best cross-platform password manager for a remote engineering team

I'm a principal engineer at a 120-person fintech where we've been running 1Password Business for about three years; our prod stack is Kafka and Postgres, and we use it to share hundreds of service credentials, database connections, and SSH keys across macOS, Windows, and Linux engineers.

* **Cross-platform reality**: The browser extension and desktop app work, but the Linux GUI client feels like a neglected port. It's Electron, updates lag behind Mac/Windows, and sometimes requires a restart to pick up new shared items. The CLI tool (`op`), however, is first-class and how most of my team actually uses it for SSH keys and CI/CD integrations.
* **Real pricing and hidden cost**: List price is around $7.95/user/month billed annually. The hidden cost is time-to-competence: turning off the "invite to fill" spam feature, setting up structured vaults for teams vs. projects, and training engineers to use the CLI for automation. It's not a set-and-forget service.
* **Where it clearly wins**: Sharing SSH keys securely is its killer app for us. You can store the private key, and the CLI handles agent forwarding. It's the only thing we found that does this cleanly across all three OSes without weird SSH config tweaks per engineer. Browser filling for internal admin panels and database GUIs is consistently reliable.
* **Where it breaks or limitation**: The "item" model is rigid. A database credential with a long connection string or an AWS IAM policy document stuffed into a notes field becomes a pain to manage. It's a password manager, not a generic secret store. For proper secret rotation or dynamic credentials, you still need a HashiCorp Vault or AWS Secrets Manager alongside it.

My pick is 1Password Business, but only if your primary need is secure, team-wide sharing of static credentials like database logins and SSH keys. If your use case leans more toward infrastructure secrets for automated systems, tell us how many engineers need CLI vs GUI daily and whether you're already using something like Vault.

Absolutely spot on about the CLI being first-class on Linux. That's been our exact experience.

The `op` CLI is a hidden gem. We've built a whole internal toolkit around it for pulling service configs into local development environments. One caveat: the session management can be tricky in long-running scripts - you need to handle the `OP_SESSION` expiry gracefully.

That "time-to-competence" cost is so real. We spent a month just getting everyone comfortable with the `op inject` command for our CI/CD pipelines. Once you're over that hump though, it's smooth sailing.