Enpass
The password manager with no vault server: your encrypted vault syncs through your own iCloud, Google Drive, OneDrive, Dropbox or WebDAV, and the business tier keeps it inside your own Microsoft 365 or Google Workspace tenancy. Business is £1.58 a user a month with SSO, SCIM, dark-web monitoring and an MCP server included, ISO 27001 and SOC 2 Type II are claimed, and one-time licences exist for individuals. What is thin: the auditor is unnamed, there is no CLI or API, the reviews are few, and the company details are hard to pin down.
How we testEnpass is made by Sinew Software Systems, an Indian company with a US entity; its own about and terms pages blocked our reading, so the corporate structure is recorded as stated rather than confirmed. The architecture is the reason to look at it: Enpass stores nothing on its own servers. Personal vaults are encrypted on the device with AES-256 through SQLCipher, the master password stretched with 320,000 rounds of PBKDF2-HMAC-SHA512, and synced, if you want sync, through your own iCloud, Google Drive, OneDrive, Dropbox or WebDAV account. The business tier goes a step further and keeps the vault data inside the customer's own Microsoft 365 or Google Workspace tenancy. That removes Enpass as a place for a vault breach to happen and moves the responsibility to the cloud you already run. The security page claims ISO 27001:2022 and SOC 2 Type II, but no auditor is named and no report is public; the clients are closed source with no public repositories; the 2025 extension clickjacking class was patched in version 6.11.6 on 13 August 2025.
Prices in pounds on 8 September 2026 during an "end of summer" promotion. Individual renews at £19.49 a year, about £1.62 a month, after a first year at £11.69; Family is £38.99 a year for six; and, unusually, there are one-time licences: a three-year plan at £44.99 (£31.49 on promotion) and a lifetime licence at £91.99 (£73.59). The desktop app is free to start, but the limits of a free plan are not described. Business is £1.58 a user a month billed annually, with taxes added at checkout, and the list of what is included is long for the price: admin console, policies, SSO, SCIM provisioning, unlimited vaults, password and file sharing, a security audit dashboard, dark-web monitoring, event and audit logs, automatic data deletion when someone leaves, SIEM integration, 24/7 technical support and an MCP server that gives an AI agent read access to admin data on password health, security posture and adoption. A 30-day business trial needs no card; Enterprise is custom.
Passkeys are stored on every plan and the apps cover Windows, macOS, Linux, iOS, Android and both smartwatch platforms, with extensions for seven browsers. What we could not find is any command-line tool or public API, so automation runs only through the MCP server. Support for individuals is email and forum. Trustpilot is 4.1 on only 70 reviews, two of them in the last year, with the one-star themes being the move from lifetime licences to subscriptions, slow sync and a sense that development had stalled. A sound choice for a company that would rather own its own vault store than trust anyone's.
Not yet tested by Saaskly: assessed on published pricing, documentation, audit reports and third-party reviews.
Pros
- +No vendor vault server: personal vaults sync through your own cloud and business vaults live in your Microsoft 365 or Google Workspace
- +£1.58 a user with SSO, SCIM, audit logs, dark-web monitoring and an MCP server included; ISO 27001 and SOC 2 Type II claimed
- +One-time three-year and lifetime licences for individuals; apps for every platform including Linux
Cons
- −Auditor unnamed and no public report; closed source; corporate details not confirmable from its own site
- −No CLI and no public API; TOTP and hardware-key details not confirmed on its pages
- −Only 70 Trustpilot reviews, with subscription-switch and stalled-development complaints
Pricing
Minimum commitment: £1.62 (£1.62/yr for the entry licence). The least you can spend before walking away; excludes numbers, minutes and add-ons.
Individual
£1.62/yr · annual commitment
Month-to-month: not published
- ✓£19.49/yr renewal (about £1.62/mo) after £11.69 in year one on promotion, 8 Sep 2026; VAT not stated for personal plans. Family £38.99/yr for 6. One-time: 3-year £44.99, lifetime £91.99 (list). Free desktop app, limits not published.
Business
£1.58/yr · annual commitment
Month-to-month: not published
- ✓£1.58/user/mo billed annually, taxes at checkout: SSO, SCIM, admin console, sharing, audit logs, dark-web monitoring, offboarding deletion, SIEM, MCP server, 24/7 support; vault stored in your Microsoft 365 or Google Workspace. 30-day trial, no card. Enterprise custom.
Specifications
| Rating | 3.2 |
| Business per user* | £1.58/user/mo annual only (Business) |
| Individual | £1.62/mo annual only |
| Free tier | Limited |
| Seat minimum | 1 |
| Breach on record | No |
| Last audit | None published |
| Open source | No |
| Self-host | ✓ |
| Passkeys | Store |
| TOTP codes | ✓ |
| Hardware key | No |
| SSO | Included |
| SCIM | ✓ |
| Shared vaults | ✓ |
| Secrets manager | No |
| CLI | No |
| MCP server | ✓ |
| Owned in** | Other |
| Data location | Your own cloud (personal) or your Microsoft 365 / Google Workspace tenancy (business) |
| Trustpilot (reviews) | 4.1 (70) |
| Family plan | £3.25/mo (6 seats) |
| Scored tier | Business |
| Tier above | Enterprise (custom) |
| Free tier limits | Free desktop app; limits not published |
| Money-back (days) | 0 |
| Encryption | AES-256 via SQLCipher; PBKDF2-HMAC-SHA512 320,000 rounds |
| Zero-knowledge | ✓ |
| Bug bounty | No |
| Email aliases | No |
| Built-in VPN | No |
| Admin console | ✓ |
| Role-based permissions | ✓ |
| Password health reports | ✓ |
| Dark-web monitoring | ✓ |
| External sharing | No |
| Guest accounts | No |
| Emergency access | ✓ |
| Audit logs | ✓ |
| Browser extensions | Chrome, Edge, Firefox, Safari, Brave, Vivaldi, Opera |
| Desktop apps | ✓ |
| Linux | ✓ |
| API | No |
| HQ | India |
| Owner | Sinew Software Systems |
| SOC 2 | ✓ |
| ISO 27001 | ✓ |
| Live chat | No |
| Phone support | No |
| Support channels | Email, Forum, 24/7 technical support (business) |
*Business per user: the business or teams tier the score is set on, per user per month on annual billing and then month-to-month, in the currency the vendor shows a UK visitor on the research date; see each profile for the VAT basis, the seat minimum and what the tier above adds.
**Owned in: where the company that owns the provider answers to. A US-owned provider is subject to US law (including the CLOUD Act) wherever the vault is stored; with a zero-knowledge design the vendor cannot read the vault either way, so this column is about the company, not the encryption. "Data location" records where the encrypted vault is stored.
Researched and drafted with AI assistance; reviewed and approved by Tim Meredith. How we use AI
Work at Enpass? Something not look right? Register in the vendor portal to see what we publish and send corrections.