Password managers for MSPs: 23 products compared
"Password manager for MSPs" covers two different purchases. One is the vault your own technicians use to store and share client credentials, often tied to your documentation. The other is a business password manager you roll out to every client's staff and bill per seat. The catalog's Password Management category lists 23 products from 19 vendors as of October 2026. This guide separates the two jobs and covers what to check for each.
Key facts, October 2026
- 23 products from 19 vendors are listed under Password Management.
- 22 are client-facing: 14 resold, 8 run by the MSP and paid for by the client. 1 is not yet classified.
- 10 expose a public API, 6 have a verified MCP server and 2 a CLI. Keeper has all three.
- 4 list a verified ConnectWise PSA integration, 3 Autotask and 2 Halo PSA.
- 14 of the 23 come from US vendors and 4 from Canada.
Two jobs: your technicians' vault, and your clients' password manager
The technician vault. Your team needs every client's admin credentials, Wi-Fi keys and service accounts, stored per client, shared by role and logged when used. Several of these tools are tied to documentation. Passportal from N-able combines a password manager with a documentation manager, with permissions down to client, folder and single password. CyberQP covers help desk identity verification and privileged access for MSPs, with an audit trail of every action. IT Glue's My Glue is the bridge: it shares documentation and passwords from IT Glue with your clients' staff through a portal. Related tools are in Documentation & Knowledge Base and Privileged Access Management (PAM).
The client password manager. Each client gets its own tenant, its staff get vaults, and you manage all of them from one console. This is the resale business. 1Password Enterprise Password Manager MSP Edition, Keeper, Bitwarden Business Password Manager, LastPass, NordPass Business, Dashlane Business Password Manager, Zoho Vault, CyberFOX Password Manager, Judy Password Manager and JumpCloud's Password Manager all serve this job.
CyberFOX's product, previously sold as Password Boss, sits between the two. Its MSP portal manages every client and device, and its site lists instant login into remote control tools such as ConnectWise Control, TeamViewer, Datto, Splashtop and LogMeIn Pro.
How the MSP consoles work
The consoles for client password managers follow the same pattern: a partner account on top, a managed tenant per client below.
- Keeper calls them Managed Companies, run from a central MSP console (Keeper documentation).
- LastPass gives the MSP account the features of LastPass Business Max and a multi-tenant admin console with a company selector (LastPass support).
- Bitwarden uses a Provider Portal, with no fee, from which an MSP manages its client organisations. Provider admins can manage users, groups and collections in a client organisation but can't view its credentials, and each client organisation has its own policies (Bitwarden help).
- 1Password has an MSP console with consumption-based billing and no licence minimums, a view of each client's seat usage and invoice export as CSV.
Two details decide day-to-day work. First, whether you can set policy once for every client or have to repeat it per tenant: Bitwarden's help pages say each client organisation is configured on its own. Second, what your technicians can see inside a client's vault. Bitwarden answers that one in its documentation; ask the other vendors in the demo.
The landscape in numbers
| How MSPs relate to it | Products (of 23) |
|---|---|
| Resold to clients | 14 |
| Both: you run the console, the client pays | 8 |
| Not yet classified | 1 |
- More MCP servers than email security, DNS filtering or SASE. 10 products have a public API and 6 a verified MCP server: Keeper, Bitwarden Business Password Manager and Bitwarden Access Intelligence, 1Password Extended Access Management and Unified Access, and My Glue. Keeper also has a CLI.
- PSA integrations. Passportal lists ConnectWise and Halo, LastPass ConnectWise and Autotask, CyberFOX Password Manager ConnectWise and Autotask, NordPass Business ConnectWise, CyberQP Autotask and Keeper Halo. For resale, the integration that matters is billing sync, so seat counts reach your invoices.
- Some pricing is public. NordPass Business lists $1.79, $3.59 and $5.39 per user per month for its tiers.
- Reset and policy tools are listed elsewhere. Tools that manage Active Directory passwords rather than vaults, such as N-able's Blink self-service reset, Netwrix Password Policy Enforcer and Enzoic for Active Directory, sit under IAM Platforms and Active Directory & Cloud Directory. BeyondTrust Privileged Password Management and Click Studios Passwordstate stay here because they combine password management with PAM.
What separates products
- Multi-tenant administration. One login for every client, tenant creation in minutes, and technician roles that limit who sees which client.
- SSO and provisioning. NordPass Business lists SSO with Entra ID, ADFS, Okta and Google Workspace. RoboForm's business plans list SSO and SCIM provisioning. If clients already use Entra ID, users should arrive and leave with their directory account.
- Audit logs. Dashlane lists encrypted audit logs of credential sharing. Zoho Vault lists real-time audit trails. You will need these after an incident.
- Billing model. Per user per month, minimums, and whether seats sync to your PSA. 1Password lists consumption-based billing with no minimums. LastPass lists Autotask company and billing sync.
- Self-hosting and open source. Bitwarden is open source. Passwordstate is self-hosted.
- Employee families. LastPass offers family vaults for employees, on the reasoning that compromised personal accounts can affect the workplace. To find out when a client's credentials have already leaked, see Dark web monitoring for MSPs.
Questions to ask in the demo
- Show me creating a new client tenant, applying my default policies and inviting the first users.
- What can my technicians see inside a client's vault, and how is their access logged?
- How do seat counts reach my PSA for billing?
- What happens to a user's vault when they leave the client, and to the client's data if they leave me?
- Which SSO providers and SCIM directories do you support for my clients?
- Is there a separate product or edition for my own technicians, or do I use the same one?
How to use the catalog for this
The category page lists all 23 products with their flags. Each product page links the evidence behind its API and MCP flags, and the vendor page shows what else the vendor sells. The technician side overlaps with Privileged Access Management (PAM), with 31 products from 22 vendors, and Documentation & Knowledge Base, with 28 products from 22 vendors. If a password manager you use is missing, paste its URL and the system will classify and add it.
Frequently asked questions
What is the best password manager for an MSP?
It depends on the job. For your technicians' client credentials, look at documentation-linked vaults such as Passportal and CyberQP. For reselling to clients, look at products with a multi-tenant MSP console, such as 1Password MSP Edition, Keeper, Bitwarden, LastPass and NordPass Business.
Can MSPs resell business password managers?
Yes. Of the 23 products in the catalog, 22 are classified as client-facing: 14 resold and 8 run by the MSP and paid for by the client.
Which password managers have an MCP server?
Six products in October 2026, verified against documentation: Keeper, Bitwarden Business Password Manager, Bitwarden Access Intelligence, 1Password Extended Access Management, 1Password Unified Access and IT Glue's My Glue.
Which password managers integrate with ConnectWise, Autotask or Halo?
Passportal (ConnectWise and Halo), LastPass (ConnectWise and Autotask), CyberFOX Password Manager (ConnectWise and Autotask), NordPass Business (ConnectWise), CyberQP (Autotask) and Keeper (Halo).
Is a password manager the same as PAM?
No. A password manager stores and shares credentials for people. Privileged access management controls and records admin access to systems. For MSPs the two overlap in the technician vault, which is why products such as Passportal and CyberQP describe themselves in PAM terms.
Numbers are from the MSP Navigator catalog on 19 October 2026: 23 published products in Password Management. Product details come from each vendor's own website and documentation, checked on 19 October 2026. Capability flags are verified against vendor documentation and linked on each product page. The use-or-resell verdict is produced by a classifier reading each product's description and reviewed by hand in samples. Related guides: Dark web monitoring for MSPs, Microsoft 365 backup for MSPs, Email security for MSPs.