1Password for a Three-Person Team: What the Plans, Recovery Rules and Logs Actually Document

Every list of essential small-team software includes a password manager, and the recommendation is usually made in a tone that suggests there is nothing left to decide. There is. For a team of three the open questions are which plan you are actually buying, who can let a locked-out colleague back in, and which of the features in the marketing copy belong to a tier you are not on.

This is a documentation-based guide, not a usage test. Every product detail below was checked against 1Password’s own pricing and support pages on September 22, 2026. An earlier version of this article described a four-month, three-seat trial with import counts, autofill failure tallies, a $19.95 monthly price and recovered subscription charges; none of that was supported, and it has been removed. The cost table below is arithmetic on published prices, not an invoice.

Illustration only. It does not depict a measured migration.

What the documentation says

Question	What 1Password documents	Source (checked Sept 22, 2026)	What to check yourself
What does the small-team plan cost?	Teams Starter Pack: $24.95 USD per month billed annually ($299.40 a year), 10 members included, extra seats $4.99 per seat per month. 14-day free trial.	Business & Teams pricing	Whether the price shown in your currency and region matches, and what monthly billing costs.
What does Business cost?	“$8.99 USD per user, per month. Paid annually.” Adds SSO unlock and custom groups.	Business & Teams pricing	Whether you need anything on that list at three people.
How are seats counted?	Business “bills for each team member”; new members are prorated; “You won’t be charged for people who have been suspended, deleted, or invited but haven’t joined.” Business accounts include 20 guests.	Subscription billing policy	That departed contractors are suspended or deleted, not merely ignored.
Who can let a locked-out person back in?	A team administrator or owner, or a member of a custom group with the “Recover Accounts” permission. The person gets a new Secret Key, sets a new account password and keeps their data; their two-factor setup is reset.	Account recovery	That at least two people hold that power (1Password’s own advice).
Can 1Password reset a password for you?	No: “no one can reset your password.” The fallbacks are the Emergency Kit, a recovery code, or an administrator.	Forgot account password	That every member saved an Emergency Kit somewhere other than the vault.
Can you see what a shared login used to be?	Password history exists for Login and Password items; other items keep previous versions that can be viewed and restored in the desktop apps or on 1Password.com.	Item history	How far back versions go on your plan. The page states no retention period.
Is there an account-wide audit trail?	“The audit log is only available in 1Password Business.” Teams and Starter Pack customers on direct billing can start a free trial of it. It “keeps 365 days of events.”	Audit log	Whether per-item history is enough for you, or you need the account-level log.
What does Watchtower flag?	Compromised sites, vulnerable, weak and reused passwords, missing two-factor, available passkeys, http:// logins, expiring items, exact duplicates in a vault.	Watchtower	How you will triage the first-day list (see below).
What can be imported?	Browsers, Bitwarden, Dashlane, KeePass, KeePassXC, Keeper, LastPass, RoboForm and generic CSV. Without vault-creation permission, imports land only in the Employee, Personal or Private vault.	Import guide	Who on the team is allowed to import into a shared vault.

The cost question at three people

The Starter Pack is a flat price and Business is per user, so the comparison changes with headcount. The table is multiplication on the published annual-billing prices and nothing else.

Team size	Starter Pack, per year	Business, per year	Starter Pack per person per month
3	$299.40	$323.64	$8.32
5	$299.40	$539.40	$4.99
10	$299.40	$1,078.80	$2.50
12	$419.16	$1,294.56	$2.91

Two things follow. At exactly three people the plans cost almost the same, about $24 a year apart, so the decision is about features rather than money. And the Starter Pack is a flat fee: a three-person team pays for ten seats and uses three, which is the mirror image of the usual per-seat pricing problem where the bill grows with every hire. Here the bill stays still until the eleventh person, which makes it one of the few tools where adding a part-time bookkeeper or a contractor costs nothing extra.

Whether either plan beats a free or personal-tier manager is a separate question, covered in the comparison of what free password managers include. The short version is that personal plans do not give an administrator the power to recover someone else’s account, and for a team that is the feature you are paying for.

