What is the best password manager for business use?
Hello!
I've been using NordPass recently, but the interface is pretty broken with modern password flows (e.g. you enter your username, the webapp moves to the next "page" and gets your password. ADP does this, for example). NordPass guesses things are a new password on an established site about 20-30% of the time. Sort of annoying UX, though I dont really have any other complaints.
As a community, what do you recommend? I _think_ I've seen bitwarden recommended, but would love hear opinions on current state-of-the-art and recommendations.
We use 1Password at the corporate level and I have been very pleased with their service.
Bitwarden is fantastic. I use it for my personal things + I've successfully migrated multiple companies to it from other password managers. Highly recommend it.
I love BitWarden, i use it both personally and at the company I work at. The previous company I worked at used it for all employees.
I‘m not sure if it has all the „business“ features you might desire but check it out, you could even host it on-prem if you want ;)
NO Lastpass, we use it at my company and it is terrible, the UX is a nightmare.
Also, does anyone know of a multi-user password manager that can have permissions assigned to users? A number of the government accounts we use have a single company level login and keeping password changes synced between multiple users is difficult. We currently use one manager with a shared password but I would prefer something with better permissions and history.
Currently in a large private bank: Keepass, hardware tokens in physical safes accessed supervised by another team, Hashicorp Vault, a few HSMs and managed key vaults for the cloud workloads.
Paranoid levels of security are relevant in some cases but unnecessary in others. Physical security and organisational processes are also an important complement to technological solutions.
I would indeed suggest bitwarden. Mostly because I believe that this type of security critical software needs to be open source to be trustworthy.
In my opinion I would say anything that has revision control, understands it's encrypted database file is shared meaning changes can converge clean and stored on-prem in a secure artifact repository with access logging that is preserved and can't be tampered with based on the companies SOC1/2/PCI policies and in no way touches a cloud not owned and under full control by that company. This is assuming the database is shared by a team. If used by just one employee then KeyPassXC is fine.
I can’t recommend anything as a community, but as me, I can say that I’ve been happy using a text file stored in an ecrypt volume. Vim lets me find and copy a password in under two seconds.
pass
We use it because PGP has been through hell and back with security audits. Combined with the fact that everyone gets their own key gives you a lot of control over the ecosystem. At the end of the day it's just git + pgp, two bulletproof technologies you probably are already familiar with.
All shared passwords suffer from irrevocability, no matter your password storage solution.
EnvKey
Programmer focused, not strictly a password manager. But easy enough to use as one.
I've been using Passbolt for some time in a small company, it seems to be secure (pgp) and it has good browser plugins
1password. If you have business version employees also get free family plan.
I'm sorry, but the title is triggering me.
Why not ask, "What are some good password managers for business use cases and their pros and cons?