The Keeper platform, product by product
Keeper is best known for password management, and the enterprise platform is built on that same zero-knowledge vault: secrets for applications, brokered sessions for administrators, and endpoint privilege for workstations, all managed from one console. This page walks through what each product does and which ones an environment needs.
What the Keeper platform actually covers
Looking for licensing, deployment and a managed handover rather than the products? That is KeeperPAM licensing and delivery.
One vault, four jobs. The Enterprise Password Manager is the foundation everything else sits on. Secrets Manager extends it to applications and pipelines. Connection Manager extends it to remote sessions. Keeper EPM extends it to endpoint privilege. Because they share a vault and a console, adding one to an environment already running another is a policy change rather than a new platform to learn.
The Keeper products
Keeper Enterprise Password Manager
The vault where workforce credentials live, with the policy layer that controls them: password complexity, sharing rules, role-based access, and the SSO and directory integration that keeps it in step with your identity provider. Every other Keeper product depends on this one being configured properly, which is why the role model matters more than the encryption.
Keeper Secrets Manager (KSM)
Secrets management for applications, CI/CD pipelines and infrastructure: API keys, database credentials and certificates pulled out of code and configuration files and issued at runtime through SDKs and integrations. If a secret lives in a repository or an environment variable today, KSM is what moves it into the vault with rotation attached. This is also how Keeper handles service account management.
Keeper Connection Manager (KCM)
Brokered remote access to servers, databases and desktops through a browser, with no VPN and no credential ever reaching the endpoint. Sessions are recorded and can be terminated centrally. It is how administrators and third parties reach systems without a shared password, and it is the product that turns Keeper from a password manager into a privileged access platform.
Keeper Endpoint Privilege Manager
Keeper EPM removes standing local administrator rights from workstations and grants elevation for approved applications instead. It is the same problem CyberArk EPM solves, approached for organizations that want it running in days rather than as a project. What makes it worth naming separately is where it sits: on the same zero-knowledge vault as everything else, managed from the same console. For a team that has already consolidated password management and secrets onto Keeper, adding endpoint privilege is a policy change rather than a new platform, a new agent estate and a new vendor. As with any endpoint privilege rollout, the part that decides success is running it in audit mode first.
The zero-knowledge vault underneath
Every Keeper product stores data encrypted on your device before it reaches Keeper, and Keeper holds no key that can decrypt it. That is why a breach of the vendor's infrastructure does not expose customer vaults, and it is the section to send anyone who asks about vendor risk.
How the products fit together
| Product | The question it answers | Who needs it |
|---|---|---|
| Enterprise Password Manager | Where do workforce credentials live, and who controls policy? | Everyone — this is the foundation |
| Keeper Secrets Manager | Where do applications and pipelines get their secrets? | Teams with developers or CI/CD |
| Keeper Connection Manager | How do admins and third parties reach systems without a VPN or a shared password? | Teams with remote or third-party admin access |
| Keeper EPM | Does anyone still have standing local admin on their workstation? | Teams where users are local admins |
| The zero-knowledge vault | Where does all of it live, and who can decrypt it? | The foundation under all four |
Common questions about the Keeper products
The password vault holds credentials people use. Secrets Manager holds credentials applications use — API keys, database passwords, certificates — and hands them to code at runtime through SDKs rather than through a browser. Same vault underneath, different consumers.
Brokered remote access through a browser: RDP, SSH, VNC and database sessions with no VPN client, no credential on the endpoint, and every session recorded. It is how third parties and remote administrators reach systems without a shared password.
Keeper's endpoint privilege product. It removes standing local admin rights from workstations and elevates approved applications instead, managed from the same console as the rest of the platform.
No. Most teams start with the Enterprise Password Manager, add Connection Manager when third-party or remote admin access becomes a problem, add Secrets Manager when developers are hard-coding credentials, and add EPM when local admin on workstations shows up in an audit. Buying them together is common; turning them on together is not.
Yes. SSO through Entra ID, Okta or any SAML provider, and directory sync from Active Directory or Entra ID, so joiners and leavers flow through automatically. Where the wiring is unusual it becomes IAM integration work.
Smaller and mid-sized organizations, managed service providers, and cloud-first teams — anywhere privileged access needs to be real without the weight of an enterprise program. The full picture of which platform fits which situation is on the platforms we deliver.
Go deeper
HashiCorp Vault Alternatives: What to Move To, and Whether You Should
A renewal, a licence clause or a tier that went away is usually what prompts this question. Here is the view from the delivery side, including the case for not moving at all.
Sep 15, 2026
Zero-Knowledge Encryption Explained — And Is Keeper Zero-Knowledge?
Zero-knowledge encryption keeps your data unreadable to the provider. Here's how the architecture works and how Keeper implements it.
Aug 21, 2026
What Is a Password Vault? How Vaulting Works and Why It Beats Spreadsheets
A password vault encrypts and centralizes credentials so only authorized users can access them — a major step up from spreadsheets or sticky notes.
Aug 14, 2026Which Keeper products do you need?
Tell us what you run and where your privileged risk sits. A free consultation maps it to the right products, with no obligation.