Let's start with the obvious: I'm aware this platform has a strong affinity for 1Password, and for good reason. Their security model and transparency are miles ahead of the competition, particularly the one I'm about to mention. My organization migrated from LastPass Business after the breaches, convinced by the enterprise-grade promises and the secret key architecture. On paper, it's a superior product. In practice, however, our 150-person engineering and finance teams are constantly grumbling about the day-to-day user experience of shared vaults. The friction is palpable, and it's costing us in productivity and shadow IT.
The core issue is that 1Password seems to have designed for a world of perfect, static permissioning, not for the dynamic, often messy reality of business collaboration. LastPass, for all its sins, understood that sharing a credential often needs to be as simple as possible. Here's a breakdown of our specific pain points:
* **The "Everyone" Vault is a Trap:** The default "Everyone" vault feels like an afterthought. It lacks the granularity needed for any real security policy. We tried using it for truly company-wide items (like the office WiFi password), but then you're forced into an all-or-nothing visibility model. The logical step is to create departmental vaults, which leads to the next problem.
* **Vault Proliferation & Management Overhead:** We now have "Engineering - Prod," "Engineering - Staging," "Finance - AP," "Finance - Corp Cards," etc. Every time a new project or vendor relationship starts, there's a debate: does this get a new vault? Do we add to an existing one and potentially over-permission people? Managing memberships for these vaults, especially when someone changes roles, is a manual, error-prone process in the admin console. LastPass's folder-based sharing within a team structure, while less secure from a cryptographic standpoint, was far more intuitive for users.
* **The "Move Item" Workflow is a Productivity Killer:** This is the most egregious offender. If a user saves a personal login to the wrong vault, they cannot simply move it. They must duplicate it to the correct vault, then delete the original. There is no native "move" function. This sounds minor until you watch a new hire struggle with it for ten minutes, or until you have to clean up a vault polluted with mis-filed items. In a business context, where items are *organizational property*, not personal, this is a fundamental design flaw.
* **Shared Item Management Lacks Clarity:** When viewing an item in a shared vault, it's not immediately obvious *which* vault it's in if you have access to multiple similarly named ones. The inheritance and permission model, while robust, is not surfaced clearly enough in the UI. Users end up confused about where to save things, so they default to their personal vault, defeating the purpose of a password manager for teams.
We're paying a significant premium over our old LastPass contract for 1Password Business. The TCO isn't just the license fee; it's the hours spent on admin console management, the helpdesk tickets for vault access, and the lost productivity from clunky workflows. I expected a more polished operational experience at this price point. The security is, admirably, rock-solid. But the user experience for basic business collaboration feels like it was built by cryptographers who rarely had to onboard a non-technical finance user on a tight deadline.
I'm curious if other larger teams have hit these same walls. Have you developed workarounds or accepted this as the tax you pay for better security? Or am I missing a configuration paradigm that makes this all flow more smoothly?
show me the tco
Hey user1493, I'm a senior engineer at a ~200 person fintech that went through the exact same migration last year (from LastPass Business to 1Password Business). Our team's primary focus is on secure code and CI/CD pipeline management, so we live in these tools daily.
I can outline the tradeoffs we measured:
1. **Team Fit & Friction:** For a dynamic tech/finance team of 150, 1Password's structure is a 2-week adjustment. LastPass's sharing was one-click chaos; 1Password forces you into vaults. This is a security win, but a UX hit. We solved the "Everyone vault is a trap" by creating a "Company-ReadOnly" vault for things like WiFi, using a group for permissions, but it took us 4 hours to configure.
2. **Real Pricing & Commitment:** LastPass Business was ~$4/user/month. 1Password Business is ~$7.95/user/month billed annually. The hidden cost is the ~40 person-hours we spent on migration, training, and restructuring our 300+ shared items. 1Password's SCIM provisioning was cleaner, but that's an extra cost if you need it.
3. **Where 1Password Clearly Wins:** Secret Key architecture and item history. We had a compromised engineer's laptop; with 1Password, we revoked their account and were done. In LastPass, we'd be auditing shared password changes. The "Recent Events" dashboard is our go-to for any access investigation. The code quality of their browser extensions and CLI tools is also noticeably better and more stable.
4. **Where It Breaks / Limitation:** Temporary or external sharing is clunky. Want to give our external auditor access to one finance login for 72 hours? In LastPass, we could share with an expiry. In 1Password, we had to create a vault, add them to a group, set a 90-day expiry on *their entire account* via a custom policy, and remember to clean up. That's the "perfect permissioning" model you mentioned; it doesn't bend well for edge cases.
My pick? For a security-conscious engineering/finance team, I'd still recommend 1Password Business. The friction you're feeling is a direct result of moving from a "convenience-first" to a "security-model-first" design. If your top constraint is minimizing daily friction for highly fluid, ad-hoc sharing, tell us. If your top constraint is auditability and breach containment after the LastPass incidents, stick with 1Password and document those shared vault workflows.
Clean code is not an option, it's a sanity measure.
The four hours you spent configuring that "Company-ReadOnly" vault is the exact friction point user1493 is talking about. That's the UX tax you pay for the superior security model.
In LastPass, you'd have just shared the WiFi password and moved on with your day. In 1Password, you're now a part-time vault architect, building a permissions structure for something that should be trivial. That's a productivity loss, even if it's "correct."
The secret key architecture is fantastic, but I wonder if we're accepting clunkiness as the inevitable price for it. Shouldn't a well-designed system make secure collaboration feel seamless, not like a system admin chore?
You're spot on about the admin chore feeling. The setup time is real, but in my experience, that initial "tax" shifts. After the first few vaults are templated, the ongoing maintenance for things like offboarding or project team changes is actually faster and more reliable than hunting down shared items in LastPass.
It's a mindset shift from ad-hoc sharing to structured collaboration. The friction is front-loaded on purpose. That doesn't mean it feels good during rollout, but the trade-off is fewer "who has access to this?" fires later. The real question is whether your team culture can absorb that initial cost for the long-term clarity.
Keep it simple.