I ran this because I kept seeing people complain about it and couldn't find anyone who'd actually tested it, so I wanted to see for myself. Did it all at the start of October. Made accounts on Codeberg, Hacker News, Todoist, Wikipedia and PythonAnywhere, changed the password once per manager per site, pasted the new password instead of using the generator, then checked if the vault ended up with the new one.

• 1Password: 5/5
• Bitwarden: 4/5, missed Wikipedia
• Proton Pass: 2/5, missed Codeberg, Wikipedia and PythonAnywhere

In all 4 misses there was no save or update prompt at all. Wikipedia's change form, where you verify first and then type the new one twice, beat everything except 1Password. Every time Proton Pass missed, it filled the old password on the next sign in and the site rejected it.

What surprised me: Codeberg's form is set up properly and Proton Pass still missed it. And Bitwarden's "Ask to update existing login" setting didn't kick in on Wikipedia.

It's a small test, just me, five sites, one run each, and these extensions update all the time so results might already be different.

If you change a password, copy the new one before you hit submit, then open the vault entry after and check the last edited time actually changed.

Full disclosure, I'm building a password change extension (Rekey) and tested it too. It got 4/5 and also missed Wikipedia. Full write-up and method here: https://getrekey.com/research/password-changed-vault-not-updated

Hey everyone, I think a one-and-done list like this is long overdue for this subreddit. I tried to compile as much as I could into one post and am currently working on one for B2C. I hope you all could get some use out of it!
This is everything, and I mean EVERYTHING, you need to know about B2B password managers.

SUMMARY TABLE

1. BITWARDEN

• Price: Teams $4/user/mo, Enterprise $6/user/mo, billed annually, excl. tax. No seat minimum stated. Secrets Manager sold separately at $6 (Teams) / $12 (Enterprise) per user/mo.
• Deployment: cloud or full self-host. Docker (Linux/Windows, standard, manual, offline, Lite), Helm/Kubernetes, AWS EKS, Azure AKS, OpenShift.
• Data residency: US or EU. Cloud runs on Microsoft Azure.
• SSO: Enterprise plan only. SAML 2.0 and OpenID Connect are both exclusive to the Enterprise organization plan, so Teams at $4/user/mo has no SSO at all.
• Directory sync / SCIM: SCIM and Directory Connector on both Teams and Enterprise.
• Audit log: event logs on Teams and Enterprise.
• Certifications: SOC 2 Type II, SOC 3 (2026 report published), ISO 27001. HIPAA compliance with annual third-party audit (a claim, not a certification). GDPR plus EU SCCs, CCPA/CPRA, Data Privacy Framework. FedRAMP not held, "actively pursuing Class D (High)". No certificate numbers, issuing bodies or validity dates published.
• Machine secrets: API on both tiers. Separate Secrets Manager product.
• MSP / multi-tenant: yes. Provider Portal, one Organization plus vault per client, role-based access per client, SCIM and Directory Connector across clients, no seat minimums, NFR licences for internal use at volume.
• Breach history: none known.

2. 1PASSWORD

• Price: Teams Starter Pack $2.49/user/mo billed yearly, or $2.99/user/mo monthly. 10 users minimum, 20 users maximum. Business $8.99/user/mo billed yearly, or $10.99/user/mo monthly, 1 user minimum. 14-day free trial, no card required.
• Deployment: cloud only. No self-hosting.
• Data residency: chosen at signup: US (1password.com), Canada (1password.ca), EU (1password.eu). Region sets billing currency and hosting location. Cannot be switched. Moving means creating a new account and manually copying every vault, and files cannot be copied across regions.
• SSO: Okta, Entra ID, OneLogin, Duo listed on Business.
• Directory sync / SCIM: provisioning for users and groups via Azure AD, Google Workspace, Okta, OneLogin, Rippling, JumpCloud. The term SCIM is not used on the pricing page.
• RBAC: custom policies and access monitoring listed. Tier allocation not visible on the page.
• Audit log: custom business reports covering usage and account activity.
• Certifications: ISO/IEC 27001:2022, 27017:2015, 27018:2019, 27701:2019, SOC 2 Type 2. Annual penetration tests, reports on the Trust Center. HackerOne bug bounty. No certificate numbers or validity dates on the assessments page. Certificates themselves are published at 1password.com/resources/iso27001.
• Machine secrets: CLI, SDKs, CI/CD and infrastructure-as-code integrations. A REST API is not described on the pricing page.
• MSP / multi-tenant: yes. Enterprise Password Manager MSP Edition, launched in beta May 2024. Single MSP console to open and configure client instances, each opening in its own browser tab. Technician permissions set through groups and scoped to client-level actions. Existing direct or reseller client accounts can be migrated into the MSP account. Currently provisions Business plans only, with other plans under evaluation. Consumption-based per-user billing, no licence minimums, consolidated invoice per period, exportable to CSV, per-client seat usage and forecast. 14-day free trial, and clients onboarded during it are free. No white-label or co-branding mentioned. No PSA or RMM integration mentioned.
• Breach history: 29 September 2023, suspicious activity detected in 1Password's own Okta instance (used for employee-facing apps), traced to the Okta support system breach. Confirmed 20 and 25 October 2023. 1Password states no user data was accessed and no other sensitive systems were compromised.

