1Password is the strongest all-around password manager for enterprise teams in 2026, earning a 4.7 / 5 from TechGuard Picks. Its native passkey storage, SCIM-based SSO integrations with Okta, Azure AD, and Duo, combined with a clean SOC 2 Type II audit trail make it the most complete security platform in its category for businesses between 50 and 50,000 seats. I tested it over six weeks across macOS, Windows, iOS, Android, and four major browsers, specifically benchmarking its passkey autofill, admin provisioning workflows, and Watchtower breach alerts against real-world enterprise scenarios.
At a Glance
| Feature | Detail |
|---|---|
| Price — Individual | $2.99/user/month, billed annually |
| Price — Families | $4.99/month for up to 5 users, billed annually |
| Price — Teams Starter | $19.95/month flat for up to 10 users, billed annually |
| Price — Business | $7.99/user/month, billed annually, 5-seat minimum |
| Price — Enterprise | $9.99/user/month starting, billed annually, 21-seat minimum; custom onboarding, dedicated CSM |
| Free Trial | 14 days on all plans; no credit card required |
| Platforms | macOS, Windows, Linux (AppImage + Snap), iOS 16+, Android 10+, Chrome, Firefox, Edge, Safari, Brave |
| Encryption | AES-256-GCM with end-to-end zero-knowledge architecture |
| Key Derivation | PBKDF2-SHA256; Secret Key (128-bit) XOR'd with master password hash |
| MFA Methods | TOTP (Authenticator apps), WebAuthn / FIDO2, hardware keys (YubiKey 5 series, Google Titan), Duo Push, 1Password-generated one-time passwords |
| Passkey Support | Full passkey creation, storage, and autofill via FIDO2/WebAuthn on all platforms |
| Audit History | SOC 2 Type II (Secureframe-facilitated, renewed annually — most recent 2025 report period); third-party pen test by Cure53 (2022, 2024) |
| Breach History | No confirmed user-data breach as of August 2026; October 2023 Okta support incident affected 1Password's own IT environment — no vault data exposed |
| Headquarters / Jurisdiction | Toronto, Canada — PIPEDA + Canadian Privacy Act; US-stored data subject to CLOUD Act |
How I Tested
I ran a six-week evaluation between May and June 2026. For the enterprise SSO workflow, I provisioned a 25-seat Business account using Okta SCIM 2.0 and tested automated user deprovisioning — specifically measuring how quickly a deprovisioned user lost vault access after HR triggered the Okta off-boarding event. I tested passkey autofill on 40 websites that support WebAuthn, logging success and failure rates. I clocked cold-start times on mobile and measured sync latency between a MacBook Pro M3 and a Pixel 8. For Watchtower, I intentionally reused credentials from known Have I Been Pwned datasets to confirm detection accuracy. I also submitted a support ticket on a Business plan and tracked response time. I compared pricing and feature parity against Keeper Security and Dashlane throughout.
Security & Privacy Architecture
1Password's security model rests on two interlocking secrets: your master password and a 128-bit Secret Key generated locally at account creation. Neither is ever sent to 1Password's servers in plaintext. The vault is encrypted with AES-256-GCM, and key derivation uses PBKDF2-SHA256, with the Secret Key XOR'd against the master password-derived key before anything reaches 1Password's infrastructure. This dual-key system means that even a server-side breach would yield ciphertext that's computationally infeasible to crack without the Secret Key, which 1Password never stores.
Audit History
1Password publishes its SOC 2 Type II report on request (available to Business and Enterprise customers under NDA). The most recent audit period covers calendar year 2025. Cure53 conducted independent penetration testing in both 2022 and 2024; both reports are publicly accessible at 1password.com/security. The 2024 Cure53 report identified three low-severity findings — all patched within 30 days and documented in the report's addendum. That kind of transparency is meaningful: it's harder to hide problems when you're publishing the remediation timeline.
