1Password vs heylogin

1Password

The security pages name AES-GCM-256 authenticated encryption, PBKDF2-HMAC-SHA256 key derivation, the 128-bit Secret Key combined with the account password, and SRP, and state that end-to-end encryption keeps Secure Data unreadable to the vendor. The independent work is real: ISO 27001, 27017, 27018 and 27701 plus SOC 2 Type 2 certifications, a 2020 ISE penetration test and code review, an Onica architecture audit, unaltered reports published through the Trust Center, and a public HackerOne bug bounty. We found no public information on a field-by-field statement of what is and is not encrypted, on disclosed incident history, or on open-source clients, so it sits just short of the top band.

heylogin

The architecture pages name the algorithms (XSalsa20 + Poly1305, Curve25519), describe a zero-knowledge cloud that functions solely as storage and cannot decrypt vaults, and offer a security whitepaper; the privacy policy states usernames, passwords and website URLs are end-to-end encrypted stored data. ISO 27001:2022 certification for the GmbH and a named security contact are published. We found no public information on independent penetration test reports, a bug bounty, or disclosed incidents, so the design rests on the vendor's own documentation.

1Password

Shared vaults carry five item permissions plus a separate manage-vault right that cannot view or edit items, groups, guests confined to a single vault, and business client settings that can switch off export, copy and share, print and item history per vault. Account recovery is documented with its key model: a new Secret Key and account password, two-factor reset, and recover-accounts groups deliberately excluded from automated provisioning to prevent account-wide cryptographic access. We found no public information on time-limited or one-time sharing with external parties or emergency access with a waiting period.

heylogin

Sharing is well documented: teams with permissions, hidden passwords, sending and receiving passwords with external parties, per-login assignment to individuals, and Enterprise custom roles with individually defined, freely configurable permissions. Recovery is documented with its key model — organisation vaults are also encrypted with admins' device security chips for cryptographic recovery, while admins cannot access personal vault contents. We found no public information on time-limited sharing, emergency access, or approval workflows.

1Password

This is close to what I run in Entra ID: Microsoft Entra ID, Okta and Google are named for both OIDC Unlock with SSO using Authorization Code Flow with PKCE and SCIM automated provisioning, deprovisioning in the identity provider suspends the team member, group access is granted and revoked automatically, and email address changes are managed in the provider first. The SSO unlock is described as using encrypted credentials and a device key with no account password, under an overall design in which the vendor states it has no way of decrypting Secure Data. We found no public information naming FIDO2 or hardware security keys for sign-in or passkey unlock of the vault itself, and the SSO key model reads as one sentence rather than a published derivation.

heylogin

The Entra ID integration imports users, mirrors Entra groups as heylogin teams with membership kept in sync automatically, and lists its required Graph permissions; Google Workspace and CSV import are also offered, and FIDO2 security keys, Touch ID, Windows Hello, smartwatches and passkey support are documented. As the person who owns joiner-mover-leaver for two thousand staff, I need to see what happens the moment an account is disabled: we found no public information on single sign-on for sign-in, SCIM, or automated suspension and vault revocation on deprovisioning.

1Password

Events Reporting sends sign-in attempts, item usage and audit events to named SIEM targets including Splunk, Microsoft Sentinel and Elastic, with bearer tokens whose expiry and event types are configurable, data retention control, custom dashboards and alerts, and an Events API for anything unlisted, and client policies can enforce export, copy and share, print and item history. Business reports cover sign-in attempts, vault and device usage over twelve months, Watchtower security issues, domain breaches with affected-user notification, and developer-secrets discovery. We found no public information on a master-password or MFA policy, browser-extension policy detail, or compliance report packs aligned to ISO 27001 or NIS2.

heylogin

The audit log, Enterprise-only, records website logins, password copies, and reveals of passwords and hidden fields, keeps events for one year, and is limited to organisation events so private logins stay unlogged; breach monitoring with automatic admin notification is also offered. Login changes and user-related changes are described as upcoming rather than available. We found no public information on exportable logs, SIEM integration, or enforceable policies.

1Password

Clients cover macOS, Windows, iOS, Android, Linux, the CLI and the browser, hosting is customer-selectable between the EU, US and Canada, offline unlock is available through biometrics, and import paths exist from named competitors including Bitwarden, Dashlane, KeePass and LastPass. Export is the weak point: the captured pages state exported files are stored in plaintext, the CSV path covers only Login and Password items, and unlocking with SSO blocks export until an administrator turns it off for the account. We found no public information on a self-hosted or on-premises vault option or an encrypted full-fidelity export covering all item types including attachments.

heylogin

Production runs on named EU infrastructure — Hetzner in Nuremberg with a Falkenstein standby and independent backups at IONOS — clients cover Chrome, Firefox, Safari, Edge, iOS, Android and PC/Mac, and import from eleven password managers plus Excel and CSV, with a selectable export, are documented. Enterprise can duplicate the encrypted data to customer servers as an on-premises backup, which is duplication rather than self-hosting. We found no public information on offline access during an outage, Linux clients, or export format fidelity.

1Password

The vendor is proven Canadian: AgileBits Inc. of Toronto, governing law Ontario, with customer support and email hosted primarily in the United States and Canada, and AWS appearing only in a third-party audit description rather than a subprocessor list. There are genuine European elements: vault data can be hosted in the EU at the customer's choice, item sharing data is stored in the EU while shared, a Data Processing Agreement is published, and standard contractual clauses, a DPO contact and a GDPR complaint right are offered. The contracting entity's jurisdiction and ownership are not confirmed on the captured pages, and we found no public information on an EU contracting entity or a published subprocessor list with locations.

heylogin

heylogin GmbH of Braunschweig is the contracting entity and controller, vaults are hosted at Hetzner in Nuremberg with Falkenstein standby and backups at IONOS in Germany, and a strict DPA with European subprocessors, an EVB-IT cloud contract for public bodies, and published ISO 27001:2022 certification are offered. The privacy policy names subprocessors with locations and states exclusively European subprocessors are used; the leak-check operator is named in Australia and described as involving no data transfer. We found no public information on the ownership chain beyond investors named as German business angels and Mozilla Ventures.

1Password

The captured pricing page publishes no prices and asks buyers to contact the sales team to discuss their environment and receive a quote, so an annual cost cannot be computed from public pages alone. The terms of service describe a per-user model in US dollars billed monthly or yearly with thirty-day payment terms and customer-borne taxes, but the actual amounts sit in an order form rather than on a public page.

heylogin

The Business tier is publicly priced at "3,99 € Pro Nutzer im Monat, jährliche Abrechnung" with the note "Alle angezeigten Preise zzgl. MwSt.", tier features are listed, and a free private plan plus a Business trial are offered. Enterprise is sales-contact only with no published price, and optional items such as onboarding support and on-premises backup carry no published prices. A note ties the enterprise add-ons to organisations with more than 300 employees.