3. PASSWORK

• Price: Standard $3.00/user/mo, Advanced $4.50/user/mo, both billed annually. A lifetime one-time payment also exists, priced by quote, which they put at up to 50% less than long-term subscription. 1-month free trial, no free version.
• Deployment: self-hosted. PHP plus MongoDB on Windows or Linux, with or without Docker.
• Apps: native desktop apps for Windows, macOS and Linux since February 2026, alongside browser extensions and mobile.
• Data residency: wherever you host it. Vendor is Passwork Europe S.L., Barcelona.
• SSO: SAML SSO. On the Advanced tier alongside LDAP mapping, clustering and failover support.
• Directory sync / SCIM: LDAP, Active Directory, Entra ID sync.
• RBAC: role-based access control with custom roles, vault/folder/group permissions, predefined vault admins.
• Audit log: per-entry action history. Forwards to Windows Event Log, Syslog and SIEM.
• Certifications: ISO/IEC 27001:2022. Certificate CERT-001724, issued by MSECB, valid to 6 May 2028. HackerOne tested. GDPR, NIS2 and ENS alignment.
• Machine secrets: REST API, Python connector, CLI, Docker/Kubernetes.
• MSP / multi-tenant: yes. Partner/reseller model, wholesale per-user pricing with volume tiers, white-label or co-branded, custom domain per client, isolated database and audit trail per client, MSP portal with one-click provisioning, PSA/RMM integration via REST API.
• Security dashboard: flags weak passwords, credentials not rotated in 180+ days, and credentials accessed by users whose access has since been revoked.
• Breach history: none known.

4. KEEPER

• Price: Business Starter $2/user/mo (5 to 10 seats). Business $4/user/mo (min 10). Enterprise $6/user/mo (min 10). Privileged Access Manager min 5 seats, quote only.
• Deployment: cloud.
• Data residency: 6 regions: US, Europe, Australia, US GovCloud, Canada, Japan.
• SSO: SSO Connect, federated login via Entra ID, Okta, Google Workspace.
• Directory sync / SCIM: SCIM provisioning on Enterprise. AD/LDAP sync not mentioned on the enterprise page.
• RBAC: granular role-based enforcement policies, delegated administration, role-based sharing policies.
• Audit log: reporting and alerts on 200+ event types. Pushes to SIEMs including Splunk, LogRhythm, Microsoft Sentinel. Compliance Reports are a paid add-on.
• Certifications: FedRAMP High, GovRAMP High, ISO 27001/27017/27018, SOC 2, FIPS 140-3, HIPAA, FINRA, ITAR. Certificate numbers and dates aren’t published.
• Machine secrets: Commander SDK, Keeper Secrets Manager SDKs, APIs, command line.
• MSP / multi-tenant: yes. Password Manager for MSPs, Privileged Access Manager for MSPs, MSP Partner Program.
• Breach history: no breach of Keeper systems known. December 2017, Google researcher Tavis Ormandy disclosed a flaw in a Keeper browser add-on that Microsoft had bundled with Windows 10, which let any malicious website steal passwords. Keeper patched within 24 hours. A nearly identical flaw had been reported to Keeper in 2016. Keeper then sued Ars Technica and reporter Dan Goodin for defamation, Ars filed an anti-SLAPP countersuit, and the case was dismissed on 30 March 2018.

