1Password Blog

I've done the same thing, with the same results. These guidelines are impressive. 1Password created an excellent summary: https://blog.1password.com/nist-password-guidelines-update/

Their Android client has been maintained for over a decade, from what I can see. It’s not something even remotely recent as you’re implying. I’ve used the Android client and it works great. Passkeys aren’t supported in 1Password on Android because Google has not released APIs to allow that. Not because Android support is an afterthought. Which you would know if you had researched this: https://blog.1password.com/save-use-passkeys-web-ios/ Your information on this topic is woefully out of date and wrong.

I love JMAP. It's what allowed me and my team (at 1Password) to easily add support for Masked Emails, where we randomly generate your email address in addition to your password. Our own Madeline Hanley wrote about that experience, if you'd like to see what it's like to work with JMAP: https://blog.1password.com/making-masked-email-with-jmap/

My best guess is that Apple won't do it because their plan is to phase out passwords entirely. That's what that whole FIDO Alliance (https://fidoalliance.org) is all about. And 1Password is part of that too: https://blog.1password.com/1password-is-joining-the-fido-alliance/ I think that ultimately a password tool needs to be available on multiple platforms, like 1Password. Having it just be on Apple stuff just isn't gonna work for the many Windows and Linux machines I begrudgingly have to interact with.

The use of the secret key is part of 1Password’s operational security - a target full of worthless data is less likely to be breached: https://blog.1password.com/what-the-secret-key-does/

Hi. I'm a features developer for 1Password. You raise a very good question (one that I used to have myself, before I started working here). I would recommend you read our security whitepaper (https://1password.com/files/1Password-White-Paper.pdf) if you want details, but the TL;DR is that we don't know your account password and our servers only store your encrypted information (which we cannot read), and communication is done over HTTPS with an additional layer of encryption via the SRP (Secure Remote Password) protocol. You also might enjoy this blog post: https://blog.1password.com/what-if-1password-gets-hacked/

Yes. https://blog.1password.com/totp-for-1password-users/ It isn’t a degradation of security, in my opinion, it’s an upgrade, when certain accounts are involved. For these shared accounts, such as those used by my family, and on services which don’t support account-per-person in an “organization” or “household” sense, this still provides for TOTP in a way my spouse and I can both login. Ensuring just the loss of the password isn’t enough to compromise the account is an upgrade vs. not having TOTP enabled. Where we can both have our own accounts and use U2F tokens that’s a better story, clearly, but 1Password having this functionality is great!

Thanks for sharing. I’m sorry it took us so long to release a native Linux app. We have a great app for Linux now in beta and will move it to an official release shortly. https://blog.1password.com/1password-for-linux-beta-is-now-open/ I hope you can give us another chance. —Dave 1Password Founder

> The only way passkeys make sense is in terms of vendor lock in. This is what I've figured as well, and even if my password manager claims "eventually we'll support it, once it's available" (https://blog.1password.com/fido-alliance-import-export-passkeys-draft-… I've been putting it off until the implementation is actually in place. But the question is when that'll be. Last I've heard about the whole "Risk of lock-in from export blocking" is: > The general vibe is supportive and language has been added to this effect, though it looks like we haven't done a public working draft in some time so I don't think that's externally visible yet. Also usual caveats about in-progress work subject to change. https://github.com/fido-alliance/credential-exchange-feedback/issues/2… I guess time will tell. But for now, considering the history of lock-in on the web, it's best to stay away from Passkeys for now, until they figure out a proper way of avoiding it.

I love 1password's "Show in Large Type" feature, which shows your password in a large monospace font with symbols and numbers clearly differentiated. Makes it super easy to see and type on another device (like when you have it open on your phone and use it to log in on another computer). https://blog.1password.com/posts/2018/b5x1.10/large-type.png Small touches like that are awesome, and why I'm happy to pay for 1password over the OS or browser password managers or competitors like Bitwarden. ----- For my company's support team, they often had to reset customer passwords over the phone (I know, how archaic). I copied that 1password look and then added the NATO phonetic alphabet below each letter / number so they can easily read the entire password out loud (like "whiskey tango foxtrot delta zero zero delta"). Last I heard, that one tiny tweak (which took twenty minutes to add) ended up saving them hours on the phone each day just by preventing a bunch of misspoken/misheard passwords.

I use and generally recommend 1password. I've used it on every major mobile and desktop OS browser. (I've had some issues on Android, but it was not a standard Android OS.) The UX is generally nice. First, they encrypt with the secret key AND the master password. This is the most important thing, and I was shocked to learn Lastpass doesn't do it. Second, the master password runs through PBKDF2 with 100000 rounds, but a precursory Google search suggests the very earliest versions used around 10000. Lastpass's problem was a low 5000 rounds, and did not update the number of rounds. I don't know if 1password updates the number of rounds. Third, they use a zero-knowledge proof protocol called "secure remote password". When I was sharp in cryptography, this is what made me choose 1password over the others. I don't understand all the details anymore, and I don't know if it is "post-quantum secure." Fourth, the UX is nice and I can recommend it to anybody who is literate. (This is not a cynical take-- I don't know how good the UX is for someone who is not fluent in a language 1password uses.) (Also, 1password recently released "1password 8", a new UI. I have not tried it and cannot speak to it.) Fifth, 1password's biggest (only?) controversy was moving to a subscription model. I actually prefer this. (I want devs to be paid in perpetuity to keep this secure! I assume 1password has security holes somewhere, and I want 1password to pay their folks to find them…

