1Password

⚠️ Article status notice: This article has been marked as incomplete

This article needs additional work for its sourcing and verifiability to meet the wiki's Content Guidelines and be in line with our Mission Statement for comprehensive coverage of consumer protection issues.

This notice will be removed once sufficient documentation has been added to establish the systemic nature of these issues. Once you believe the article is ready to have its notice removed, please visit the Moderator's noticeboard, or the discord and post to the #appeals channel.

Learn more ▼

This Article Requires Additional Verification

---

This article has been flagged due to verification concerns. While the topic might have merit, the claims presented lack citations that live up to our standards, or rely on sources that are questionable or unverifiable by our standards. Articles must meet the Moderator Guidelines and Mission statement; factual accuracy and systemic relevance are required for inclusion here!

Why This Article Is In Question

---

Articles in this wiki are required to:

• Provide verifiable & credible evidence to substantiate claims.
• Avoid relying on anecdotal, unsourced, or suspicious citations that lack legitimacy.
• Make sure that all claims are backed by reliable documentation or reporting from reputable sources.

Examples of issues that trigger this notice:

• A topic that heavily relies on forum posts, personal blogs, or other unverifiable sources.
• Unsupported claims with no evidence or citations to back them up.
• Citations to disreputable sources, like non-expert blogs or sites known for spreading misinformation.

How You Can Improve This Article

---

To address verification concerns:

• Replace or supplement weak citations with credible, verifiable sources.
• Make sure that claims are backed by reputable reporting or independent documentation.
• Provide additional evidence to demonstrate systemic relevance and factual accuracy. For example:
  • Avoid: Claims based entirely on personal anecdotes or hearsay without supporting documentation.
  • Include: Corporate policies, internal communications, receipts, repair logs, verifiable video evidence, or credible investigative reports.

If you believe this notice has been placed in error, or once the article has been updated to address these concerns, please visit the #appeals channel on our Discord server: Join here.

1Password

Basic Information
Release Year	2006
Product Type	Software,Password Managers
In Production	Yes
Official Website	https://1password.com/

1Password is a multi-platform subscription-based Password manager developed by AgileBits Inc. One of the unique elements of this password manager is the combination of a master password with a second secret key generated on-device (i.e., not in the cloud). Unlocking a user's vault therefore requires both pieces of information to decrypt and access. Conventional Two factor authentication using either software tokens or hardware-based tokens (e.g., Yubikey, Google Titan) can be added to further secure a vault. 1Password is not open source and not self-hostable.

Beyond passwords, 1Password is capable of storing myriad site credentials including one-time codes, emails / user names, and additional notes. A user can also choose a preferred single sign-on service to login.

Consumer impact summary

Freedom

Users can import existing passwords from other managers and export passwords and other content in formats suitable for importing into other managers. 1Password is not a walled-garden. Allowing the subscription to expire places an account in a read-only state, allowing the user to download their passwords and other saved content.

"You can export your 1Pasword information at any time. If you discontinue payment, your account will enter a frozen (read-only) state that still allows you to retrieve and export your information. Your export will be limited to the information you saved in 1Password. We can’t guarantee that vault permissions, group structures, and other details about relationships between people and information are included."

Privacy

Extracted directly from the privacy policy,

"We’ll never lock you out of your 1Password account, but we’re unable to decrypt it for you." (implies anything in it is hidden from the company)

"You have the right to know what we know. You have the right to know what we know about you and see how we handle that information. If you make such a request, you’ll receive a screenshot of what we can see about you in our systems. To protect customer privacy, these requests will be carefully authenticated beyond demonstrating control of the registered email address." (expect to be any identifying information you have to provide in order to use the service such as email, name, address, payment information)

User security

Users should be aware that using password manager browser extensions increases their vulnerability to clickjacking where the autofill feature of password managers is abused to trick the password manager into leaking user credentials and other sensitive details. It is always best practice to copy in these elements on trusted pages manually.

Business model

Subscription based, has a strong emphasis on enterprise credential management, especially for secret management for software development (e.g., SSH keys, authentication tokens, API keys, etc.).

Market control

This section is incomplete. This notice can be deleted once all the placeholder text has been replaced.

Password managers are pretty much a dime a dozen these days, highly competitive.

Incidents

This is a list of all consumer protection incidents related to this product. Any incidents not mentioned here can be found in the 1Password category.

1Password Okta instance breach, discovered (29 Sept 2023)

1Password published a blog post disclosing an internal investigation of the breach. It largely appears one of the attackers actions triggered an email to a member of the IT team who acted swiftly to contain the breach. The company reported user data was not exfiltrated or decrypted.

• 
  PDF document report

See also

• Bitwarden
• LastPass