Recovery is the conversation to have first

1Password’s design means the company cannot open your vault, and its support page says so without hedging: no one can reset your password. For an individual that is a risk to manage alone. For a team it becomes a question of who holds the recovery role.

The documented arrangement is that an owner, an administrator, or a custom-group member with the recovery permission starts the process, and the locked-out person ends up with a new Secret Key and a new account password, with their data intact and their two-factor authentication reset. 1Password’s own recommendation is to “make sure at least two family or team members can recover accounts.”

In a team of three, that recommendation is most of your configuration. If one founder is the only owner and the only administrator, the person most likely to be locked out with no one to help is that founder. Settle three things on day one:

1. Two of the three people can perform recovery.
2. Each person’s Emergency Kit is stored outside 1Password: printed, or in a place the other two know about.
3. Everyone understands that recovery resets two-factor authentication, so the authenticator app’s own backup matters too.

History versus audit log

Shared credentials create a predictable problem: someone rotates a password, forgets to mention it, and the next person finds a login that no longer works. The documentation describes two different tools for this, and they sit on different plans.

Password history and previous item versions are per-item features. You open the login, view the earlier password or restore an earlier version, in the desktop apps or on 1Password.com. That answers “what was this before?”.

The audit log answers a different question: who did what across the whole account. It covers user management, device authorisation, vault access changes and sign-in attempts, kept for 365 days, and is readable by owners, administrators and anyone in a group with the View Administrative Sidebar permission. The support page is explicit that it belongs to Business, with a trial available to Starter Pack customers on direct billing.

So if the reason you want a password manager is accountability rather than storage, check on the trial which of the two you actually need. At three people, per-item history may be enough. If it is not, that is the real argument for paying the extra $24 a year.

Plan for the first Watchtower report

Watchtower checks ten or so categories, from passwords exposed in breaches to logins that could use a passkey. Importing a long-lived spreadsheet or browser store into any scanner of this kind tends to produce a long first report, because old credentials are usually weak, reused, or both. The documentation describes an Ignore option for the two-factor prompt but no general way to switch a category off, so assume the list is cleared by fixing items, not by hiding them.

A workable order, based on what each category means rather than on how many items it contains:

1. Compromised and vulnerable items first, since those passwords are already known to be exposed.
2. Reused passwords on accounts with power: email, banking, domain registrar, payroll, the cloud console.
3. Missing two-factor on the same list of accounts.
4. Weak passwords on low-stakes accounts last. A forum login with a weak password is worth fixing, but not before the registrar.

Importing from a spreadsheet

The import guide lists CSV alongside the named password managers and browsers. It says nothing about de-duplication, so plan to do that yourself: sort the sheet by service before importing, resolve rows where two people recorded different passwords for the same account, and mark accounts nobody recognises. That last group is worth a second look, because an unrecognised login is often an unrecognised bill, the same thing a quarterly stack audit or a hunt for shadow software is designed to find.

Two practical points the guide does document or imply. Decide beforehand who has permission to create vaults, because without it imports go only to a private vault and then need moving. And treat the exported CSV as the most sensitive file your team has ever produced: it is every password in plain text. Delete it, empty the trash, and check it did not sync to a shared drive.

A trial checklist

The 14-day trial is long enough to test the things that matter and short enough that you need a list.

• Lock one person out on purpose and run account recovery end to end. Time it, and note what they had to set up again.
• Change a shared password, then have someone else find the old value through password history.
• Open the audit log trial if you are on the Starter Pack and decide whether you would miss it.
• Import a small sample CSV into a test vault before importing everything.
• Invite a guest to a single vault and confirm what they can and cannot see.
• Export a vault and look at what the file contains, so you know the way out before you commit.

Limits of this guide

Nothing here measures autofill reliability, sync speed or support quality; those need hands-on testing and this article did none. Prices are the USD figures shown on September 22, 2026 for annual billing and may differ by region or promotion. Feature-to-plan mapping changes, so treat the audit log and guest rows in particular as things to confirm on the live pricing page before paying.