Choose 1Password if staff adoption is your binding constraint.
VerityLoft tested5 runs · 1 Aug 2026
How we arrived at this score
Scored against the Incumbent promise: nothing breaks and nobody second-guesses the choice. It ended a revoked session at once on all five runs, holds four ISO certifications, and asks least of your staff. It loses half a point for being the priciest of the three and for an undocumented trial card requirement.
Why This Review Exists
Most password manager reviews generally confirm that the product stores passwords. All of them do, so that finding helps nobody choose between them. We tested something narrower instead. When a seasonal preparer leaves your firm and somebody clicks revoke in the admin console, does that person's access actually stop? For a practice holding taxpayer data, the answer carries legal weight as well as practical risk.
1Password gave the best answer of the three products we ran, though it also costs the most and hides one condition the vendor never documents. This review therefore covers what we measured ourselves, what 1Password publishes, and the places where those two diverge. Where we could not confirm something, we say so rather than filling the gap with a confident sentence.
What Is 1Password?
1Password is a business password manager built by AgileBits. Your staff usually keep logins in shared vaults. An admin console governs who reaches what, while browser extensions fill credentials on the sites your firm uses daily. Ultimately two plans matter to a small practice. The Teams Starter Pack meanwhile covers ten members for a flat monthly fee. Business charges per user instead, and it adds single sign-on, event logs and the Events API.
That split, however, matters more than the price gap suggests. Business is specifically the tier that lets you prove what happened. Event logs are what an auditor asks for, and the FTC Safeguards Rule expects your firm to keep them. So a practice with audit obligations is effectively buying Business rather than choosing it. Starter Pack suits a ten-person office with no compliance exposure, though few accounting firms fit that description.
What Happens When You Revoke a 1Password User?
Here is exactly what we ran. We created a test user and signed that user in on a second browser. Opening an item first confirmed the session was genuinely live. Then we revoked the account from the admin console and kept probing with a forced sync. The session died on the spot. That sounds unremarkable until you see the alternative, because one competitor left an identical session working for at least five minutes.
We ran that test five times. The session died at once on every attempt, which rules out a lucky first result. One caveat still belongs here, though. We tested the web surface rather than a long-running desktop client, and a desktop app holding a local cache may behave differently. Even so, the gap between instant and five-minutes-and-counting is not the kind of difference that reverses.
Why it matters for your firm comes down to the rule itself. The FTC Safeguards Rule requires access controls that permit access only to authorised users. A departed preparer is obviously no longer authorised by any reading. If your offboarding checklist assumes access ends the moment somebody clicks the button, 1Password is a product where that assumption currently holds.
What Did We Measure Ourselves?
| What we measured | Result | Runs | Tested |
|---|---|---|---|
| Live session after admin revocation | Ended immediately seconds | 5 | 2026-08-01 |
| Trial credit card required | Yes boolean | 1 (single observation) | 2026-08-01 |
How we tested: Live session after admin revocation
Test user logged in on a second browser and confirmed live before each run. Account revoked from the admin console. Probe was a forced sync plus opening an untouched item. Repeated five times.
How we tested: Trial credit card required
Signed up for the business trial and recorded whether payment details were mandatory.
Which Features Matter for Your Firm?
Watchtower is the headline feature, and it gets misdescribed constantly. It audits specifically what already sits in your vaults. That means weak passwords, reused passwords, and sites offering two-factor that nobody enabled. Notably it is not a broad dark-web sweep, whatever the marketing implies. The separate domain breach report, however, does draw on Have I Been Pwned. That one runs on Teams and Business alike, so the capability exists under a different name.
Account recovery is the standout admin capability. Owners, administrators, or indeed any group holding the Recover Accounts permission can restore a locked-out user. That person then creates a fresh account password and Secret Key. Delegating that to a permission group is the genuinely useful part. Your firm does not, therefore, need a partner on holiday to unblock a junior during busy season. Few competitors, notably, handle the delegation this cleanly.
One claim we cut belongs in the open. We could not confirm that admins can remotely rotate a user's stored credentials. The support documentation, moreover, does not describe it anywhere we looked. So we make no such claim, even though it appears in third-party summaries of the product.
Which Certifications Does 1Password Actually Hold?
1Password holds SOC 2 Type II alongside four ISO certifications: 27001, 27017, 27018 and 27701. That breadth is unusual in this category, and 27701 in particular covers privacy information management rather than security alone. Encryption is AES-256-GCM, layered further with the Secret Key. Because that key never reaches 1Password's servers, a breach of their infrastructure does not by itself expose your vaults.
Two gaps nevertheless deserve stating plainly. Current penetration test reports sit behind a request wall rather than being published. So your firm cannot check the latest one without asking. Also, 1Password makes no FedRAMP claim at all. Neither gap matters to most accounting practices, yet both matter a great deal if yours serves federal clients.
A word on what SOC 2 buys your firm, though: nothing directly. It attests to controls at the vendor, not at your practice, so your own obligations under the Safeguards Rule stay entirely yours. However, the report is fair evidence toward the service-provider assessment that 16 CFR 314.4(f) requires you to perform. Treat it as one input to your compliance file rather than a substitute for it.
