Keeper (password manager)

Keeper password manager uses a freemium pricing model for individual consumers[2] and a subscription-based model for households and businesses.[3] The free individual version of Keeper offers storage for passwords, identity data, and financial information, and includes a password generator and two-factor authentication (2FA) on a single mobile device. The subscription-based model for individual consumers offers additional features, such as unlimited password, identity data, and financial data storage across an unlimited number of devices, cross-device syncing, and record-sharing capabilities.[4] Keeper’s “Family” plans extend these features to up to five people in a household.[5]

Keeper also offers a variety of add-ons at additional cost, including:

• BreachWatch, a tool that monitors the Dark Web for stolen passwords and notifies users if their credentials are found.[6]
• KeeperChat, a secure messaging application. KeeperChat is free for individuals and sold on a subscription basis to businesses.[7]
• Keeper Secure File Storage, which enables users to store confidential files, photos, and videos in their Keeper Vaults.[8]

Keeper is available as a mobile app for Android and iOS, as well as a desktop application for Windows, Linux, and MacOS.[9] It also offers a desktop browser extension for Safari, Chrome, Firefox, Edge, Internet Explorer, Opera, and Brave.[10] The mobile app, desktop app, and browser extension can generate random passwords for new website and app accounts and fill in existing apps and accounts automatically.[11]

Users secure their Keeper vaults with a “master password.” Users can further protect their Keeper vaults via a variety of multi-factor authentication methods, including Google Authenticator, Duo Security, FIDO U2F, and biometrics.[12]

Keeper utilizes a zero-knowledge and zero-trust security architecture, where encryption of user passwords and other data is performed locally on the user’s device. Customer vaults are secured using an AES-256 key, which is derived from the user’s master password using PBKDF2. Only encrypted ciphertext is stored on Keeper’s servers, and Keeper has no way of decrypting the data its customers store in their digital vaults, nor can it retrieve their master passwords.[13]

Keeper users can directly share passwords, files, and other information “vault to vault” with other Keeper users; all shared content is secured with PKI encryption.[14] Additionally, Keeper's One-Time Share feature enables its users to securely share passwords and other confidential information with anyone on a time-limited basis, even if the recipient does not have a Keeper account.[15] All One-Time Shares are secured using zero-knowledge encryption; record data is decrypted locally, on the recipient's device, using 256-bit AES, and all server requests are signed with elliptic-curve cryptography (ECDSA).

Keeper offers a suite of cybersecurity products for commercial use, all of which integrate with each other, including:

• Keeper's enterprise password manager, which offers the same features as Keeper's consumer product, plus additional tools that are specific to organizations, including multi-tenant password management, user provisioning, auditing, reporting, Active Directory integration, and delegated administration, all of which are accessed through a centralized administration console.[16]
• Keeper Secrets Manager, which stores confidential data related to IT infrastructure, such as API keys, certificates, database passwords, privileged credentials, and access keys.[17]
• Keeper Connection Manager, an agentless remote desktop gateway that enables IT Admins and DevOps teams to securely access RDP, SSH, MySQL and Kubernetes endpoints through a web browser. Keeper Connection Manager is built on top of the open-source gateway Apache Guacamole.[18]

Business customers can also access a variety of add-on products, including:

• Commercial-grade versions of BreachWatch, KeeperChat, and Secure File Storage.
• Keeper Compliance Reports, which gives Keeper Administrators visibility into access permissions of records and credentials across their organizations. Administrators can also run reports on-demand and forward them to automated compliance systems, or send them directly to external auditors.[19]
• Keeper's Advanced Reporting and Alerts Module (ARAM), which provides advanced event logging to meet compliance requirements. ARAM can track over 100 event types, generate custom reports, send alert notifications via email and SMS, and feed alert data into security information and event management (SIEM) systems.[20]
• Keeper SSO Connect, a SAML 2.0 SaaS solution that enables businesses to integrate their existing single sign-on (SSO) deployments with Keeper’s password management platform.[21]

Keeper Security is listed as Authorized on the FedRAMP Marketplace at the Moderate impact level, with an authorization date of 8/23/2022.[22] Keeper Security Government Cloud (KSGC) is designed specifically for U.S. federal, state, and municipal government agencies and supports compliance with the United States International Traffic in Arms Regulations (ITAR).

Keeper Security Government Cloud obtained StateRAMP Authorization at the Moderate Impact Level with an authorization date of 11/30/2022. The nationwide StateRAMP cybersecurity verification program promotes the adoption of secure cloud services across state and local governments by providing a standardized approach to security and risk assessment for cloud technologies.

In 2009, Craig Lurey developed the original Keeper app while on a long business flight to China with Darren Guccione.[23] In 2011, Lurey and Guccione officially co-founded Keeper Security, Inc. As of March 2022, Keeper had offices located in Chicago (Headquarters), California (Software Development), Ireland (EMEA Business Sales) and the Philippines (International Customer Support).[24]

In October 2019, Keeper launched KeeperMSP, a password management platform designed specifically for managed service providers (MSPs), managed security service providers (MSSPs), and their customers.[25]

In August 2020, Keeper received a $60 million minority investment from venture capital firm Insight Partners.[26]

In March 2021, Keeper launched Keeper SSO Connect.[21]

In May 2021, Keeper was listed on the U.S. federal government’s FedRAMP Marketplace as a “CSP in Process.”[27]

In January 2022, Keeper announced the launch of Keeper Secrets Manager.[17]

In February 2022, Keeper acquired remote access gateway company Glyptodon Inc., creator of Glyptodon Enterprise and Apache Guacamole, and commenced integrating Glyptodon Enterprise into its product suite.[28]

In May 2022, Keeper launched Keeper Connection Manager, a rebranding and revamping of Glyptodon Enterprise into a commercial-grade remote desktop gateway with expanded capabilities, advanced integrations, and ongoing feature development.[18]

In August 2022, Keeper Security became Authorized on the FedRAMP Marketplace at the Moderate impact level, with an authorization date of 8/23/2022.[22]

In November 2022, Keeper Security Government Cloud obtained StateRAMP Authorization at the Moderate Impact Level with an authorization date of 11/30/2022.

PC World named Keeper an Editor's Choice in 2019[29] and Most Security-Minded Password Manager in 2022.[30]

PCMag named Keeper “Best Password Manager for Businesses" (2022), as well as Best Password Manager and Editors' Choice for the previous three consecutive years.[31]

Tom’s Guide named Keeper one of the best password managers of 2022.[32]

U.S. News & World Report’s 360 Reviews team named Keeper Best Overall Password Manager of 2021.[2]

Keeper is the recipient of multiple InfoSec Awards, which are sponsored by Cyber Defense Magazine and handed out annually at the RSA Conference:

Keeper holds the following patents through the United States Patent & Trademark Office:

In December 2017, Keeper was bundled with Windows 10 by Microsoft. Google security researcher Tavis Ormandy disclosed that the software recommended installing a browser addon which contained a vulnerability allowing any malicious website to steal any password.[45] A nearly identical vulnerability was already previously discovered and disclosed to Keeper in 2016.[46][47] Within 24 hours, the company issued a patch.[48][49] Days later, the company that makes Keeper sued Ars Technica, claiming their article was defamatory and misleading.[50] The lawsuit was dismissed on March 30, 2018, and Ars Technica added further clarifications to the article.[51]

Following the lawsuit, Keeper launched a public vulnerability disclosure program in partnership with Bugcrowd.[52]

• List of password managers
• Cryptography

• Official website