1Password

1Password is the polished, corporate-standard password manager, and its security architecture is arguably the strongest of the mainstream options thanks to its Secret Key. The trade-offs are that it is closed source, has no free plan at all, and has recently made its newest audit reports harder to read.

Security

1Password encrypts your data with AES-GCM-256 — an authenticated-encryption mode. The vault key is derived from your account password with PBKDF2-HMAC-SHA256 at 650,000 iterations, then combined with a 128-bit Secret Key that is generated on your device and never sent to 1Password’s servers. This dual-key design is the headline: an attacker who somehow obtains your encrypted data and guesses your account password still cannot decrypt anything without the Secret Key. Authentication uses SRP, so nothing password-equivalent crosses the network.

The Secret Key cuts both ways. It makes a server-side breach far less dangerous — and it makes your Emergency Kit, the document that holds the Secret Key, the single point of failure for account recovery. Lose it with no family or team recovery set up, and the vault is unrecoverable.

1Password is SOC 2 Type 2 certified and holds ISO 27001:2022 and related certifications. The most recent independent audit you can actually download is Independent Security Evaluators’ 2020 penetration test and code review. Newer annual pentests exist, but since November 2025 they live behind the 1Password Trust Center’s request-access gate rather than as open PDFs — a step back from the plain-download transparency some competitors offer. There is a public bug bounty on HackerOne.

Privacy & Trust

This is the weakest category. 1Password’s client and server code is not open source; the security design white paper is public and detailed, but you are trusting a description, not the code. Combined with the newer audits moving behind an access gate, the “verify, don’t trust” story is thinner here than with an audited open-source manager.

1Password is AgileBits Inc., a Canadian company in Toronto. It is venture-funded, with Accel and ICONIQ Growth holding board seats. Telemetry is somewhat broader than the leanest competitors: the privacy policy lists quality and performance metrics, and analytics and device/usage information that may be shared with service providers for support, summaries, and internal marketing.

In October 2023, 1Password disclosed that attackers had accessed its Okta tenant — the one it uses to manage employee-facing apps — as a downstream effect of Okta’s Support System breach. Its investigation found no compromise of user data or product systems, and the activity was terminated on detection. It was an incident in 1Password’s own IT stack, not a breach of user vaults, but it is on the record.

Recovery is zero-knowledge: 1Password does not store your account password and cannot reset it. Family and team accounts can recover a member through an administrator; individual accounts rely on the Emergency Kit and an optional recovery code.

Features

1Password’s feature set is the most complete and the most refined of the mainstream managers. Watchtower flags breached, weak and reused credentials and sites missing two-factor. Travel Mode removes selected vaults from your devices when you cross a border. Passkeys work both ways — 1Password stores and autofills site passkeys, and a passkey can unlock the 1Password account itself (via per-device keys, initially for new accounts). Secure item and vault sharing, including with people who don’t use 1Password, is built in.

Email aliases are available through a tight Fastmail integration: you can generate a Masked Email inline on a sign-up page, and it is saved to 1Password with the login. The catch is that this needs a separate paid Fastmail account — it is not a self-contained feature the way a native alias generator would be.

Usability & Platforms

1Password is the manager other managers are measured against on polish. The apps are native, consistent across Windows, macOS, Linux, iOS and Android, and the browser extension and CLI are mature. Autofill is reliable, onboarding is gentle for non-technical users, and Watchtower surfaces problems without being asked. If “it should just work, and feel good doing it” is your priority, this is the strongest option here.

Price & Value

1Password has no free tier — only a 14-day trial. Individual is $3.99 a month at the renewal rate (an introductory year runs $2.99), billed $47.88 annually; Families is $5.99 a month, billed $71.88, for up to six people. The renewal price itself is mid-range — cheaper than some paid managers, dearer than the cheapest — so the score here is not really about the sticker price. It is that there is no free plan at all to fall back on: you commit to paying from day one for the polish and the Secret Key architecture, with no option to run a stripped-down version for free the way the open-source managers let you. Whether that is worth it depends on how much you value those two things.

Pros

• Dual-key encryption: a 128-bit Secret Key combined with your account password, so guessing the password alone is not enough
• AES-GCM-256 with 650,000 PBKDF2 iterations and SRP authentication
• The most complete, most polished feature set here — Watchtower, Travel Mode, two-way passkeys, secure sharing
• Native apps on every platform plus a mature CLI; the usability benchmark for the category
• Family and team accounts add administrator-assisted recovery
• SOC 2 Type 2, ISO 27001:2022, public HackerOne bug bounty

Cons

• Closed source — you are trusting the security white paper, not auditable code
• No free plan at all, only a 14-day trial; renewal is $3.99/month individual
• Since November 2025, newer pentest reports are behind the Trust Center’s request-access gate rather than open downloads
• Email aliases require a separate paid Fastmail subscription
• Telemetry is broader than the leanest competitors (analytics, performance metrics, internal marketing)
• October 2023 Okta-tenant incident (no user data accessed, IT stack only)

Our Rating

1Password is the pick when you want the strongest architecture and the smoothest experience, and you are willing to pay for both and to trust a closed codebase. The Secret Key genuinely raises the security floor, and nothing here matches its polish. If independently verifiable code or a free tier matters more to you, one of the open-source options will fit better — but for a paid, corporate-grade manager that “just works,” 1Password sets the standard.

Rating: 8.5/10