1Password vs heylogin

1Password

The security pages name AES-GCM-256 encryption, PBKDF2-HMAC-SHA256 key derivation and a 128-bit Secret Key, the privacy policy states the vendor has no way to decrypt Secure Data, and the trust pages show ISO 27001 and SOC 2 certifications, a dated 2020 ISE penetration test with unaltered reports published through a Trust Center, and a public HackerOne bug bounty. The captured pages do not show a field-by-field list of what stays unencrypted, any incident history, or open-source clients, so I place this a notch below the strongest documented designs.

heylogin

A downloadable security whitepaper names the cryptography (XSalsa20 with Poly1305 and Curve25519) and describes a zero-knowledge design in which the cloud stores vaults but cannot decrypt them and each user's device security chip holds the keys; the company states ISO 27001:2022 certification, and the privacy policy separates end-to-end encrypted stored data (usernames, passwords, URLs) from contract and account data. I found no public information on independent penetration test reports, a bug bounty, or open-source clients, so I cannot go higher.

1Password

This is what I need for forty people: shared vaults with groups and five permission levels, account recovery documented down to issuing a new Secret Key and password with bulk recovery via CLI and a recommendation to keep two recoverers, and suspension of leavers through identity-provider deprovisioning. Guests restricted to a single vault give me controlled external sharing; we found no public information on time-limited or one-time shares, emergency access with a waiting period, or approval workflows beyond a homepage feature bullet.

heylogin

This is what I care about most and it holds up: teams with their own permissions, logins assigned to individuals or shared externally, hidden-password sharing, and admin plus custom roles — and because there is no master password at all, recovery works by encrypting organization vaults with the admins' device security chips, so a lost device can be recovered while admins still cannot read an employee's personal vault. I found no public information on time-limited or one-time external sharing, emergency access with a waiting period, or approval workflows for sensitive items.

1Password

Unlock with SSO is documented down to the OIDC protocol with PKCE and an encrypted-credentials-plus-device-key model, supports Entra ID, Okta, Google and others on the Business plan, and automated provisioning creates users and groups, grants and revokes group access, and suspends leavers, with recovery-capable groups deliberately excluded from automation. Hardware security keys are not named on the captured pages and passkey evidence is thin, so I stop just below the strongest level.

heylogin

Directory sync is properly documented: users import from Microsoft Entra ID or Google Workspace, Entra groups sync as teams with membership kept current automatically, and removal from a synced group removes the person from the team — and these integrations sit in the per-user Business tier rather than a tier above, my main worry. Two-factor is on by default with FIDO2 security keys, Touch ID, Windows Hello and smartwatches, and passkeys are supported; I found no public information on single sign-on to the vault itself or on SCIM.

1Password

Sign-in attempts, item usage and audit events feed named SIEM targets like Splunk, Microsoft Sentinel and Elastic through revocable bearer tokens with retention control, and the report set covers Watchtower password health, domain breaches that notify affected users, devices and adoption. Admin policies govern viewing, copying, exporting, sharing and printing of items; we found no public information on master-password or MFA enforcement, browser-extension policies, or compliance reports aligned to ISO 27001 or NIS2 audits.

heylogin

The audit log records every website login performed with heylogin, every password copied or revealed and every reveal of a hidden field, keeps events for one year, and breach detection automatically notifies the administrator. The log lives only in the Enterprise plan and watches organizational use only; I found no public information on exportable logs, SIEM integration, or enforceable policies for sharing, export or two-factor.

1Password

Clients cover Windows, macOS, Linux, iOS, Android, browsers and a CLI, the vault region is selectable between the EU, US and Canada, imports are documented from LastPass, Bitwarden, KeePass and other named sources, and a status page is referenced in the terms. The export path worries me as a buyer: exports are unencrypted plaintext, the CSV route only carries Login and Password items, passkeys export only from iOS or Android, and accounts unlocked with SSO cannot export until an administrator intervenes; we found no public information on self-hosting or vault access during a vendor outage.

heylogin

Apps for iOS and Android, extensions for Chrome, Firefox, Safari and Edge, production hosting at Hetzner in Nuremberg with a Falkenstein standby and encrypted backups at IONOS, plus import from eleven named password managers, the major browsers, Excel and CSV — moving my Excel mess over looks straightforward. Export runs from the settings area with selectable data and an on-premises backup of the encrypted data is an Enterprise option; I found no public information on offline access to the vault during an outage, Linux clients, or how complete the export format is.

1Password

The contracting entity is AgileBits Inc. of Toronto with Ontario governing law, but customers can select EU hosting for their secure data, item sharing data is stored in the EU, and a DPA is published with standard contractual clauses and other transfer safeguards. The captured pages prove support and email hosting in the United States and Canada, imply AWS in the infrastructure, and leave ownership and the wider subprocessor chain unstated, so only part of the chain is European.

heylogin

The chain is European and concrete: heylogin GmbH in Braunschweig with a register number and VAT ID, production at Hetzner in Nuremberg with a standby in Falkenstein, encrypted backups at IONOS in Montabaur, subprocessors published with addresses, a statement that only European subprocessors are used, a strict data processing agreement including an EVB-IT cloud contract for public authorities, and ISO 27001:2022. The Have I Been Pwned breach-check subprocessor sits in Australia, though the privacy policy records no data transfer for it; I found no public information on the ownership chain beyond the named investors, or on a self-hosted option that removes the vendor from the data path.

1Password

The pricing page I read sends every buyer to the sales team for a tailored Unified Access quote, and no per-user figures appear on the captured pages, so I cannot compute what my forty people would cost or see by price which tier carries SSO. The terms do establish a per-user model in US dollars, monthly or yearly cycles, 30-day payment terms, auto-renewal and non-refundable fees, which keeps this just above the bottom.

heylogin

The price I would actually pay is public: Business at 3,99 € per user per month with annual billing, all prices excluding VAT, the free tier priced, a trial offered, and the main features per tier listed — and the Entra ID and Google Workspace integrations are included in that Business tier rather than pushed up. What holds it back: the Enterprise tier holding the audit log, custom roles and breach monitoring has no public price at all and points to the sales team, and I found no public information on seat minimums or on prices for the optional onboarding and on-premises backup add-ons.