Best Password Manager for UK Small Business in 2026: Proton Pass Wins, 1Password Sets the Standard, and What the LastPass Fine Tells You

A password manager is the one piece of software a small business cannot afford to choose badly, because it holds the keys to everything else. So before we looked at features we asked three questions of each of the eleven products here. What does it cost per user on the tier a team of two to fifty actually needs, on annual billing and month to month, and what does single sign-on add? Has the vendor ever been breached, and what did it do next? And where do the company and the encrypted vault sit, because a US-owned company answers to US law wherever its data centre is, and a zero-knowledge design means the vendor cannot read the vault either way.

The answers spread the field. Business tiers run from £1.58 a user at Enpass to $8 at Dashlane, and only NordPass, Zoho Vault, Proton Pass and Passbolt let you pay monthly. Four vendors publish open-source clients, two of them the server too. Five have public third-party audit reports, and Bitwarden lists twenty-four. One has a breach on the record that ended in a £1.2 million fine from the UK Information Commissioner in December 2025, and it is last.

We also looked hard at the things a 2026 buyer should care about that a 2020 review would not have mentioned: whether passkeys are stored and whether one can unlock the vault, whether two-factor codes live in the vault, whether a hardware key protects it, and whether there is a command-line tool, an API and an MCP server so that scripts and AI agents can fetch a credential without a human pasting it. Six of the eleven now ship an MCP server, and the designs differ: 1Password's will never return a secret value to the agent, Bitwarden's can read and write the vault, Dashlane's only reads the audit log.

Proton Pass is first-party: Saaskly's own secrets live in it. The other ten are assessed on published pricing, documentation, audit reports and Trustpilot, and are labelled "Not yet tested". Prices were read on 8 September 2026 in the currency each vendor shows a UK visitor: pounds at Keeper, NordPass, Zoho Vault, RoboForm, Enpass and LastPass; euros at 1Password and for Proton's business tiers; dollars at Bitwarden, Dashlane and Passbolt.

The winner

Proton Pass: Swiss law, open code, a real free plan

Proton Pass wins because it answers the three questions best for the reader this site serves. Where does it sit? Geneva, under Swiss law, inside Proton AG, a company majority-owned by the non-profit Proton Foundation that has never taken venture capital and says it discloses the little data it holds only on a binding request from the competent Swiss authorities. Has it been breached? No. The clients are open source, Cure53 audited the extensions, apps and API in 2023 and the report is public, and the bug bounty pays up to $100,000. What does it cost? Individuals get a free plan with passkeys, unlimited devices and ten email aliases, or Pass Plus at £2.39 a month on the annual plan for unlimited aliases, the built-in two-factor authenticator, sharing, dark-web monitoring and emergency access. A team pays €1.99 a user a month on annual billing for Pass Essentials (€4.99 month to month, three-user minimum) with an admin panel, shared vaults and health reports, or €4.49 (€6.99 monthly) for Pass Professional with SAML single sign-on, SCIM provisioning, activity logs, enforced policies and the command-line tool. Both have a 14-day trial, a 30-day money-back guarantee and a 99.95% uptime commitment.

The honest caveats. Business pricing is in euros with no pound option on the page, and the individual plans are in pounds, which is odd. The admin console is younger than 1Password's or Keeper's, and SSO needs the Professional tier. There is no SOC 2 or ISO 27001 published for Pass, no self-hosting, and no official MCP server yet, although the read-only, time-limited access tokens Proton added in May 2026 are a careful way to let an agent fetch a credential with an audit-log entry for each use. And Proton's company-wide Trustpilot is 2.2 on 1,779 reviews, most of them about Mail and VPN billing and support rather than Pass; G2 rates Pass for Business 4.7.

In our experience: Saaskly's own secrets, including every credential this site runs on, live in Proton Pass, and it has been reliable for us. We chose it for the jurisdiction, the ownership and the open-source clients as much as the price. Saaskly has an affiliate link for Proton Pass; the verdict came first and the link does not affect the score.