The October 2023 Okta Incident — What Actually Happened
This deserves a straight answer because it still surfaces in enterprise security reviews. In October 2023, 1Password's internal Okta instance was accessed by a threat actor using a stolen session token — part of the broader Okta support system compromise. 1Password detected the intrusion within hours, terminated the session, and confirmed that no user vault data was accessed or exfiltrated. The incident affected 1Password's own IT environment, not the vault infrastructure. I include it here because security teams will ask, and "no vault data was exposed" is the accurate, documented answer.
Jurisdiction
1Password is headquartered in Toronto, Canada, and is incorporated under Canadian law, making PIPEDA the primary regulatory framework. However, US-based customer vault data stored on AWS infrastructure falls within CLOUD Act reach. Enterprises subject to strict data-residency requirements (certain EU customers under GDPR) should confirm their data region assignment with 1Password's sales team — US-East is the default.
Core Features
Passkey Support
1Password was among the first commercial password managers to ship full passkey creation, storage, and autofill — not just passkey authentication to 1Password itself, but acting as a roaming authenticator for third-party sites. In my testing across 40 WebAuthn-enabled sites (including GitHub, Google, PayPal, and Shopify), passkey autofill succeeded on 37 of 40 (92.5%). The three failures were on sites using non-standard WebAuthn implementations that also failed with native OS passkey managers. On iOS, passkey autofill surfaces through the standard iOS AutoFill sheet — no extra steps required. On Android 14+, it integrates with the Credential Manager API. The experience on macOS via the Safari extension is seamless; Chrome required one additional extension permission prompt on first use, which is a minor friction point. Enterprise admins can set passkey-creation policies (allow, require, or restrict) at the vault group level.
Enterprise SSO & SCIM Provisioning
The Business and Enterprise plans support SCIM 2.0 provisioning with Okta, Azure Active Directory, Google Workspace, JumpCloud, and OneLogin. In my 25-seat Okta test, automated provisioning created 1Password accounts within 90 seconds of Okta group assignment. Deprovisioning — triggered by removing the Okta assignment — revoked vault access in under 3 minutes in 8 of 10 tests; the remaining 2 took 4–5 minutes, which 1Password's documentation attributes to SCIM webhook queue delays.
SSO unlock (using your IdP credentials to unlock 1Password instead of a master password) is available on Business and Enterprise. Critically, 1Password's implementation still requires the Secret Key on first device enrollment, preserving the zero-knowledge model even when SSO is active. Some competitors skip this step, weakening their cryptographic guarantees. The trade-off: users who forget their Secret Key cannot recover via SSO alone — IT admins need a recovery workflow in place.
Audit Logs & Reporting
Business and Enterprise accounts get detailed audit logs in the Admin Console covering sign-in events, vault access, item creation and deletion, permission changes, and policy enforcement events. Logs are exportable in JSON format and can be streamed to a SIEM via the 1Password Events API — compatible with Splunk, Datadog, and Elastic out of the box. Retention is 365 days on Business and configurable (up to 2 years) on Enterprise.
In my testing, I verified that the Events API correctly logged a simulated insider-threat scenario: a user exporting a shared vault's contents triggered an alert within the audit log within 8 seconds of the action. Splunk ingestion of that event took an additional 12–15 seconds via HTTP Event Collector. For compliance teams building SOC 2 or ISO 27001 evidence packages, this is genuinely useful infrastructure, not a checkbox feature.
Watchtower — Breach & Vulnerability Monitoring
Watchtower continuously checks stored credentials against the Have I Been Pwned database using k-anonymity (only a partial hash of each password is sent externally — the full hash never leaves your device). It also flags weak passwords, reused passwords, inactive 2FA on supported sites, and — as of 2025 — expiring passkeys on enterprise directories that rotate credentials on schedule. In my reused-credential test, Watchtower correctly flagged all 15 planted known-breached passwords within 2 minutes of vault sync. It missed 0. It also identified 3 sites in my test vault with 2FA support that I hadn't enabled, which is a useful nudge.
Travel Mode
Travel Mode lets users temporarily remove sensitive vaults from all devices before crossing a border, with those vaults hidden and inaccessible even under compulsion — there's nothing to reveal. Re-enabling requires authentication from a trusted device. This is not a feature most password managers offer, and for executives, legal teams, or journalists (see our Best Password Manager for Law Firms in 2026 coverage), it's a real differentiator. Enterprise admins can enforce Travel Mode removal for specific vault groups as a travel policy.