5. DASHLANE

• Price: Credential Protection $4.00/user/mo (min 2 users). Password Management $8.00/user/mo (min 2 users). Enterprise custom, unlimited users.
• Deployment: cloud only.
• Data residency: EU by default. Professional teams can instead be placed in Dashlane's US East AWS region. Covers encrypted vault data, vault backups, encrypted shared items and encrypted audit logs. Choosing US requires contacting sales before the team is created, and self-serve signup offers no choice. Region cannot be changed after team creation and there is no migration path. Caveat: enabling "Allow sharing outside the company" removes US residency status for shared data. Dashlane's own article does not name a specific EU location, so "Dublin / eu-west-1" is not supported by their documentation.
• SSO: SAML login via identity provider. Featured integrations: Google Workspace, Entra ID, Okta, Duo.
• Directory sync / SCIM: automated user provisioning and offboarding. SCIM not named on the business page.
• Audit log: detailed activity logs and reporting on policy compliance and credential usage. I couldn’t confirm export format, SIEM forwarding or retention.
• Certifications: ISO/IEC 27001:2022. Dashlane's own post of 22 January 2024 claims it was the first major credential manager to meet the 2022 revision. No certificate number, auditor or date published, and the post points to trust.dashlane.com.
• MSP / multi-tenant: reseller programme only, no MSP product. The Global Partner Program (reseller programme document dated July 2025) runs a points-based tiered model across Core, Preferred and Strategic tiers, with rising incentives, NFR licences, a partner portal, a dedicated channel sales manager at Strategic, and quarterly business reviews. No multi-tenant client management, no per-client separation and no MSP console are described anywhere in the programme document.
• Breach history: May to June 2026. Attacker brute-forced the API endpoints used for device registration, submitting every possible numeric combination before short-lived 2FA tokens expired, and registered new devices on some accounts. Fewer than 20 personal-plan accounts accessed. Copies of encrypted vaults were downloaded. They remain encrypted and need the user's master password, so weak master passwords are exposed to offline cracking. Dashlane says it found no evidence its internal systems were compromised. Acknowledged 31 May 2026, advisory updated 4 June 2026. Business customers not mentioned in coverage.

6. NORDPASS

• Price (per user/mo): 2-year: Teams $1.79, Business $3.59, Enterprise $5.39. 1-year: $1.99 / $3.99 / $5.99. Monthly: $2.49 / $5.99 / $7.99. Teams is a 10-user pack. Business and Enterprise from 5 seats.
• Deployment: cloud only. No self-hosting mentioned on the business plans page.
• Data residency: US or EU data centre, chosen at purchase or at business free-trial signup. Cannot be migrated later. Moving means exporting items and creating a new organisation in the other data centre with support's help. Accounts created without following the invitation email land in the US data centre and must be deleted and re-invited before they can join an EU organisation. No documented region choice for personal accounts. Nord Security is Lithuania-based (EU).
• SSO: Teams includes SSO with Google Workspace. Enterprise adds Entra ID, MS ADFS, Okta.
• Directory sync / SCIM: Enterprise: user and group provisioning via Entra ID and Okta. The terms SCIM and directory sync are not used.
• RBAC: role-based policies on Business, RBAC on Enterprise.
• Audit log: Activity Log and Activity Log API listed.
• Certifications: ISO/IEC 27001:2017 for NordPass Business, per NordPass's own blog dated 24 October 2024. Note this is the older revision, and 27001:2022 is current. No auditor, certificate number or certification date published.
• Machine secrets: Activity Log API only, so far as the page shows.
• MSP / multi-tenant: yes. Multi-tenant MSP Admin Panel for managing client environments from one place, with a separate MSP Panel for the partner's own organisation and a Business Admin Panel for onboarded clients. Consumption-based pricing. NFR licences for internal use, 24/7 technical support, 14-day client trials. Distribution through Ingram, Pax8, Exertis Cloud, Bluechip and Gridheart. Integration categories listed include IAM, user and group provisioning, professional services automation, automated security and compliance, and SIEM. No named PSA or RMM products, RMM not mentioned at all. No white-label mentioned. Per-client isolation mechanism not explained.
• Breach history: no NordPass breach found.

7. LASTPASS

• Price: Teams $4/user/mo billed annually, capped at 50 users. Business $7/user/mo billed annually, no cap. A Business Max tier exists with unlimited SSO apps.
• Deployment: cloud only.
• Data residency: 6 regions: United States, Europe, Australia, Singapore, India, Canada. LastPass's Technical and Organizational Measures document describes them as "redundant, active-passive cloud regions" and says the region is chosen by the customer's data residency preference at account creation. No specific European country or city named. This is the widest regional choice of any of them.
• SSO: not included on Teams. Business limited to 3 apps. Business Max unlimited.
• Directory sync / SCIM: AD sync on Business (Microsoft Active Directory among others), not on Teams. SCIM not mentioned.
• Audit log: basic reporting on Teams, advanced on Business.
• Certifications: SOC 2 Type II, SOC 3, ISO 27001, BSI C5. LastPass’s own compliance page names only the first 3 and gives no revision years, dates or certificate numbers. A third-party directory also lists ISO 27701.
• Machine secrets: API not mentioned on the pricing page.
• MSP / multi-tenant: separate partner offering, not a listed plan.
• Breach history: August to December 2022. 8 to 11 Aug 2022: developer laptop compromised, 14 source code repositories, technical documentation and an encrypted SSE-C backup key taken. 12 Aug 2022: a DevOps engineer's personal computer compromised via an unpatched Plex server, and a keylogger captured the engineer's master password. 20 Aug: attacker extracted the engineer's Employee Business vault containing keys. 20 Aug to 16 Sept: attacker obtained the user database and several vault backups. 25 Aug: LastPass stated no evidence of customer data access. 15 Sept: LastPass and Mandiant said activity was limited to a 4-day window in August, and the ICO later said LastPass was unable to determine the extent. 15 and 22 Oct: GuardDuty alerts fired, SOC not informed until 2 Nov. 30 Nov: reported to the ICO. 15 Dec: AWS confirmed the attacker had downloaded a copy of the backup database. Taken in the clear: names, email addresses, billing addresses, partial card numbers, website URLs. Vaults taken encrypted under users' master passwords. ICO found over 1 million UK data subjects affected.