The runner-up

1Password: the business benchmark

If the question is "which product would an IT manager pick for fifty people", the answer is still 1Password. Every account is protected by a Secret Key as well as a password, so a stolen password alone opens nothing. The Business tier at €7.99 a user a month on annual billing includes SSO with Okta, Entra ID, OneLogin and Duo, SCIM provisioning, guest accounts for outside collaborators, Watchtower reporting, audit-ready activity logs and sharing with people who do not use 1Password; the fixed ten-seat Teams Starter Pack at €21.95 a month (about €2.20 a seat) gives a small company the vault and admin console without SSO. The trust centre lists SOC 2 Type 2 and ISO 27001, the one incident on record, a September 2023 attempt on 1Password's own Okta tenant, was stopped and disclosed by the company with no user data touched, and the developer tooling (CLI, SDKs, Secrets Automation, an official MCP server that never returns a secret value) is the most complete in the field. Trustpilot is 4.2 on 12,475 reviews. Against it: no free plan, no pound pricing (a UK visitor is shown euros with no VAT statement), annual billing only on Business, closed source, no self-hosting, and no phone support. Not yet tested by Saaskly.

Why Proton Pass edges it

Price and provenance. A team of ten pays Proton €19.90 a month for Essentials or €44.90 for Professional with SSO; it pays 1Password €21.95 for the starter pack without SSO or €79.90 for Business with it. Proton's clients are open source and audited in public; 1Password's are closed with the reports behind a request form. Proton is Swiss and foundation-owned; 1Password is Canadian and venture-backed, which is fine, but is a weaker answer to the jurisdiction question. Where 1Password wins is the admin experience, guest accounts, the SDKs and the MCP design, and for a company that lives in an identity provider and wants the most mature console, it is the right buy. For the readers Saaskly writes for, the price and the ownership decide it.

The open-source alternative

Bitwarden (4.1) is the password manager you can read: clients and server on GitHub, self-hosting for those who want it, an EU cloud region on any plan chosen at signup, twenty-four published audits since 2018 including a 2025 cryptography review by ETH Zurich, SOC 2 Type II and ISO 27001. A full free plan for individuals, Families at $3.99, Teams at $4 a user with shared collections, event logs, SCIM and the public API, Enterprise at $6 with SSO and policies; all in dollars and all on annual billing. The tooling matches 1Password's, with a CLI, a REST API, a Secrets Manager and an official MCP server that can read and write vault items, so read its permissions before an agent gets a session token. The October 2024 SDK licence episode was reversed within a week. Trustpilot is 3.2 on 362 reviews, with extension lag and lockouts the themes. If SSO on the entry business tier mattered less than owning the code, this would be second. Not yet tested by Saaskly.

Full comparison

The pound-priced trio

Keeper (3.7) has a UK price list and the deepest compliance stack here: ISO 27001, SOC 2 Type 2, FIPS 140-3, an EU data region, passkeys that unlock the vault, a TOTP authenticator, YubiKeys, One-Time Share for sending a record to anyone, vault transfer when someone leaves, 24/7 phone support, a Commander CLI, Terraform providers and a vendor-built MCP server. Business Starter is £2.00 a user a month, Business £3.50, Enterprise £5.00, all billed annually with no monthly option and no free plan, and Enterprise is where SSO and SCIM live; reporting, dark-web monitoring and the Secrets Manager are paid add-ons at every tier. Two things to weigh: in 2017 Keeper sued Ars Technica over its report of an extension vulnerability, then dropped the suit; and Trustpilot's 3.2 on 3,164 reviews reflects recent lockout and renewal complaints outweighing an older five-star base. Not yet tested by Saaskly.