What these certifications do and do not cover
A SOC 2 report attests to controls at the vendor, not at your practice. Your own obligations under the FTC Safeguards Rule stay yours, and no vendor certificate discharges them. The report is fair evidence toward the service-provider assessment that 16 CFR 314.4(f) requires you to perform, and nothing more.
Does 1Password Have a Free Trial?
The trial runs 14 days, and it also requires a credit card. That second part is worth knowing, because no official 1Password page we found states the policy either way. We signed up and consequently met the card wall ourselves. So budget holders should plan on entering payment details before anyone in your firm touches the product.
For practices where a purchase order takes longer than a fortnight, that is a practical obstacle rather than a footnote. Ask your finance lead before you start the clock, since the trial converts to a paid plan unless somebody actively cancels it. Two weeks is enough to pilot with two or three staff, provided the approval is already sitting in hand.
How Much Does 1Password Cost?
Business runs $8.99 per user / month on annual billing. The Teams Starter Pack covers ten members for $24.95 / month, also billed annually. Run the arithmetic before assuming Starter Pack is the bargain. At ten seats it does indeed work out cheaper. Yet it omits single sign-on and event logs, and those logs are what let your firm answer an auditor without guessing.
So the honest framing is simple. Starter Pack suits a practice of ten with no audit obligation, while everyone else is buying Business whether they planned to or not. Measured against the alternatives, 1Password is the most expensive of the three products we tested, and that gap widens as your headcount grows.
1Password vs Bitwarden: Which Is Better for a Small Firm?
Bitwarden costs less, at $4 per user per month on Teams and $6 on Enterprise. So the case for paying more than twice that needs to be concrete. Two things particularly justify it. Our revocation test separated the two decisively, since Bitwarden's session survived past five minutes where 1Password's ended at once. Adoption is the second reason, because staff resistance is a real cost that never appears on an invoice.
Against that, Bitwarden conversely lets one account belong to many organisations. For a fractional CFO juggling six client entities, that architecture beats anything 1Password offers, and no amount of polish closes the gap. Switching itself is unremarkable, though. Both products import from common formats, so plan on re-enrolling every user rather than migrating live sessions across.
What Are the Pros and Cons?
Pros
- Revoked session died immediately in our test
- Lowest staff friction of the three we tested
- Admin account recovery via a dedicated permission group
- Four ISO certifications, not one
- SSO on Business removes the Secret Key step entirely
Cons
- Priciest of the three at $8.99 per user / month
- Secret Key adds a step at setup unless you run SSO
- Trial needs a card, and this is documented nowhere
- Current penetration tests sit behind a request wall
- No FedRAMP claim at all
Who Is 1Password Best For?
1Password especially suits firms where adoption is the binding constraint. Partners who resent security tooling resent this one least, and that matters more in practice than any feature list. Similarly it suits audit-conscious practices, provided they buy Business rather than Starter Pack. Event logs and the Events API are the difference between believing a control worked and proving it.
Look elsewhere, though, in two cases. Budget-led firms will find Bitwarden does most of this for less than half the price. The functional gap is generally narrower than the price gap suggests. Meanwhile anyone managing multiple client entities under a single login should weigh Bitwarden's multi-organisation model first. That is a structural advantage rather than a feature.
Is 1Password Right for Your Firm? Final Verdict
1Password takes 4.5 out of 5. It pairs the fastest revocation we measured with, notably, the lowest adoption friction of the three. That is exactly what a safe default ought to offer your firm. The half point comes off for price, and also for a trial card requirement the vendor documents nowhere. Neither is disqualifying, yet both are things your practice should know before the demo.
That verdict rests on five revocation runs, every one of which killed the session on the spot. So if your offboarding process assumes access ends the moment you click revoke, this is a product where the assumption holds. Two of the three we tested cannot say the same, and their gap is measured in minutes.
Frequently Asked Questions
Does 1Password Business include event logs?
Yes, event logs and the Events API are both part of the Business tier. Notably the Teams Starter Pack includes neither. The Teams Starter Pack does not include them, so a firm with audit obligations should budget for Business.
Do I need a credit card for the 1Password trial?
Your firm will need one. We signed up and hit a card wall, though no official 1Password page states this policy. Plan on entering payment details before the trial begins, and cancel deliberately if you decide against it.
What is the Secret Key and does every user need one?
The Secret Key is essentially an extra credential combined with your password to decrypt your vault. Every user gets one at setup, however Business plans using single sign-on remove that step for end users entirely.
Can a 1Password admin recover a locked-out staff member?
An admin can indeed do this. Owners, administrators, or indeed any group holding the Recover Accounts permission can restore access. The user then creates a new account password and Secret Key.
Is Watchtower dark-web monitoring?
Not exactly. Watchtower instead audits credentials already stored in your vaults for weakness, reuse and missing two-factor. The separate domain breach report is specifically the feature that draws on Have I Been Pwned.
Does 1Password hold FedRAMP authorisation?
No, and it makes no such claim. If your firm serves federal clients with FedRAMP requirements, this is a genuine gap worth raising before you commit.
Sources and Further Reading
From VerityLoft
Primary sources