1Password
1password.comClosed-source, cloud-only password manager from AgileBits in Canada that combines the account password with a locally generated 128-bit Secret Key.
- Owner
- AgileBits Inc.
- Based in
- Canada
- Founded
- 2005
- Type
- Standalone app
- Free plan
- No
- 14-day free trial
- Individual, per year
- $35.88
- then $47.88/yr after year one
- Latest audit
- Anvil Secure, 2024
- annual penetration test, public report
- On record
- No incidents found
- in our research
- An extra secret key protects the vault
- Audited by Anvil Secure in 2024, report public
- Price rises 1.3× after the first year
How 1Password encrypts your vault
From 1Password's security documentation, next to the other 22. 1Password is outlined.
End-to-end encrypted
Encrypted on your device before it's stored (like 20 others)
Cipher: AES-256-GCM
Yes 21
Optional 1
No 1
Website addresses encrypted
Encrypted with the rest of the item (like 18 others)
Encrypted 19
Readable 1
Not documented 3
Item names encrypted
Titles and folder names are encrypted (like 16 others)
Item titles and vault names are encrypted.
Encrypted 17
Readable 1
Not documented 5
Memory-hard password hashing
Repeated hashing, but not memory-hard: cracking hardware has an easier time (like 10 others)
PBKDF2-HMAC-SHA256, 650,000 iterations on the account password, combined with a 128-bit Secret Key via HKDF (Two-Secret Key Derivation)
Memory-hard 3
Not memory-hard 11
Not documented 7
Doesn't apply 2
Extra secret key
A second secret, made on your device, is also needed to decrypt (the only one)
128-bit Secret Key generated locally and never sent to 1Password.
Yes 1
No 14
Not documented 4
Doesn't apply 4
What you'll pay
In USD, from 1Password's own pricing page, checked 2026-10-16.
Free plan
No
14-day free trial
Individual
$35.88/yr
or $4.99 billed monthly
After the first year
$47.88/yr
1.3× the first-year price
Families
$53.88/yr
up to 5 people
- Business:
- $8.99/user/mo
- Free trial:
- 14 days
- Money-back:
- Unknown
- About the renewal:
- Renews at the regular $3.99/month billed annually.
Audits
Independent security reviews, newest first.
2024 Anvil Secure
Scope: annual penetration test. Report is public.
Summer 2024. Since November 2025, 1Password distributes pentest reports through its Trust Center.
2023 Secfault Security
Scope: annual penetration test. Report is public.
Summer 2023.
2022 Cure53
Scope: 1Password 8 for iOS and Android. Report is public.
October 2022.
- Open-source appsNoNo
- Open-source serverNoNo
- Run it yourselfNoNo
- Bug bountyHackerOneHackerOne
Certifications: SOC 2 Type 2
Incidents
Breaches, stolen data and serious flaws on record.
None found in our research. Apps, browsers and passkeys
- WindowsYesYes
- macOSYesYes
- LinuxYesYes
- iPhoneYesYes
- AndroidYesYes
- Web vaultYesYes
- ChromeYesYes
- FirefoxYesYes
- SafariYesYes
- EdgeYesYes
- Saves and fills passkeysYesYes
- Unlock the vault with a passkeyYesYes
- Passkey import and export (CXP)YesYes
Sharing, recovery and extras
- Shared vaultsYesYes
- Share with non-usersYesYes
- Emergency accessNot verifiedNot verified
- 2FA codes built inYesYes
- Breach monitoringYesYes
- Email aliasesNoNo
- File attachmentsYesYes
- SSH keys and agentYesYes
- Command lineYesYes
- Encrypted exportNoNo
- Works offlineYesYes
- Authenticator-app 2FAYesYes
- Security key for 2FAYesYes
- Password health reportYesYes
- CSV exportYesYes
Where it's a pick
Best password manager for families
Families is $53.88 for the first year, then $71.88, for 5 people. A Secret Key that never leaves your devices is combined with each master password, so a stolen vault alone can't be cracked.
Best LastPass alternative
No vault theft on record, and its Secret Key means a copied vault can't be attacked with the master password alone. Annual third-party pentests by named firms.
Best password manager for Apple users
Apps for macOS, iPhone, Windows, Linux and Android, with a Secret Key on top of your master password. Pick it when someone in the house uses Android or Linux.
All sources for 1Password (17)
- Research summary of the vendor's pages (no single link)AI-assisted research, spot-checked, checked 2026-10-16
- Wikipedia: 1PasswordNews or reference, checked 2026-10-16
- 1Password security overviewVendor, checked 2026-10-16
- 1Password blog: why 1Password can't read your vault dataVendor, checked 2026-10-16
- 1Password security white paperVendor, checked 2026-10-16
- 1Password support: PBKDF2Vendor, checked 2026-10-16
- 1Password blog: how 1Password protects your dataVendor, checked 2026-10-16
- Research summary of the vendor's pages (no single link)AI-assisted research, spot-checked, checked 2026-10-16
- 1Password security assessments (reports now in its Trust Center)Audit, checked 2026-10-16
- 1Password personal pricingVendor, checked 2026-10-16
- 1Password business pricingVendor, checked 2026-10-16
- 1Password featuresVendor, checked 2026-10-16
- 1Password support: two-factor authenticationVendor, checked 2026-10-16
- 1Password: export your dataVendor, checked 2026-10-16
- 1Password support: passkey securityVendor, checked 2026-10-16
- 1Password developer docs: SSHVendor, checked 2026-10-16
- 1Password developer docs: CLIVendor, checked 2026-10-16