NordPass (3.6) is Nord Security's password manager, priced in pounds before VAT the Nord way: an introductory rate against a struck-through list price, three billing terms, and the renewal rate not shown. Teams is £1.99 a user a month on a one-year term, £2.49 month to month, sold in ten-user packs with Google Workspace SSO; Business is £3.99 with a five-seat floor; Enterprise at £5.99 adds Entra ID and Okta SSO with provisioning. XChaCha20 and Argon2id, ISO 27001, SOC 2 Type 2 and a Cure53 badge, passkeys, a built-in authenticator, email masking, 24/7 live chat and a Trustpilot 4.0 on 2,064 invited reviews. What it lacks is any command-line tool, public API, MCP server or open-source code, and a clear statement of which company you contract with or where the vault sits. Not yet tested by Saaskly.

Zoho Vault (3.5) is the cheapest business tier on this page and the most generous free plan: unlimited passwords, passkeys and devices for nothing, with passkey, YubiKey and biometric unlock and a built-in authenticator. Standard is £0.90 a user a month, Professional £3.13 (£3.50 monthly, five-user minimum) with folder sharing, breach alerts, a break-glass account and a CLI, and Enterprise £6.30 with SSO, all before VAT and all with monthly billing. Against it: SSO only at Enterprise, no published audit or ISO 27001 statement, no bug bounty page, no MCP server, a data centre assigned by signup region with no UK centre confirmed, and, as with Zoho CRM, less polish than the price suggests. Not yet tested by Saaskly.

The rest of the field

RoboForm (3.4) has the simplest business deal here: £2.66 a user a month with SSO and SCIM included, plus a million-round PBKDF2 master key, passkeys that unlock the vault, a TOTP authenticator, hardware-key support, a 2025 penetration test summary and a Trustpilot 4.6. It stores data only in the US, publishes no SOC 2 or ISO 27001, has no CLI, API, MCP server or Linux app, and bills annually only. Not yet tested by Saaskly.

Dashlane (3.3) hosts its vaults in Dublin with a French company as GDPR controller, derives SSO keys inside AWS Nitro enclaves, holds ISO 27001 and SOC 2 Type II, and ships an open-source CLI, a read-only API and an MCP server for audit logs. It is mid-table because the business product, now "Omnix", charges $8 a user on annual billing for the vault half alone, in dollars with no pound page; there is no free plan any more, no desktop app, TOTP lives in a separate authenticator app, business cancellations need thirty days' notice or the year renews, and Trustpilot is 2.8 on 6,127 reviews. Not yet tested by Saaskly.

Enpass (3.2) stores nothing on its own servers: personal vaults sync through your own iCloud, Google Drive, OneDrive, Dropbox or WebDAV, and the business tier keeps the vault inside your own Microsoft 365 or Google Workspace tenancy. Business is £1.58 a user a month with SSO, SCIM, audit logs, dark-web monitoring, offboarding deletion and an MCP server included, ISO 27001 and SOC 2 Type II are claimed, and individuals can buy a three-year or lifetime licence. The auditor is unnamed, there is no CLI or API, the company's own pages block reading, and there are seventy Trustpilot reviews. Not yet tested by Saaskly.

Passbolt (3.1) is the European open-source team vault: a Luxembourg company, AGPL code including the paid edition since August 2026, four Cure53 audits and a public incident log since 2017, free to self-host with unlimited users, or cloud-hosted in Belgium and Germany from $5.40 a user monthly and in a sovereign Luxembourg centre at $8. It is built for organisations only: no personal or family plan, a ten-seat minimum on paid tiers, dollars or euros only, no passkeys, no macOS or Linux desktop app, no MCP server, and not one Trustpilot review. For a technical EU team that wants to own and read its vault, it is the purpose-built choice. Not yet tested by Saaskly.

