SealedKeys is the only team password manager purpose-built for technical teams — with dedicated SSH key and API key types, per-copy audit logging, EU-only hosting, and Cyber Essentials certification.
It is not a consumer password manager bolted onto a business plan. It is built from the ground up for the way developers, DevOps teams and agencies actually work.
LastPass suffered two major breaches (2022). Crucially, the architecture meant encrypted vault data was exfiltrated — meaning attackers had everything they needed to attempt offline decryption at their leisure. LastPass stores a password hash that enables server-side key derivation, which is the fundamental architectural weakness.
SealedKeys derives the vault key client-side, in your browser, before any data touches the server. A breach of SealedKeys servers exposes only AES-256-GCM ciphertext — worthless without the key, which never leaves your machine.
Bitwarden is open-source and genuinely zero-knowledge. The gaps for technical teams: no dedicated SSH key or API key field types, SAML SSO requires the Enterprise plan (significant additional cost), EU data residency is not guaranteed on the standard plan, and there is no Cyber Essentials certification for UK supply chain requirements.
Bitwarden is a solid choice for generic password storage. It is not designed for teams managing SSH keys, API tokens and infrastructure credentials.
Dedicated field layouts for SSH private keys (fingerprint, passphrase, associated service) and API tokens (name, environment, expiry). Not generic password fields with workarounds.
Every time a user copies a password, API key or SSH key — we record: who (email address), what (which field), when (timestamp), where (IP address). Stored in your EU-hosted database. Not on a third-party logging server.
All data is stored on Hetzner EU infrastructure. No enterprise agreement required. Relevant for UK GDPR, EU data residency requirements, and government supply chain audits.
The vault key is derived client-side using PBKDF2-SHA256 (600,000 iterations). The server stores only AES-256-GCM ciphertext. The full encryption implementation is open-source and independently auditable on GitHub.
UK Cyber Essentials certified with an independent penetration test completed May 2026 — zero exploitable findings across 42 test cases. Required for some UK government supply chain contracts.
The SealedKeys CLI lets developers access secrets from the terminal and CI/CD pipelines. sealedkeys get "DB password" --field password --raw. Zero-knowledge — all decryption is local.
| Feature | SealedKeys | LastPass | Bitwarden | 1Password |
|---|---|---|---|---|
| Zero-knowledge architecture | ✓ Key never leaves browser | ✗ Breached 2022; server-side hash | ✓ | ✓ Server-assisted KDF |
| SSH key storage (dedicated type) | ✓ | ✗ | ✗ | ✓ |
| API key storage (dedicated type) | ✓ | ✗ | ✗ | ✗ |
| Per-copy audit log (who copied what) | ✓ Email, field, IP, timestamp | ✓ Basic; on LP servers | ✓ Enterprise plan only | ✓ Business plan only |
| SAML 2.0 SSO — standard plan | ✓ Included in Pro | ✓ Teams plan | ✗ Enterprise only | ✗ Business plan required |
| EU data residency — all plans | ✓ Hetzner EU, always | ✗ | ✗ US by default | ✓ Business plan |
| Cyber Essentials certified (UK) | ✓ | ✗ | ✗ | ✗ |
| Open-source encryption layer | ✓ github.com/sealedkeys/crypto | ✗ | ✓ | ✗ |
| CLI tool for terminal / CI-CD | ✓ | ✗ | ✓ bw CLI | ✓ op CLI |
| Contractor offboarding checklists | ✓ | ✗ | ✗ | ✗ |
| Independent pentest (2026) | ✓ 0 exploitable findings | ✗ Not published | ✗ Not recent | ✗ |
| Price (Pro / per user / month) | £3.49 | ~£3.00 | ~£2.80 | ~£6.50 |
Prices and features correct as of May 2026. Verify directly with each vendor.
| Data | Visible to server? |
|---|---|
| Your master password | ✗ Never |
| Your vault key | ✗ Never |
| Plaintext passwords / keys | ✗ Never |
| Vault item names (metadata) | ✓ Yes |
| Audit events (who copied what) | ✓ Yes (your data) |
| Encrypted ciphertext blobs | ✓ Yes (unreadable) |
The question that matters after any security incident is not "was our vault encrypted?" — it is "which credentials did the contractor copy before they left, and when?"
Chrome's clipboard logs nothing. Most password managers log to their own servers — you see a line item on a report, weeks later, if you ask for it.
SealedKeys logs every copy, view, edit and deletion to your own EU-hosted database in real time. You can query it, export it, and include it in a security incident report. It is your data, not a feature you rent from a vendor.
Sample audit log entries
| james@acme.com ITEM_COPIED · password |
5 Jun 23:04 89.247.x.x |
| alex@acme.com ITEM_COPIED · apiKey |
5 Jun 17:31 82.19.x.x |
| sarah@acme.com ITEM_COPIED · sshPrivateKey |
4 Jun 09:12 78.32.x.x |
| james@acme.com MEMBER_REMOVED · team |
3 Jun 16:00 89.247.x.x |
Every row: email · field name · timestamp · IP address