RoboForm

Who owns it

RoboForm is made by Siber Systems Inc., a private Virginia corporation in Fairfax, and its copyright line runs from 1999, which makes it the oldest product here. The security white paper (February 2023) describes AES-256 with the master password stretched through a million rounds of PBKDF2-SHA256 and a 32-byte salt, a twelve-character minimum password that business admins can raise but not lower, and RSA-2048 key pairs for sharing; everything is encrypted on the device. Secfault Security ran a penetration test in 2025 and the summary is linked from the security page, and there is a bug bounty. What we did not find is any SOC 2 or ISO 27001 statement, and the privacy policy is plain that customer data is stored on Siber's servers in a US data centre, with UK and EU transfers covered by the Data Privacy Framework rather than a European region. The clients are closed source and self-hosting exists only at Enterprise scale for a thousand users or more. On the record: the 2025 browser-extension clickjacking class disclosed at DEF CON, which RoboForm patched in version 9.7.6 in July, before the public talk.

What it costs

Prices in pounds on 8 September 2026 with no VAT statement on the page, all on annual billing. Free covers one device with no sync. Premium is £1.99 a month (£23.88 a year) with a first-year promotion at £15.90, and Family £3.16 for five accounts, both with a 30-day money-back guarantee. Business is £2.66 a user a month with no stated seat minimum, and the notable thing is what is inside it: SSO with Entra ID, Okta, Google Workspace, Ping and OneLogin, SCIM provisioning, role-based permissions, dark-web monitoring, exportable activity logs and a free Family plan for every user in companies with ten or more licences. No other vendor here bundles SSO and SCIM at the entry business price. The business trial needs no card, the licence terms enable auto-renewal by default fourteen days before expiry, and refunds exclude business licences.

What you get and what to watch

Credentials are covered in full: passkeys are stored and can unlock the vault, TOTP codes are generated inside it, and a hardware security key or passkey works as a second factor. The form-filling that made RoboForm's name is still its best feature. What it lacks is the developer layer: no command-line tool, no public API and no MCP server were found, and there is no Linux app. Support is 24/7 by email with live chat and phone on weekdays from Virginia. Trustpilot is 4.6 on 542 invited reviews, 83% five-star and 5% one-star, with mobile navigation and lockouts the recurring complaints.

Not yet tested by Saaskly: assessed on published pricing, documentation, audit reports and third-party reviews.