The one we marked down

LastPass (2.3) is last, and the record is why. In August 2022 an attacker took source code from its development environment; between November and December 2022 the same attacker copied customer details and encrypted vault backups, with the website URLs inside them unencrypted, and LastPass confirmed the vault theft on 22 December, three weeks after a notice that had described only cloud-storage access. In March 2023 it disclosed that the way in had been a senior DevOps engineer's computer, compromised through vulnerable third-party software. The vaults were only as strong as the key-stretching behind them, and old accounts were found with as few as one to five hundred rounds of PBKDF2 against a 2018 default of 5,000 and the million that RoboForm and Keeper use; Krebs on Security reported in September 2023 that researchers had tied more than $35 million of cryptocurrency theft to cracked vaults, TRM Labs traced about the same figure to Russia-based operators in a report published in January 2026, and the US Secret Service seized $23 million of it in 2025. On 11 December 2025 the Information Commissioner's Office fined LastPass £1.2 million over the breach, which affected up to 1.6 million people in the UK. And on 23 June 2026 LastPass confirmed that an extortion group had used tokens stolen from a supplier, Klue, to read customer names, addresses and support cases from its Salesforce system.

The fixes are real: twelve-character master passwords since January 2024, encrypted URLs since May 2024, a new cloud platform, ISO 27001, ISO 27701, SOC 2 Type II and BSI C5. The product is competent and priced in pounds, with passkeys and an authenticator on every plan and Teams at £3.83 a user for up to fifty people, though SSO is capped at three applications until Business Max at £8.50. Trustpilot is 1.4 on 930 reviews. Our view is the one you would expect: the breach was four years ago and the company has done the work, but the disclosure pattern, the defaults left on old accounts, the regulator's finding and a further customer-data breach in 2026 mean every other product on this page does the job without that history. If you are still on it, the migration is an afternoon.

Bottom line

• Price the tier you need, on both bases. For a team of ten: Enpass £15.80 a month, Proton Pass €19.90 (€44.90 with SSO), NordPass £19.90, Keeper £20, 1Password €21.95 (€79.90 with SSO), RoboForm £26.60 with SSO, Zoho Vault £31.30 (£63 with SSO), Bitwarden $40 ($60 with SSO), LastPass £38.30 (£55 with SSO for three apps), Passbolt $54, Dashlane $80. Only NordPass, Zoho Vault, Proton Pass and Passbolt bill monthly.
• Read the record, not the badge. Every vendor claims zero knowledge. Four publish open-source clients, five publish audit reports, and one has a £1.2 million fine from the ICO. That is the column that should decide a close call.
• Proton Pass is the one we use and recommend, for the jurisdiction, the ownership, the open code and the price.
• 1Password if you want the best admin console and the most careful MCP design and can pay €7.99 a user; Bitwarden if you want to own the code, self-host or pick an EU region at $4 a user.
• Keeper, NordPass or Zoho Vault for a pound price list, in that order; RoboForm for SSO and SCIM at £2.66; Enpass to keep the vault in your own Microsoft 365 or Google tenancy; Passbolt for an EU-owned, fully open-source team vault you run yourself.
• Leave LastPass. Every product above does the job without the history.

Prices checked 8 September 2026 on each vendor's UK-facing pages, in the currency shown to a UK visitor: GBP for Keeper (VAT basis unclear on the page), NordPass and Zoho Vault (ex VAT), RoboForm (VAT not stated), Enpass (business ex VAT) and LastPass (ex VAT); EUR for 1Password (VAT not stated) and Proton's business tiers (tax "may apply"); USD for Bitwarden, Dashlane and Passbolt (tax not stated). The LastPass fine and 2026 breach were confirmed from BleepingComputer and The Register the same day; the ICO's own notice was not read because its site blocks fetching. Trustpilot scores are from uk.trustpilot.com on the same date; Proton's and Zoho's are company-wide, Passbolt has none. Proton Pass is first-party; the rest are labelled "Not yet tested by Saaskly". Saaskly has affiliate links for Proton Pass and NordPass; no one on this page is sponsored, and commercial relationships never affect scores.