Someone has asked you what Keeper will cost. You open the pricing page, find a clean per-user figure, multiply it by headcount, and put that number in a budget line.
Then the quote comes back and it is nothing like your figure.
This is not a bait-and-switch. It is that Keeper sells two different things on two different pages, and the one most people are actually shopping for — privileged access management — is not on the page with the prices.
How much does Keeper cost?
Keeper Business Starter is $2.00 per user per month, Keeper Business is $4.00, and Keeper Enterprise is $6.00, all billed annually, with a five-user minimum on Starter. KeeperPAM has no published price — it is quoted against your organisation's size, infrastructure and privileged access needs.
The catch is that almost everything that makes Keeper a privileged access tool — session management, credential rotation, discovery, endpoint privilege management — is an add-on on top of whichever vault tier you buy. The published number is the floor, not the budget.
Here is how that breaks down tier by tier, and where the gaps tend to cost people money.
There are two price lists, not one
Keeper splits its commercial pricing into separate pages:
- Password Management — Business Starter, Business, Enterprise. Published per-user, per-month, billed annually.
- Privileged Access Management (KeeperPAM) — sales-only. Keeper states plainly that KeeperPAM pricing is tailored to your organisation's size, infrastructure and privileged access needs.
- Secure Add-Ons — priced separately again, and available across the tiers.
If your requirement is "stop staff keeping passwords in a spreadsheet", the first list is your whole answer. If your requirement involves service accounts, session recording, vendor access or removing local admin rights, the first list is the floor and the real number comes from the second.
Mixing those two up is the single most common reason a Keeper budget estimate lands wrong.
The three published tiers
All three are per user, per month, billed annually. The figures below are Keeper's published USD list prices. Keeper localises price and tax treatment by region, and runs periodic promotional discounts, so check the live page before you commit a number to a budget.
Keeper Business Starter — $2.00 per user per month
Minimum five users, so $10 a month is the real floor, and it tops out at ten. Built for sole proprietors and small teams. You get the encrypted vault, the admin console, credential sharing and autofill, folders, the password generator, vault transfer when someone leaves, and a free Family Plan for every user.
What you do not get: shared team folders, delegated administration, or any of the provisioning that makes a vault manageable above a handful of people. The user cap means you will outgrow it before the features become the constraint.
Keeper Business — $4.00 per user per month
Everything in Starter, plus the things that make it work across a company: shared team folders, delegated administration so sub-admins can run their own department, advanced organisational structure, advanced admin controls, and advanced integrations.
This is where most mid-sized organisations land if the requirement is genuinely password management.
Keeper Enterprise — $6.00 per user per month
Everything in Business, plus the identity plumbing: SCIM provisioning, Active Directory and LDAP sync via Keeper Bridge, Entra ID / Okta / Ping integration, Single Sign-On over SAML 2.0, DUO and RSA two-factor, role-based access control, and developer SDKs and REST API.
Worth noticing: Starter and Business carry a "Buy Now" button. Enterprise carries "Request a Quote". The $6.00 is published as a starting point, not a checkout price — at Enterprise scale you are in a conversation, and that is the tier where volume affects what you actually pay.
The line that decides your tier is SSO, not headcount
If you are in a regulated sector, read the paragraph above again.
Single Sign-On, SCIM provisioning and AD/LDAP sync are Enterprise-only. They are not add-ons you can bolt onto Business — they sit above the line.
That matters more than the price difference. If your access controls have to be auditable, you need users provisioned and deprovisioned from your identity provider rather than by hand in an admin console. A leaver who keeps a vault login because nobody got round to the offboarding ticket is the exact finding an auditor writes up, and it is the finding we see most often in user access reviews.
So the practical rule: if you have an identity provider and a compliance obligation, your floor is Enterprise. Budget from there, not from the headline tier.
Everything that makes it a PAM tool is an add-on
This is the part that surprises people, and it is visible on Keeper's own comparison table if you read the columns carefully.
