1Password

Is 1Password safe?

Yes, for most people. 1Password encrypts your vault on your own devices, and its sign-in design means that even a full copy of its servers' data would not let an attacker try to guess your password offline. No breach of user vaults has been reported in the company's 20-year history. We score it 86/100, two points below Bitwarden (88).

The gap comes from things outside the encryption. The iPhone app collects more analytics than Bitwarden's, the code is closed, and you cannot export your data in encrypted form. On security alone, we rate 1Password slightly higher.

How the Secret Key protects you

Most password managers protect your vault with one secret: your master password. 1Password adds a second. When you create an account, the app generates a Secret Key with 128 bits of randomness and keeps it only on your devices and in the Emergency Kit you print or save. The white paper calls this two-secret key derivation. Your account password is stretched with PBKDF2 (650,000 rounds) and mixed with the Secret Key, and the result unlocks the keys that encrypt each vault with AES-256-GCM.

Sign-in uses Secure Remote Password (SRP), a protocol that proves you know the password without sending it. So 1Password never stores anything that could be cracked by guessing. This is the main practical difference from LastPass, whose stolen 2022 vault backups could be attacked offline wherever users had weak master passwords.

The trade-off: lose both the account password and the Secret Key and 1Password cannot recover your data. Family organisers and business admins can help with recovery; individuals need the Emergency Kit or recovery codes.

Has 1Password been hacked?

Not its vaults. The closest call came in September 2023. On 29 September, 1Password spotted suspicious activity in the Okta instance it uses to manage employee apps, ended it and investigated. By 20 October it had confirmed that the attacker came through the breach of Okta's own customer support system. 1Password said it found no compromise of user data or of other employee-facing or customer-facing systems, and an updated report on 25 October said its Google instance was not affected either. Only 1Password's word stands behind that conclusion, but nothing has emerged since to contradict it.

Two flaws in the macOS app, CVE-2024-42218 and CVE-2024-42219, were made public in August 2024. Both needed malware already running on the Mac and could expose vault items; they were fixed in versions 8.10.36 and 8.10.38.

What the 2026 ETH Zurich study found

In February 2026 cryptographers from ETH Zurich and Università della Svizzera italiana tested four password managers against a hostile server: one run by an attacker who has taken over the company's systems. They found 6 attacks against 1Password, against 12 for Bitwarden, 7 for LastPass and 6 for Dashlane. Most attacks across the study could recover passwords.

1Password replied the same day that the paper added no new attack beyond limits already in its white paper. The main one is that you cannot check that a public key really belongs to the person you share a vault with, so a compromised server could swap in its own. Sharing vaults is where this matters; a personal vault you never share is less exposed. Fixing it needs structural changes, which 1Password says it is working on.

What 1Password collects

Apple's privacy label lists usage data, crash data, coarse location, email address, name, other user content and user and device IDs, all linked to you, for analytics, app functions and "other purposes". None of it is marked as used to track you across other companies' apps. The privacy notice says the website and marketing partners use cookies for advertising, separate from the apps. Vault contents ("Secure Data") are excluded: 1Password says it has no way to decrypt them and can only hand them over encrypted.

Watchtower, the built-in checker, flags reused and weak passwords, sites with a reported breach, logins on plain http and accounts that support two-factorTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary codes. Separately, 1Password saves and fills passkeysPasskeyA way to sign in without a password. Your device holds a key tied to one website or app and unlocks it with your fingerprint, face or PIN.More in the glossary, which cannot be phished the way passwords can.

Who owns 1Password

1Password is made by AgileBits Inc., founded in Toronto in 2005. It ran without outside money until Accel invested USD 200 million for a minority stake in November 2019. A USD 620 million round led by ICONIQ Growth in January 2022 valued it at USD 6.8 billion. David Faugno is chief executive. The company says more than 200,000 businesses use it, and many new features are aimed at them first.

How to set up 1Password safely

1. Save the Emergency Kit offline or in a safe place, not only in your email. Without the Secret Key and account password, nobody can open the vault.
2. Use an account password you have never used elsewhere. If your account dates from before 27 January 2023, changing it moves you to the current 650,000-round setting.
3. Turn on two-factor authenticationTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary for the account with an authenticator app or security key.
4. Be careful with shared vaults: invite only people you know, and check membership in shared vaults now and then.
5. Delete export files once you have used them. The 1PUX and CSV formats are not encrypted.

How we scored it

Apart from a clean regulatory record (96), security (87) is the strongest factor, helped by the Secret Key and SRP and held back by the 2026 malicious-server findings. Privacy (84) and transparency and control (84) are lower than for Bitwarden because of the analytics on Apple's label, closed code and unencrypted exports. For encrypted email from a company with a similar record, see Proton Mail (85).