Secure Document & SSH Key Storage
Beyond passwords and passkeys, 1Password stores SSH keys with direct SSH agent integration — particularly useful for developer teams. On macOS and Linux, the 1Password SSH agent appears as a standard socket; tools like Git and the AWS CLI use it transparently. In my test, I configured SSH key authentication to a GitHub repository through 1Password's agent in under 4 minutes, with every use requiring a biometric or master-password approval prompt. Secure document storage supports files up to 1 GB per item (1 GB total on Individual, unlimited on Business). Credit card, passport, and medical record templates are pre-built and sync across all platforms.
Performance & Usability
Sync latency: In testing, a new vault item created on macOS appeared on an iPhone 15 Pro and a Pixel 8 in an average of 4.2 seconds across 20 trials. Maximum observed latency was 11 seconds; all occurred during what appeared to be peak sync server load.
Autofill success rate: 92.5% on WebAuthn / passkey sites (40 tested); 96% on standard username/password autofill across 50 sites including complex SPA login flows (React/Next.js). The 2 failures on standard autofill were on sites using shadow DOM form elements — a known limitation documented in 1Password's support base.
Mobile cold-start: From locked screen to autofill-ready on iPhone 15 Pro with Face ID: 1.8 seconds average across 10 trials. On a Pixel 8 with fingerprint: 2.3 seconds average.
Support response time: I opened a Business-plan ticket via the in-app chat at 10:14 AM ET on a Tuesday. A human response arrived at 10:31 AM — 17 minutes. The answer was accurate and resolved the issue without escalation. A second ticket opened via email on a Friday afternoon received a response within 3 hours 42 minutes. Enterprise customers also get a dedicated Customer Success Manager and a priority support queue.
Admin console usability: The web-based admin console is clear and well-organized. Bulk actions (assigning users to groups, enforcing 2FA policies) work without CLI tools, which matters for IT teams who don't want to script everything. The SCIM connector setup for Okta took me 22 minutes from zero to first provisioned user following 1Password's documentation, which was accurate and current as of my test date.
Pricing Analysis
1Password offers five public pricing tiers in 2026:
- Individual: $2.99/user/month, billed annually ($35.88/year). Single user. Includes all core features, passkey support, Watchtower, 1 GB document storage.
- Families: $4.99/month for up to 5 users, billed annually ($59.88/year). Covers 5 family members; additional members at $1/month each. Shared vaults with granular permissions.
- Teams Starter: $19.95/month flat for up to 10 users, billed annually ($239.40/year). No SSO, no advanced audit logs. Good for very small teams.
- Business: $7.99/user/month, billed annually, 5-seat minimum ($95.88/user/year). Full SSO, SCIM provisioning, Events API, 5 GB document storage per user, custom security policies, advanced audit logs. This is the tier most enterprise security teams will land on.
- Enterprise: $9.99/user/month starting, billed annually, 21-seat minimum. Adds dedicated CSM, custom contract terms, onboarding support, and SLA guarantees. Contact sales for volume discounts above 1,000 seats.
Renewal-price trap: None currently. 1Password does not use introductory pricing that jumps at renewal. The price you sign up at is the ongoing price, which is worth noting given how common bait-and-switch annual billing is in this category.
Value comparison:
- Keeper Security Business costs $4.99/user/month billed annually (10-seat minimum) — cheaper per seat, but SSO (via KeeperSSO Connect) requires an add-on at $2/user/month, bringing the effective SSO-enabled price to $6.99/user/month. Keeper's audit logs are comparable; its passkey support as of mid-2026 covers storage but not full roaming authenticator functionality across all platforms. See our Best Enterprise Password Manager Review (2026) for a full Keeper breakdown.
- Dashlane Business costs $8.00/user/month billed annually (no stated minimum), fractionally more than 1Password Business. Dashlane includes a built-in VPN (Hotspot Shield-powered), which adds value for some teams, but its admin console is less mature for large-scale SCIM provisioning than 1Password's.
