Keeper Security

Keeper is the enterprise-focused password and secrets management platform from Keeper Security, a Chicago-based company founded in 2009 by Darren Guccione and Craig Lurey. It began as a consumer password manager and moved deliberately upmarket, so the product line now covers personal vaults, business password management, machine-to-machine secrets, privileged session brokering and breach monitoring. The primary buyers are IT and security teams at regulated organisations — healthcare, financial services, government, defence supply chain and critical infrastructure — although the same product serves small teams through its lower tiers.

The architecture is zero-knowledge and zero-trust. Records are encrypted and decrypted on the user's device with AES-256 in GCM mode, keys are derived from the master password through a strong key derivation function, and no plaintext credential or key material is stored on Keeper's servers. Keeper's own staff cannot read a customer vault, and a server-side compromise does not by itself expose plaintext. The company backs this with SOC 2 Type II, ISO 27001 and ISO 22301 certifications and has pursued authorisations that matter in public sector procurement, including FedRAMP. Buyers should still validate the current certification scope, as authorisations are product-specific.

At the individual level, Keeper stores passwords, payment cards, identities, secure notes and file attachments in an unlimited vault available across Windows, macOS, Linux, iOS, Android, the web vault and browser extensions. It generates strong passwords, autofills on web and mobile, warns about reused and compromised credentials, and works offline against encrypted local data. Two-factor options include TOTP applications, FIDO2 and WebAuthn security keys, biometrics on mobile, and Keeper DNA, which uses a paired device as an authentication factor.

Business password management is where most of the value sits. Vaults are organised into shared folders and team structures with granular permissions, so a group holds a credential rather than a person owning it privately. Access can be granted with an expiry, rotated on a schedule and revoked the moment someone leaves, which is what turns credential hygiene from a policy document into an enforced control. Role-based access control maps permissions to job function, and the admin console exposes policies for password complexity, permitted sharing, clipboard behaviour, screen capture and session timeouts. Directory synchronisation covers Active Directory, LDAP and SCIM provisioning through identity providers including Okta and Microsoft Entra ID, with SAML and OpenID Connect single sign-on so users authenticate through corporate identity. Audit logs and event streaming push records to a SIEM over syslog or HTTPS, giving security operations the trail compliance frameworks require.

Keeper Secrets Manager addresses machine identities, the gap most password managers leave open. It stores API keys, tokens, certificates and service credentials, exposes them to applications through an API, SDKs and CLI, and integrates with CI/CD and infrastructure tooling including Kubernetes, Jenkins, Terraform and GitHub Actions. Secrets are granted to a workload by policy rather than baked into a repository or an environment file, access is scoped and time-limited, rotation is automated, and every retrieval is logged. For a platform team managing production credentials in a config file or a chat thread, this module removes the most risk.

Keeper Connection Manager handles human privileged access. It is a browser-based client for RDP, VNC and SSH that requires nothing installed on the administrator's machine, brokers sessions against policy, records them for review and supports just-in-time elevation so standing administrative rights can be removed. Combined with Secrets Manager and the core audit trail it covers much of what a dedicated privileged access management suite does at a fraction of the deployment effort, though it does not replace the deeper session orchestration of CyberArk, Delinea or BeyondTrust in a mature programme.

BreachWatch and Dark Web Monitoring are add-on modules that screen vault credentials against known breach corpora and dark web sources, alerting users and administrators when a stored password appears in leaked data. For large estates the useful output is not individual alerts but a report showing how many employees still reuse an already-exposed password.

Deployment is broad. Extensions cover Chrome, Edge, Firefox and Safari, administrative tooling includes a command-line interface and PowerShell modules for scripted provisioning, and import utilities support migration from LastPass, 1Password, Bitwarden, Dashlane or spreadsheet-based storage — the practical barrier to switching managers is usually the vault export rather than the licence.

Compared with competitors, Keeper sits at the compliance-heavy end of the market. 1Password is the strongest general-purpose rival, better regarded for interface quality and developer experience. Bitwarden competes on price and offers self-hosting that Keeper does not. LastPass retains a large installed base but has struggled to rebuild trust since the 2022 breach and the exposure of customer vault data. Against the privileged access management specialists, Keeper's argument is that it delivers password management, secrets management and session brokering in one product line at a per-user price those vendors do not approach.

Pricing is per user per month billed annually, with a ladder published under names including Business Starter, Business, Enterprise and Enterprise Plus, where higher tiers add administrative controls, reporting and bundled access to modules such as Secrets Manager, BreachWatch and Dark Web Monitoring. Consumer plans run free, personal and family tiers. Historical published business pricing has sat in the low single digits per user per month at the entry tier and the mid single digits at the top, with add-on modules priced separately where they are not bundled. Keeper revises packaging and pricing periodically and negotiates volume deals, so current per-seat figures, module inclusions and minimum seat counts should be confirmed on their pricing page or through a quote.

The limitations are mostly about complexity and module economics. The feature set is split across tiers and add-ons, so a buyer has to model the real cost of the configuration they need rather than the advertised entry price, and the sales conversation is heavier than for a self-serve product. The interface is functional rather than polished, and adoption friction is real, since a password manager only delivers value if employees use it. There is no self-hosted option, so organisations with strict data residency requirements or air-gapped environments must confirm that Keeper's cloud regions satisfy them. Support tiers differ by plan and advanced reporting is a separate module.

Keeper fits regulated enterprises and public sector organisations that need certifications, audit trails and directory integration, platform and DevOps teams that need machine secrets under policy control alongside human passwords, and businesses wanting privileged session brokering without a full privileged access management suite. It does not fit organisations requiring on-premises credential storage, very small teams for whom a free manager is sufficient, buyers optimising purely on interface quality, or companies whose real need is secrets orchestration at the level of HashiCorp Vault.

Against alternatives, the choice is about what has to be proven. If the requirement is a pleasant, well-supported password manager for a commercial company, 1Password is usually the easier recommendation and Bitwarden the cheaper one. If the requirement is a documented control environment — certifications, FedRAMP-aligned posture, SIEM-streamed audit logs, role-based access, just-in-time privileged sessions and secrets scoped by policy — Keeper covers more of that surface in one product line than any competitor at a comparable price, and its module structure lets a buyer add secrets and privileged access later without changing vendors.