Keeper Review

Keeper is the vault you price when the board wants a published per-user rate and a later path into privileged access, not only a shared folder.

The buying mistake is treating the Starter seat as the SSO seat. Single sign-on and SCIM sit on Enterprise, so a directory that already provisions joiners is a different purchase from the small-team vault.

Dark web monitoring and the alert module that feeds a SIEM sit on add-ons, including on that Enterprise tier, so the order you sign still leaves detection unbought.

Below are the personal plans, the three business seats, and the endpoint add-on, set beside 1Password, Bitwarden, Dashlane, Proton Pass, and NordPass.

The rest of the category is in our password manager comparison.

Toolradar data: the September 2026 password-manager ranking evaluated 37 products, and Keeper is on that list.

How we compared: on September 24, 2026 we read Keeper's US price catalog (USD, tax not included in the figure), the plan guide updated July 15, 2026, and the personal and business pricing pages.

That pass also covered 1Password's USD personal pricing, Bitwarden's business pricing, and Dashlane's pricing page.

Proton figures are the 12-month cycle in Proton's USD plan catalog. NordPass bills its business plans in USD and leaves VAT off the amount shown before you pay, and no vendor paid for inclusion in this review.

Keeper Security sells a zero-knowledge vault for passwords, passkeys, files, and, on the higher products, infrastructure secrets.

Encryption and decryption happen on the device, and the security architecture page wraps each record in a 256-bit AES key generated on the client, so logins, attachments, TOTP codes, payment data, URLs, and custom fields stay inside that encryption.

A copy of the database is not a readable vault, which is what you tell an assessor who asks whether staff can open an employee's records.

A master-password login derives that key on the device with PBKDF2 at 1,000,000 iterations, the stretch you cite instead of a vague encryption claim. An SSO login unwraps the data key with an elliptic-curve device key, and a new device needs approval from the user, an admin, or Keeper Automator on the customer's side.

Keeper employees are outside that approval, which keeps zero-knowledge intact when the identity provider handles the login.

The business comparison lists SOC 2 Type 2, SOC 3, and ISO 27001, 27017, and 27018, and the security page lists FIPS 140-3. Those names clear a checkbox and still leave you to tie the reports to your own system.

FedRAMP High and GovRAMP are GovCloud only on every business column, so a commercial tenant does not inherit that authorization by buying Enterprise.

Keeper's July 15, 2026 plan guide says more than 93,000 businesses use the product, and that number is Keeper's own count, not a third-party census. The same guide splits the buy into Business Starter, Business, Enterprise, Endpoint Privilege Manager, and KeeperPAM, with KeeperPAM available only as a quote.

A personal signup is a 30-day trial, then Keeper Unlimited or Keeper Family. Family gives five private vaults whose members cannot see one another's records unless someone shares them, so a household is separate vaults rather than one shared login.

BreachWatch, the dark web scan of vault passwords, is an add-on on both, and file storage is an add-on on Unlimited while Family includes 10 GB, so those extras on the one-person plan are a second invoice.

A business rollout starts in the admin console, where Starter covers 5 to 10 users with shared team folders, autofill, and basic two-factor authentication, enough when the company will share logins and stop there.

Business adds organizational structure, a risk dashboard, and a free Family plan for each user, which covers home passwords without a second vendor. Business, Enterprise, and KeeperPAM offer a free trial whose length Keeper does not state, so do not put a day count in the project plan.

On a new laptop, the device generates its own key pair, the identity provider signs the user in, and someone has to approve the device before the data key is re-encrypted for it. An admin can approve that device from the console, and the ticket shows up on every rebuild.

That approval is an identity check, not a way for Keeper to read the vault.

Reporting is the rough edge: activity reporting is included, while Advanced Reporting and Alerts is an add-on on Starter, Business, and Enterprise, and the SIEM feed requires that add-on on every column. A team that promised Splunk events on the Enterprise order has not bought them yet.

Keeper prints personal annual totals and three business monthly rates, and the US figures do not include tax. The number on the card is the vault, not the control stack. Put add-ons in the budget before anyone treats the seat as the whole program.

Keeper Unlimited is the one-person year, shown as $3.58 per month, and there is no free personal plan once the trial ends. Keeper Family is $91.99 for the year, shown as $7.67 per month, for five private vaults and 10 GB of file storage.

Unlimited does not include that storage, so files are an extra. The personal BreachWatch add-on is $26.99 for the year, and the family BreachWatch add-on is $53.99 for the year. The personal trial lasts 30 days, then the paid year starts.

Business Starter is $24 per user per year, the annual form of the monthly rate on the card, capped at 5 to 10 users. Ten Starter seats come to $240 for the year, and an eleventh person leaves that band, so growth forces a plan change.

Business is $48 per user per year, with a minimum of five users in the July 2026 plan guide, and each user can open a free Family plan. Eleven Business seats come to $528 for the year, a real step up from Starter that buys departments, the risk dashboard, and the family vault.

Enterprise is $72 per user per year at the published start rate. Twenty-five people on that start rate come to $1,800 for the year before add-ons. Keeper still routes that tier through a quote, because SSO, SCIM, and advanced MFA are why you are there.

Endpoint Privilege Manager is $36 per endpoint per year in the same July 2026 guide, the published way to price local admin rights beside the vault. KeeperPAM is a custom quote: two endpoint licenses come with each PAM license, and further endpoints use that per-endpoint rate, so the quote is not an unlimited estate.

BreachWatch for business is an add-on, and it is included with KeeperPAM, which is why some teams take the quote instead of stacking modules on Enterprise.

The same check for 1Password, Bitwarden, Dashlane, and Proton Pass is in the table. 1Password's low personal rate is a first-year promotion for new customers on annual billing, so the renewal is not that introductory rate.

Keeper fits a security team that wants a published vault seat and will move to Enterprise the day the identity provider has to provision users. Starter is the right quote for 5 to 10 people who will share folders and do not need SAML, a small company still doing joiners by hand.

Business is the right quote when you need departments, a risk dashboard, and a Family plan for each employee, and you can still live without SSO.

Skip Starter when Okta or Entra already runs joiners and leavers, because the directory will not be able to close the vault. Skip the ladder entirely when the pilot cannot put a card down, because the personal offer is a trial rather than a free vault.

Buy KeeperPAM when session recording and non-human identities are the project. That quote is a different purchase from a password seat, and it should stay out of the vault budget.

People who want a free account and a separate authenticator can stay on Bitwarden. A household that wants Swiss jurisdiction and hide-my-email aliases is closer to Proton Pass.

If alerting has to cover more than vault passwords, start with dark web monitoring tools. Pipeline secrets are a different product: see secrets management.

Hardware keys for the second factor sit in authenticator apps. Keeper's SOC 2 claim still has to be tied to your own evidence: see SOC 2 compliance automation.