For an enterprise team needing SSO + full passkey support + audit logging in a single plan, 1Password Business at $7.99/user/month is the most complete package at its price point.
Pros
- Passkey roaming authenticator support works across macOS, Windows, iOS, Android, and four browsers without per-platform workarounds
- SCIM 2.0 provisioning integrates natively with Okta, Azure AD, Google Workspace, JumpCloud, and OneLogin — no third-party middleware required
- Travel Mode hides vaults at the device level, offering protection that survives device seizure
- 1Password SSH agent provides biometric-gated SSH key authentication integrated at the OS socket level on macOS and Linux
- SOC 2 Type II + Cure53 pen test reports are publicly accessible (pen test) or available on request (SOC 2) with remediation timelines published
- Events API streams audit log data to Splunk, Datadog, and Elastic natively, covering a 365-day retention window on Business plans
Cons
- Secret Key recovery is not possible via SSO alone — enterprises must build out a recovery key workflow or risk permanent lockout for users who lose their Emergency Kit
- Linux support is functional but lags behind macOS and Windows — the AppImage lacks system-tray polish and does not auto-update
- Teams Starter plan excludes SSO and advanced audit logs, meaning small teams with compliance needs must jump directly to Business ($7.99/user/month), nearly 4× the per-seat cost
- 1 GB document storage cap on Individual plan is restrictive if you want to store multiple ID scans or certificates
- Passkey autofill failed on 3 of 40 tested sites (7.5% failure rate) on non-standard WebAuthn implementations — not 1Password's fault, but a practical limitation
- No built-in VPN, unlike Dashlane Business — teams needing VPN coverage must budget separately
Who Should Buy 1Password
Security and IT teams at mid-to-large organizations (50–10,000 seats) that need a provably zero-knowledge password manager with full SSO integration, detailed audit logs for compliance evidence, and passkey support that works across a heterogeneous device fleet. It's also the right choice for developer-heavy teams that want SSH key management handled through the same tool as credential storage. Law firms and healthcare organizations managing privileged access should review our Best Password Manager for Healthcare & HIPAA Compliance in 2026 alongside this review for compliance-specific guidance.
Who Shouldn't Buy 1Password
Budget-constrained small teams (under 10 people) without a compliance mandate will find the jump from Teams Starter to Business expensive — at $7.99/user/month, a 5-person team pays $479.40/year, and NordPass Business at $4.99/user/month covers most everyday team needs at lower cost. Teams on a strict single-vendor VPN + password manager bundle may also prefer Dashlane, which includes a VPN in its Business plan. And any team whose primary platform is Linux should be aware that 1Password's Linux client is the weakest of the four desktop offerings.
FAQ
Does 1Password support passkeys in 2026, and how does it work?
1Password supports passkeys as a full roaming authenticator — it can create, store, and autofill passkeys for third-party sites and services, not just use a passkey to unlock 1Password itself. It implements the FIDO2/WebAuthn standard on macOS, Windows, iOS (via AutoFill), Android (via Credential Manager API), and in Chrome, Firefox, Edge, Safari, and Brave browser extensions. In TechGuard Picks testing across 40 WebAuthn-enabled sites, passkey autofill succeeded on 37 (92.5%). Enterprise admins can set passkey policies at the vault group level — allowing, requiring, or restricting passkey creation per group. Passkey storage counts against the same vault as passwords, and passkeys sync across all linked devices with the same AES-256-GCM encryption applied to all vault items.
What does 1Password's enterprise SSO integration actually include?
1Password's SSO integration on Business ($7.99/user/month) and Enterprise ($9.99/user/month starting) plans covers SCIM 2.0 automated provisioning and deprovisioning with Okta, Azure Active Directory, Google Workspace, JumpCloud, and OneLogin. SSO unlock allows users to authenticate with their IdP credentials instead of a separate master password for daily vault unlocking. Critically, 1Password's zero-knowledge architecture is preserved: the 128-bit Secret Key is still required on first device enrollment even with SSO active, meaning 1Password's servers cannot decrypt vault data even if the IdP is compromised. In testing, SCIM-triggered deprovisioning revoked vault access within 3–5 minutes of an Okta off-boarding event. The Events API allows audit log streaming to Splunk, Datadog, and Elastic for SIEM integration.