On the Business and Enterprise tiers, every one of the following is marked Add-on:
- Privileged session management
- Session recording and playback
- Remote browser isolation
- Automated credential rotation for SSH keys, database passwords, API tokens and service accounts
- Secrets Manager CLI and SDKs, and the CI/CD and IaC integrations
- Zero-trust brokered access via Keeper Gateway
- Ephemeral accounts and just-in-time elevation
- Automated discovery across cloud and on-prem
- Database access and the passwordless database proxy
- Vendor privileged access management
- Endpoint privilege management — removing local admin rights, JIT elevation requests, sudo policies, file access policies
And on the reporting side, across all three tiers:
- Advanced Reporting and Alerts (ARAM)
- Compliance Reporting
- ITSM integrations with ServiceNow, Jira and Salesforce
- KeeperAI agentic threat detection
With one dependency worth knowing before you plan: SIEM integration requires ARAM. If feeding Keeper events into Splunk or Sentinel is a requirement — and for most security teams it is — that is two line items, not one.
None of this is hidden. It is just that a per-user vault price and a PAM deployment are different purchases, and the pricing page only prices the first.
KeeperPAM pricing: what actually drives the quote
Keeper's stated basis is organisation size, infrastructure and privileged access needs. In practice, the things that move the number are:
How many privileged users, not how many employees. Vault licensing is per employee. PAM scope is per person who touches something privileged — and that is usually a far smaller number than your headcount. People who quote PAM at full headcount scare themselves out of a sensible project.
How many machines, databases and service accounts. This is where estimates break down, because almost nobody knows the number going in. Discovery nearly always returns more than expected, and non-human identities are the fastest-growing part of it — the service accounts and machine identities nobody has owned for years.
Which modules you genuinely need on day one. Session recording, endpoint privilege management, remote browser isolation and vendor access are separate capabilities. A phase-one scope that takes two of them and adds the rest later prices very differently from one that takes everything at once.
Whether you need the gateway infrastructure on-prem. KeeperPAM is delivered through the vault with minimal infrastructure, which is one of its genuine advantages over the heavier platforms. But your network topology still shapes the deployment.
Where Keeper sits against the alternatives
Keeper's pricing model is unusually transparent at the vault end. Most of the PAM market publishes nothing at all — CyberArk and its main competitors are quote-only from the first conversation, and so is HashiCorp Vault's enterprise tier.
That transparency cuts both ways. A published $4 figure sets an anchor in people's heads that a real PAM scope will not meet, and the gap feels like a surprise even though nothing was concealed. Going in knowing that the vault price and the PAM price are separate purchases is most of the fix.
For what each Keeper module actually does, the breakdown sits on our Keeper platform page.
Building a number you can take to a budget meeting
A method that holds up under questioning:
- Count vault users. Everyone who needs a credential store. That is your per-user line, at the tier your SSO requirement dictates.
- Count privileged users separately. Admins, engineers, DBAs, anyone with elevated rights. This is your PAM seat count and it is not your headcount.
- List the machines, databases and service accounts you know about, then assume the real number is higher. Discovery will tell you; a guess will not.
- Pick phase-one modules deliberately. Write down what you are deferring and why, so the deferral is a decision rather than an omission someone finds later.
- Add the reporting line. If SIEM output is a requirement, ARAM is not optional.
- Then get the quote, with all of the above in hand rather than asking "how much is Keeper".
Walk in with those six answers and the conversation is about scope. Walk in without them and it is about discounts, which is a worse conversation to be having.
The part that is not on any price list
The licence is not the cost. Getting privileged accounts discovered, onboarded, rotated and actually used by the people who have to work through them is the cost — and that work does not appear on a pricing page at all.
We are a Keeper partner. We license it, deploy it, and then run it, which means we see the gap between what gets bought and what gets used more often than we would like. The most expensive version of a Keeper purchase is the one where the tier was right, the modules were right, and six months later half the privileged accounts are still outside the vault because nobody owned the rollout.
If you want a straight answer on which tier and which modules your environment actually needs, book a free audit — 30 minutes with a certified engineer walking through your setup live, with the findings written up afterwards. We will tell you where Keeper fits and where it does not.
