Passpack review for UK small businesses

Passpack is a business password manager that has sold team-based credential sharing for more than a decade. It stores unlimited passwords, shared notes and secrets in per-user encrypted accounts, organises people into unlimited teams, and shares records with individuals or whole teams under role-based permissions. A Chrome extension adds autofill and auto-login, and a mobile app arrived in 2026.

The security model is the differentiator. Passpack describes a zero-knowledge architecture with multi-tiered client-side encryption: every record is encrypted with its own device-generated 256-bit AES key; record keys are protected by an additional key called the Team Key; and all Team Keys sit under a user-defined Packing Key, published as a 4096-bit RSA-OAEP SHA-512 key generated on the device and protected by a passphrase salted and expanded using PBKDF2 at one million iterations. Decryption happens only on the device, and Passpack states no employee can read vault contents or reset a lost main-administrator Packing Key.

Two tiers cover most businesses. The Teams plan is aimed at up to twenty people and includes unlimited passwords and teams, encrypted sharing, notes, a password generator, two-factor authentication with TOTP and YubiKey, import and export, and limited activity reporting. The Business plan adds SSO with Google and Microsoft, multiple administrators, domain and session controls, delete and reset of member accounts, advanced activity reporting, an API, device registration, Active Directory synchronisation and an unlimited archive.

For a UK buyer the honest starting point is that Passpack is a US product: it invoices in dollars, supports from the United States, and hosts in the US and EU with PhoenixNAP, publishing the EU region mainly for enterprise tenants. It states GDPR compliance and offers a Data Processing Agreement, but publishes no UK entity, UK support hours or UK price list, so the cross-border detail needs confirming with the vendor.

UK Business Stack classifies Passpack as the identity layer of a small-business stack: it sits between the systems people log into and the administrator who must prove who has access, what changed and when access was revoked. Its job is to replace spreadsheets and shared mailboxes with encrypted credentials, a permission model and an audit trail, and to make onboarding and offboarding a documented, repeatable process.

Passpack occupies the space that shared spreadsheets, browser-saved passwords and the everyone-uses-one-login habit normally fill. It centralises credentials in encrypted per-user vaults, shares them into teams under role-based permissions, and hands administrators the activity reporting and account controls that make access governance auditable.

The integration story is narrower than the consumer brands but purposeful: SSO with Google and Microsoft, Active Directory and Google Directory synchronisation, an API on Business, CSV and JSON import and export, and a Chrome extension with autofill and auto-login. There is no large connector marketplace.

The UK question is governance and geography. Passpack holds genuine credentials — SOC 2 Type II, GDPR-aligned statements, a DPA and US and EU data centres — but it is US-dollar priced and US-supported, and the EU region option is mainly for enterprise tenants. A UK buyer on Teams should confirm its data region, the transfer basis under the DPA and its own offboarding procedure before rollout.

The flow below reflects Passpack's published quick-start, administrator and browser-extension documentation. UK Business Stack has not run a live Passpack trial for this review, so treat these steps as vendor-documented behaviour rather than independently tested behaviour.

Before any password-manager decision it is worth naming the honest alternatives. All secure credentials; they differ in price, platform coverage, hosting philosophy and how much operational discipline they demand.

• Who you are contracting with. Passpack, Inc. is a US company — Delaware-incorporated, with venue in Salt Lake City, Utah. No UK legal entity is published, so the contract, governing law and support relationship are US-based.
• Currency and VAT. Prices are quoted and payable in US dollars, so the sterling cost moves with the exchange rate. Passpack states it charges tax when required; confirm the VAT treatment with the vendor and your accountant.
• Where the data sits. Passpack publishes US and EU data centres operated with PhoenixNAP, with the EU tenant option stated mainly for enterprise customers; smaller plans should confirm the hosting region and transfer basis under the DPA.
• GDPR and DPA readiness. Passpack states GDPR compliance, positions itself as a processor of customer data and a controller of its own operations, and offers a DPA; a UK controller should still confirm the terms cover its data under UK GDPR and the Data Protection Act 2018.
• UK support reality. Support is by email and a US phone number with no published UK hours or line; the claimed around-the-clock support should be tested during the free trial before an incident.
• Offboarding for auditors. Business-plan controls — delete and reset accounts, transfer ownership, domain restrictions and advanced activity reporting — are what auditors look for, but only if the customer documents the process; the un-recoverable admin Packing Key makes a written handover essential.
• Regulated-sector fit. Legal, accountancy and FCA-regulated firms can point to SOC 2 Type II, GDPR alignment and a DPA to evidence controls, but each practice must still risk-assess US hosting, US support and the zero-knowledge recovery model.

Passpack publishes per-user US-dollar pricing: Teams at $1.66 per user per month billed annually for up to twenty people, Business at $4.50 per user per month billed annually with a monthly option, and Enterprise as a custom quote. A 28-day free trial requires no credit card.

There is no free tier, so the trial is the evaluation route. The homepage and plans page display the Teams unit price differently — once per month and once per year — and the terms confirm fees are quoted and payable in US dollars, so a UK buyer should confirm the current figure before budgeting.

The value logic is simple: a business-grade credential tool at prices well below most named rivals. Twenty users on Teams list at just over $33 per month; Business adds SSO, multi-administration, the API and advanced reporting most competitors only reach at far higher per-user cost.

• US-centric by default. US-dollar billing, US support and US hosting apply unless an enterprise tenant elects the EU region, so UK buyers carry the exchange-rate and cross-border considerations rather than Passpack.
• The Packing Key is a double-edged design. It is the security strength, but a lost main-administrator Packing Key cannot be recovered by Passpack, so a forgotten key means lost vault access and a burden on staff unfamiliar with key management.
• Governance features sit on the Business plan. SSO, the API, multi-administration, advanced activity reporting and device registration are Business-only; the budget Teams plan is light on the controls auditors ask for.
• No free tier and mixed messaging on price. There is no free plan, only a 28-day trial, and the Teams price is published once per month and once per year across pages, so the entry cost needs confirmation before budgeting.
• Browser and app coverage is maturing. The Chrome extension and a new iOS app are live, but Edge and Firefox extensions remain coming soon, narrowing reach against rivals that cover every major browser.
• ISO 27001 is aligned, not certified. Passpack describes ISO 27001 alignment rather than certification, so procurement demanding a named certificate must look elsewhere or request the SOC 2 Type II audit report under NDA.
• The integration ecosystem is thin. There is no large app marketplace; workflows depend on the web app, extension, API and import and export, limiting businesses expecting deep CRM or helpdesk connectors.