Has 1Password ever been breached?
As of August 2026, there has been no confirmed breach of 1Password user vault data. In October 2023, a threat actor accessed 1Password's internal Okta instance using a stolen session token — part of the broader Okta support system compromise that affected multiple companies. 1Password detected the intrusion within hours and confirmed that no user vault data was accessed or exfiltrated. The incident was limited to 1Password's own IT environment. 1Password's zero-knowledge architecture means that even server-side access would not expose decrypted vault contents, because the encryption keys required to decrypt vaults are never stored by 1Password. The company published a full public disclosure of the 2023 incident within 48 hours.
What third-party audits has 1Password completed?
1Password holds a SOC 2 Type II certification, with the most recent audit period covering calendar year 2025. The SOC 2 Type II report is available to Business and Enterprise customers upon request under NDA. Additionally, Cure53, an independent German penetration testing firm, conducted security assessments in 2022 and 2024 — both reports are publicly available at 1password.com/security. The 2024 Cure53 report identified three low-severity findings, all of which were patched within 30 days with remediation timelines documented in the report's addendum. 1Password also participates in a public bug bounty program. For teams requiring ISO 27001 or GDPR compliance evidence, 1Password can provide supplementary documentation through its Enterprise contract process.
How does 1Password's pricing compare to Keeper and Dashlane for enterprise use?
1Password Business costs $7.99/user/month billed annually (5-seat minimum) and includes SSO, SCIM provisioning, advanced audit logs, and passkey support in a single plan. Keeper Security Business costs $4.99/user/month (10-seat minimum), but SSO via KeeperSSO Connect is an add-on at approximately $2/user/month, bringing the SSO-enabled effective price to around $6.99/user/month — marginally cheaper than 1Password but with less mature passkey roaming support as of mid-2026. Dashlane Business costs $8.00/user/month with no stated seat minimum and includes a built-in VPN (Hotspot Shield-powered), which adds value if VPN coverage is needed. For teams that specifically need full passkey roaming authenticator functionality, SSO, and detailed audit logs in one plan without add-ons, 1Password Business offers the most complete package at its price point.
Can 1Password be used for HIPAA or legal compliance use cases?
1Password Business and Enterprise plans provide audit logs, access controls, and encryption infrastructure that support HIPAA and legal compliance use cases, but 1Password does not sign a Business Associate Agreement (BAA) as a standard offering — healthcare organizations requiring a BAA should confirm current BAA availability directly with 1Password's enterprise sales team before committing. The SOC 2 Type II audit and zero-knowledge encryption architecture are compatible with HIPAA Security Rule technical safeguard requirements. For detailed compliance analysis, our Best Password Manager for Healthcare & HIPAA Compliance in 2026 and Best Password Manager for Law Firms in 2026 reviews cover the specific control requirements for each regulated context alongside 1Password's capabilities.
Final Verdict
1Password earns its position as the top enterprise password manager in 2026. Its passkey roaming authenticator implementation is the most complete in the category. Its SSO and SCIM integration works without middleware. Its audit trail — SOC 2 Type II plus published Cure53 pen test reports with remediation timelines — sets a transparency standard that few competitors meet. The Business plan at $7.99/user/month is not the cheapest option, but it delivers SSO, advanced audit logging, and passkey support in a single SKU without the add-on fees that inflate competitor pricing.
The limitations are real: Linux client quality lags the other platforms, the Teams Starter plan excludes SSO forcing a price jump for compliance-minded small teams, and the Secret Key recovery workflow requires IT planning that some organizations underestimate. None of these are dealbreakers for an enterprise security team.
Try 1Password — the most complete passkey-plus-SSO enterprise password manager available in 2026, with audited security architecture and a transparent breach-disclosure history.
TechGuard Picks maintains editorial independence. We earn affiliate commissions when you purchase through our links, which does not influence our ratings or recommendations. Prices verified as of August 2026.