8. PSONO

• Price: 4 tiers across 2 deployment models.
  • On-premise, Community Edition: $0, open source, unlimited users, basic support.
  • On-premise, Enterprise Edition free: $0 up to 10 users, complete feature set.
  • On-premise, Enterprise Edition paid: $3.00 per user per month, billed annually, minimum 25 users. Extended support optional.
  • SaaS, Community: $0, hosted free of charge, hosting and updates included, basic support.
  • SaaS, Business: $3.50 per user per month, billed annually, minimum 25 users. Extended support optional.
  • Note the gap between 10 free users and the 25-user paid minimum: a team of 15 pays for 25 seats.
• Deployment: both. Self-hosted server or Psono-hosted SaaS.
• Data residency: vendor is esaqa GmbH, Germany. I couldn’t find SaaS hosting region. Psono’s entity-model page covers datastores, secrets, shares and permissions, and says nothing about physical hosting location. Self-hosted deployments sit wherever the customer puts them.
• SSO: on-premise EE lists LDAP, SAML and OIDC. SaaS Business lists SAML and OIDC only, with no LDAP. Both free-up-to-10 and paid tiers carry SSO, so Psono is the only vendor here giving SSO away at no cost.
• Directory sync / SCIM: LDAP on self-hosted EE only.
• RBAC: policies and compliance enforcement listed on EE and SaaS Business.
• Audit log: audit logging on EE and SaaS Business, including the free-up-to-10 tier. Absent from Community Edition.
• Certifications: ISO 27001, confirmed via the esaqa GmbH trust centre at confirmed via the esaqa, announced 2 September 2025. Revision year, certificate number, issuing body and expiry are not published in the announcement.
• Gateway: SSH, RDP and VNC gateway included on EE and SaaS Business. No other vendor here offers session gateway access, which puts Psono closer to a PAM tool than a password manager at the paid tier.
• MSP / multi-tenant: no published MSP or partner programme found. Self-hosting means an MSP could stand up a separate instance per client, but that is a workaround the customer builds, not a vendor product. No MSP console, no consolidated billing, no partner tiers, no NFR licences.
• Breach history: none found.

9. PASSBOLT

• Price: Community free, self-hosted only, unlimited users, no enterprise features. Business/Pro €4.50 per user/mo ($4.90), 10-user minimum, discounts negotiable above 100 users, can be cloud-hosted. Enterprise custom quote, adds SLA, priority support, disaster recovery consulting, migration and hosting options.
• Deployment: self-hosted (Docker, Debian/Ubuntu, CentOS, Raspberry Pi) or cloud-hosted on EU servers.
• Data residency: EU-located servers for the hosted option. Vendor based in Luxembourg.
• SSO: Business and above: Entra ID, OpenID Connect, Ping One, Google Workspace.
• Directory sync / SCIM: LDAP/AD/SCIM on Business and above, for synchronisation and provisioning rather than authentication.
• Audit log: Business and above. Immutable log of credential events including who accessed a password, when, and from which device and IP. Not in Community.
• Certifications: SOC 2 Type II, first audited by Johanson Group LLP, completed February 2022, around 120 control tests, report available to customers under NDA. Renewed since, so the attestation is current. No ISO 27001, only stated groundwork toward 27001 and 27017. Also holds the ECSO "Security Made in Europe" label and the Luxembourg chamber of commerce "Made in Luxembourg" label. 6 Cure53 security audits during 2021 (audits, not certifications).
• Machine secrets: REST API confirmed. Operates over HTTPS, processes JSON payloads, language and framework agnostic.
• MSP / multi-tenant: yes. Dedicated instance per client, or multi-tenant (isolation mechanism not explained). Free admin seat per client. Partners buy at a tiered discount and set their own retail, keeping the margin plus 100% of hosting, implementation and support revenue. Commission recurs on renewals and grows with client usage. Free internal-use subscription, consolidated quarterly or annual billing, deal registration, dedicated partner manager at higher tiers. Partners handle 1st and 2nd line support, and Passbolt engineering handles 3rd line. White-label not yet available, with a co-branded offering and white-label plugin described as coming soon. Eligibility bar: service providers must pass a security review and hold ISO 27001 or at minimum SOC 2 Type II, which is the strictest partner requirement of any of them.
• Breach history: no breach of Passbolt systems found. Published CVEs include CVE-2024-33669 (browser extension), CVE-2024-33670 (API), CVE-2017-1000442. Open source since 2016.