There's also a FIDO standard in the works for how to export passkeys: https://blog.1password.com/fido-alliance-import-export-passkeys-draft-…

> It's tied to vendor lock in If you're referring to the inability to transfer passkeys across systems, that should be improving soon. https://blog.1password.com/fido-alliance-import-export-passkeys-draft-… https://arstechnica.com/security/2025/06/apple-previews-new-import-exp…

I suspect that Wasm on the web mostly just works and so we don't hear too much about it. It is occasionally mentioned in passing though, usually as part of another announcement. Well-known production users of Wasm on the web include Dropbox [1], Adobe [2], Figma [3], and 1Password [4]. [1]: https://dropbox.tech/tech/2018/06/building-better-compression-together… [2]: https://thenewstack.io/adobe-developers-use-webassembly-to-improve-use… [3]: https://www.figma.com/blog/webassembly-cut-figmas-load-time-by-3x [4]: https://blog.1password.com/passkey-crates

Actual article: https://blog.1password.com/add-locations-to-items/

> 1P will support it in a standards-compliant way soon: https://blog.1password.com/fido-alliance-import-export-passk... See then believe, in the current environment saying "soon" based on 1password submitting a draft is much too optimistic, given the big interests Google and Apple have in neutering this possibility.

Import and export of passkeys is coming "soon" to 1Password (as of October): https://blog.1password.com/fido-alliance-import-export-passkeys-draft-… I think some vendors do have intentions of locking in users with passkeys (*cough* Apple *cough*), but I also think it's also not the only explanation for why import and export isn't supported by most managers. A more charitable explanation would be that since passkeys are 'new', there's less people demanding import/export since they have very few passkeys to move around, and at least some vendors wanted to take time to develop a good solution for it / focus resources on actually getting the daily usage of passkeys working.

1P will support it in a standards-compliant way soon: https://blog.1password.com/fido-alliance-import-export-passkeys-draft-… KeePassXC also supports export but not yet using the aforementioned standard: https://github.com/keepassxreboot/keepassxc/issues/11363

Not just "most passkey stores". The spec has nothing about export/sync, so they've been working around it by hand. There is a process of drafting a decision to put before the committee to change this ~now[1], but tbh I think the omission from v1 is a strong sign that the omission is literally intentional. I'm sure spec authors will disagree, as I am sure that many are well-meaning... but there are very strong incentives for the current giga-corps to impede and complicate it during design phases, as they are now doing to the UX. If backups and device-loss considerations for such intensely personal data is not baked in, simply, and mandated from day 1, it's intentional by someone. [1]: https://blog.1password.com/fido-alliance-import-export-passkeys-draft-…

This is more recent: > There is no more incentive to collect, misuse, or otherwise do anything with user data. In fact, for Kagi, user data is a liability. We don’t want it. We have nothing useful to do with it. You have to log in for Kagi and create an account because that’s the nature of a subscription-based business model; you somehow have to tie the payment to an account. But other than that, there is really no incentive for Kagi to ever want to touch your data. https://blog.1password.com/real-cost-search-engines-interview/

Not really? Even in the same basket, having TOTP and passwords on iCloud mitigates a lot of scenarios, such as leaked passwords. Depending on your threat model, this solution is ok — way better than no 2FA at all or SMS. 1Password has a nice article regarding this point: https://blog.1password.com/1password-2fa-passwords-codes-together/

> And Apple does the same with Safari and their password manager. No, they don't. Apple vends an API to allow third party password managers to hook into Safari and other apps to save and provide passkeys. I use 1Password on Windows and iPhone to use my passkeys between Firefox, Chrome, and Safari. https://developer.apple.com/passkeys/ https://developer.apple.com/documentation/authenticationservices Looks like Chrome on Android has flagged support for this (not enabled by default) so presumably thats coming soon as well. https://blog.1password.com/save-use-passkeys-android/ https://1password.community/discussion/143903/how-do-i-use-passkeys-in…

1Password wrote a blog post stating something similar. Basically it comes down to if you're using TOTP as a true second factor. If you are it really shouldn't even be accessible from the same device. https://blog.1password.com/totp-and-1password/

It does to a certain extent but it may be a negligible compromise depending on what you use as your second factor. https://blog.1password.com/1password-2fa-passwords-codes-together/

1Password covered this very well: https://blog.1password.com/1password-2fa-passwords-codes-together/

Privacy.com has a 1password integration so I have it create cards instead of filling in my real card https://blog.1password.com/privacy-virtual-cards/

These days, password managers such as 1Password are easy enough to use even for non-tech-savvy people. Other than that, although the process can become tedious when applied manually to a multitude of passwords, diceware helps with generating easy-to-remember passwords: https://diceware.dmuth.org/ https://blog.1password.com/toward-better-master-passwords/ You probably still want to keep a secure record of those somewhere, which is where password managers come in handy again.

All 3 customers detected it quickly on their own. It sounds from their blog posts that BeyondTrust and Cloudflare both had good alerting that immediately alerted them to the problem. It sounds like 1Password's alerting wasn't as good, and they got lucky that the impacted employee saw a suspicious email saying "here's the report you requested" thought "I didn't request that report" and reported the suspicious email to the security response team. https://www.beyondtrust.com/blog/entry/okta-support-unit-breach https://blog.cloudflare.com/how-cloudflare-mitigated-yet-another-okta-… https://blog.1password.com/okta-incident/

https://blog.1password.com/okta-incident/ Original Incident Report: https://blog.1password.com/files/okta-incident/okta-incident-report.pd…