Office Stack GuidePlain-English guides to the software and IT services small businesses actually use.

Password Manager for Business: Costs, Features and How to Choose

By Office Stack Guide Editors · Updated 2026-11-12

For 10 staff, cutting off a departing employee automatically costs $480 a year at Bitwarden and $1,078.80 at 1Password, based on list prices checked in November 2026. If your office runs on Microsoft 365 or Google Workspace, buy that automatic cutoff and start with Bitwarden Teams, the cheapest published plan that includes it.

An office manager at a desk typing on a laptop in a small office, with coworkers in the background in daylight.

Offices that will remove people by hand can pay a little less. Watch the seat floor, though. 1Password Teams Starter Pack bills a minimum of 10 seats, so a 2-person office pays $299.40 a year, about $12.48 per person per month.

At a glance

Your situation Plan to look at Annual cost Source
2 people Bitwarden free organization $0 Bitwarden, 2026
3 to 6 staff Bitwarden Teams, which includes automatic suspension $288 for 6 Bitwarden, 2026
7 to 20 staff, offboarding by hand 1Password Teams Starter Pack or Keeper Business Starter $299.40 for 10 (1Password) 1Password, 2026
On Microsoft 365 or Google Workspace Bitwarden Teams $480 for 10 Bitwarden, 2026
Need SSO login and admin recovery Bitwarden Enterprise $720 for 10 Bitwarden, 2026

What a business password manager does, and why the browser's isn't enough

A business password manager is an encrypted app that stores logins and shares them by group. The office's bank, payroll, domain registrar and social media logins sit in shared vaults, which are folders with their own access lists. An admin decides who sees each vault.

CISA recommends passwords of at least 16 characters, a different one for every account, and a password manager that generates, stores and fills them in. NIST's final password guidance, SP 800-63B-4 (2025), says login pages shall allow password managers and autofill.

The free managers in Chrome, Edge and Apple Passwords work for individuals. They fall short for an office in three ways:

How much a business password manager costs, starting from the last day

Picture an employee's last day and ask how you will cut their access to every shared login. Your answer decides the plan you need. The first question is whether you already manage staff accounts in Microsoft 365 or Google Workspace.

Offboarding by hand: no central work accounts

When someone leaves, the owner removes them in the admin console and changes every shared password they could see.

The discount for doing it by hand is small. Up to 6 people, Bitwarden Teams ($288 a year) costs less than 1Password's 10-seat floor. At 20 people, 1Password's manual plan saves only about $62 a year compared with Bitwarden Teams ($960).

Automatic suspension: Microsoft 365 or Google Workspace offices

These plans connect the vault to your work accounts through SCIM, a standard that lets your user directory create and suspend accounts in other apps, or through directory sync. Disable someone's work account and their vault access is suspended too. There is no second step to forget.

Automatic suspension only works once you connect it. A plan with SCIM that was never linked to Microsoft 365 or Google still needs manual offboarding.

SSO login, admin recovery and enforced policies

Bitwarden Enterprise ($6) adds login with SSO, meaning staff unlock the vault with their work account. It also adds enterprise policies, which are rules the admin enforces for every member, and admin account recovery. 1Password Enterprise and Keeper's top tier are priced by quote.

Annual totals at 10 and 25 users

Plan Offboarding Per user/month 10 users/year 25 users/year
1Password Teams Starter Pack By hand $2.49 (seats 11-20: $4.99) $299.40 Not available (20 max)
Bitwarden Teams Automatic $4 $480 $1,200
Bitwarden Enterprise Automatic, plus SSO and recovery $6 $720 $1,800
1Password Business Automatic, plus SSO $8.99 $1,078.80 $2,697

All figures are list prices billed annually, checked on each vendor's pricing page in November 2026, excluding tax. Keeper and Dashlane are left out because neither showed a readable price; get written quotes from both if they are on your shortlist.

What changes the price: SSO, SCIM, seat minimums and add-ons

Features a 2 to 50 person office actually needs

How to choose: questions to ask before you buy

Start with the decision the price table can't make for you:

Trial two products using real office logins. 1Password offers a 14-day trial with no card required. Then put these four questions to each vendor in writing:

  1. Does your SCIM or directory sync work with our exact setup (Microsoft Entra ID or Google Workspace), and on which plan?
  2. Can an admin see every shared item a departing user had access to?
  3. Can we export everything, in what format, and what access remains if we stop paying?
  4. Does the plan auto-renew, how do we cancel, and what will the renewal price be?

Rolling it out to staff and offboarding someone who leaves

A 30-day plan keeps the rollout from stalling:

  1. Days 1 to 7: Pick your two admins, start the trials and create shared vaults by role.
  2. Days 8 to 14: Import logins from browsers and spreadsheets, sort shared logins into vaults, and turn on MFA for the vault.
  3. Days 15 to 21: Invite staff and hold a 30-minute session to install the browser extension and phone app. Ask everyone to delete saved passwords from their browsers.
  4. Days 22 to 30: Delete the old password spreadsheet. Run a practice offboarding with a test account.

Last-day offboarding checklist

  1. Suspend the user. Do it in the admin console. With SCIM, disable their Microsoft 365 or Google account and confirm the vault shows them as suspended.
  2. Transfer their shared items. Reassign anything they created or own to an admin.
  3. Rotate every password they could see. Suspension does not change passwords they viewed or copied. Start with banking, payroll, the domain registrar and social media.
  4. Check MFA devices. If a shared account sends codes to their phone, move it to an office-controlled device.
  5. Record it. Note the date and every password you changed.

Step 3 is the one that gets skipped. In a July 2025 online poll of 1,200 US workers, 40% said they had used login details from a previous job. Of those, 60% said the password had never been changed. PasswordManager.com, a review site that benefits from password-manager sales, paid for the poll.

Red flags and common mistakes

FAQ

Is a former employee really a risk in a small office?

A small team gathered around a laptop in an office during a short software training session.

Yes, if shared passwords stay the same after they leave. In a small office, the departing person frequently saw the bank, payroll and social media logins. Suspending them in the vault stops new access but not passwords they remember, so rotation is what closes the door.

What happens if the password manager company itself is hacked?

It has happened. LastPass said in late 2022 that attackers stole copies of customer vaults, which were encrypted, though website addresses were not. Brian Krebs reported in September 2023 that more than $35 million in cryptocurrency had been stolen from more than 150 victims, with experts suspecting that vaults with weak master passwords were being cracked. ITPro reported about $12 million more in December 2024. The defense is a long master password plus MFA, enforced by policy. At Bitwarden, enforced policies require Enterprise.

We used Microsoft Authenticator for passwords. What now?

Microsoft says Authenticator stopped saving new passwords in June 2025, stopped autofill in July 2025, and removed saved passwords in August 2025, moving them to Edge. Edge stores passwords for one person at a time and has no shared vaults or offboarding controls. Import those passwords into a business password manager and delete them from personal browsers.

What happens to our data if we stop paying or switch vendors?

Terms vary by vendor and change over time. During the trial, run a full export and confirm the file opens cleanly in another tool. Before signing, get in writing whether the account becomes read-only or locked after cancellation.

Key takeaways

The bottom line

These plans keep changing shape. Bitwarden closed Teams Starter to new customers on June 11, 2024, 1Password moved Teams Starter Pack from a flat fee to per-user pricing, and Microsoft retired password storage in Authenticator over three months in 2025. When Bitwarden closed Teams Starter, existing customers kept their price, so ask for that kind of grandfathering. Before you sign, get the renewal price and the terms that apply if your plan is retired in writing, and keep a tested export on file.

Sources