10. KEEPASSXC

• Price: free. Released under GPLv3. Donation-funded.
• Deployment: local encrypted database file on the user's own device. No server component.
• Data residency: wherever the user puts the file.
• SSO: none.
• Directory sync / SCIM: none.
• RBAC: none.
• Audit log: none.
• Certifications: ANSSI Security Visa ANSSI-CSPN-2025/16, issued 17 November 2025 by the French National Cybersecurity Agency, valid to 17 November 2028. Scope is version 2.7.9 on Windows 10 only, so it certifies a specific build rather than an organisation's security management. Separately, an application security review by consultant Zaur Molotnikov on version 2.7.4, completed 19 January 2023. No organisational certification (no ISO 27001, no SOC 2), which is expected for a volunteer-maintained project with no company behind it.
• Machine secrets: CLI exists (keepassxc-cli). CI/CD integration not a product feature.
• MSP / multi-tenant: none.
• Breach history: no breach possible at vendor level (no servers).
• Note: sync is not built in. Teams place the database in a shared folder (Dropbox, Nextcloud) themselves. Maintained by the KeePassXC Team.

Notes:
On MSPs: 8 of the 10 have something for MSPs and they are not the same thing. Passwork, Bitwarden, Keeper, 1Password, NordPass and Passbolt all run real multi-tenant consoles. Dashlane has a reseller programme with no multi-tenancy at all, which is a meaningful gap for anyone shopping as an MSP. Psono has nothing published. KeePassXC has nothing by design. White-label separates the field further: Passwork offers white-label or co-branded today, Passbolt lists it as coming soon, and 1Password, NordPass and Bitwarden do not mention it. PSA/RMM integration is thinner than the marketing suggests, with Passwork and Keeper naming it and 1Password and NordPass naming no specific products.
On data residency (for cloud hosting): region lock-in is near-universal and nobody advertises it. 1Password, Dashlane and NordPass all make the region permanent at signup with no migration path, so a company that picks wrong rebuilds from an export. LastPass offers 6 regions, the most in the table.

Rapid fire: which password manager should your business use?
For the most affordable per-seat price with no seat cap → Passwork
For a team of 10 to 20 that wants it to just work → 1Password Teams Starter
For open source you can run on your own Kubernetes → Bitwarden
For US federal, defence or anything touching GovCloud → Keeper
For an MSP that needs its own branding on the product → Passwork
For under 10 users who still need SSO and audit logs → Psono
For a separate secrets manager for CI/CD alongside the human vault → Bitwarden
For credential access and SSH, RDP or VNC sessions in one tool → Psono
For EU compliance-ready audit logs like NIS2 and GDPR → Passwork
For open source with a current SOC 2 and EU hosting → Passbolt
For the widest choice of where your data physically sits → LastPass
For a self-hosted vault with a company behind it and audit logs your SIEM can read → Passwork
For never letting a vendor hold your vault at all → KeePassXC
For a company that just needs SSO on a budget and has 5 seats → NordPass Business
For SAML SSO without jumping to an enterprise tier → Passwork
For a 2-person operation that wants dark-web monitoring built in → Dashlane

Aaaaand we’re done! This took way longer than I’d like to admit haha.

Question about Form filling / Save All Entered Data(SAED) features of Password Managers:

Do any have this besides LastPass, for more than passwords / credit card info ?

Really miss this feature. Handy for filling in medical forms, applications, complaints, etc. Amazing time saver for people who must fill out forms a lot, like Social Workers, in healthcare...

I think LastPass still has it, but it became buggy and there's its reputation for the way its dealt with security issues...

目前有没有比较好的帐号密码管理工具呢？

我的场景是有很多个帐号 每个帐号对应不同的手机

而有些手机关联了很多帐号

我需要可以清晰查看关系图

https://youtube.com