Keeper Security Review

Enterprise-grade password manager with advanced security features, plus secure file storage and comprehensive breach monitoring.

Keeper Security leans hardest on its audit record, so the case for it largely depends on that. The platform holds FedRAMP High Authorization (December 2025) on top of long-standing FedRAMP Moderate, SOC 2 Type II for more than a decade, SOC 3, ISO 27001, 27017 and 27018, plus FIPS 140-3 validation. That is an unusually deep set of certifications for a password manager.

It explains why Keeper turns up so often on federal, healthcare and finance procurement shortlists, where the buyer has to back up its controls with evidence. The admin model is built for the same buyers. The Admin Console supports SAML SSO with any identity provider, SCIM 2.0 provisioning, Active Directory integration and Just-In-Time user creation with automatic role and node assignment.

Role-based access control is granular, with MFA enforcement and export restrictions configurable per role. The audit log can be aligned with NIST 800-53, HIPAA and SOC 2 reporting needs. G2's 4.6 out of 5 score across roughly 960 reviews reflects that the controls work in practice as well as on the data sheet.

Tom's Guide highlights the offline mode, which stores an encrypted local copy of the vault so the product stays usable without network access. The trade-offs are mostly commercial. BreachWatch, Keeper's dark-web monitoring feature, is a paid add-on at $26.99 a year for personal accounts and $53.99 for family.

RoboForm and several others include breach scanning in the base subscription. The Family plan at $84.99 a year is also steep against 1Password Families at $60 and Bitwarden Families at $40 for six users. How-To Geek notes that no clear feature in the bundle justifies the gap.

Trustpilot reviewers repeatedly flag auto-renewal charges arriving up to three weeks before the renewal date with no obvious in-app toggle. That sort of detail wears down goodwill quickly. An older episode still comes up in community discussion.

In 2017 Tavis Ormandy at Google Project Zero disclosed a browser-extension flaw. Keeper sued Ars Technica over its coverage, then later dropped the case and launched a Bugcrowd disclosure program. The technical issue was fixed, but Keeper's response to the security press damaged trust in some communities.

The company is still working through that. In our view, Keeper is built for buyers who need an auditable platform with strong administrative controls and are willing to pay for it. Individuals and families shopping on price, or those who want breach monitoring included by default, will find the bundle harder to justify.