at 1Password Business, Dashlane and RoboForm, which include SSO and SCIM on their main business plan, or at Bitwarden, Keeper and Proton Pass on their higher tiers. If shared vaults at the lowest cost matter most, Bitwarden Teams, Keeper Business Starter, NordPass and Proton Pass Essentials all cost $4 or less per user a month on annual plans. Passbolt and self-hosted Bitwarden suit companies that must keep credentials on their own servers, Keeper fits FedRAMP requirements, and Enpass keeps vaults inside your Microsoft 365 or Google Workspace tenant. Whatever you choose, require a long master password and multi-factor authentication on every account, decide how admins will recover locked-out users before rollout, and move shared logins out of spreadsheets and chat threads in the first week.
What do NIST’s current password rules require?
NIST’s Digital Identity Guidelines (SP 800-63B-4), finalized in July 2025, say a password used as the only sign-in factor must be at least 15 characters long, or at least 8 when it is paired with multi-factor authentication, and that systems should accept passwords of 64 characters or more. They tell services to stop demanding mixes of uppercase letters, numbers and symbols, to stop forcing periodic password changes and require a change only when there is evidence of compromise, and to screen new passwords against lists of common and breached passwords. A password manager makes those rules painless, because nobody has to remember the long, unique passwords it creates.
Should passkeys go in the company password manager?
Usually, yes. The FIDO Alliance describes passkeys as sign-in credentials built on a pair of cryptographic keys: the website stores only a public key and the private key stays with the user, so there is no shared secret for attackers to phish or steal from a server. Passkeys can sync across devices or stay tied to one device, and most of the tools in this ranking can store them next to passwords. Keeping them in the company vault, rather than in an employee’s personal phone account, puts them under the same access controls as the rest of the company’s logins.
What happened in the LastPass breach, and what does it mean for buyers?
In August 2022 an attacker broke into a LastPass developer account, used what was taken to target another employee, and then copied a backup of customer vault data along with customers’ names, email addresses, phone numbers, billing addresses and IP addresses. Usernames, passwords and secure notes in the vaults were encrypted, but the website addresses saved with them were not. In December 2025 the UK Information Commissioner’s Office fined LastPass £1.2 million, noting there was no evidence that customer passwords had been decrypted. Because a stolen vault can be attacked offline, the lesson for buyers is to enforce long master passwords and multi-factor authentication and to ask each vendor which data it leaves unencrypted.
