Tools · SPBoucher
Menu

1Password

In-depth entry

by AgileBits Inc. (1Password) · Application · also known as 1Password 8, AgileBits 1Password

Password and secrets manager for individuals, families and businesses with end-to-end encrypted vaults, passkeys, an SSH agent and a developer CLI

ProprietaryPaidEnterpriseCloudLocal
Visit official site Compare

Link verified Nov 2, 2026

Overview

1Password is a proprietary password manager from AgileBits Inc. that stores logins, passkeys, cards, documents and arbitrary secure notes in encrypted vaults synchronized through the vendor's service. Native apps for macOS, Windows, Linux, iOS and Android, browser extensions and a web client fill credentials and generate passwords; sharing is organized through vaults with per-member permissions for families, teams and enterprises, and administrators get SSO integration, provisioning and activity reports.

Its security design, as described on the vendor's security page, combines an account password that the company states it never stores with a Secret Key generated on the device, so that data is encrypted end to end and the service cannot read vault contents; authentication uses Secure Remote Password, and the company publishes independent audit results and runs a bug bounty. For developers, 1Password exposes a CLI (op) that injects secrets into environment variables and configuration files at run time, an SSH agent that signs with keys kept in the vault with biometric approval, Git commit signing, Connect servers and Service Accounts for CI, and SDKs for Go, Python and JavaScript.

There is no free tier; individual, family and business plans are subscription-based with a trial. Because vaults are hosted only on 1Password's infrastructure, organizations requiring a self-hosted store look to Bitwarden or a dedicated secrets manager such as Vault, and the clients are closed source.

Capabilities

  • Encrypted vaults for passwords, passkeys, cards, documents and notes across all major platforms
  • Browser extensions and autofill, including passkey creation and sign-in
  • Shared vaults with permissions for families, teams and enterprises plus SSO and SCIM provisioning
  • Developer CLI (op) for injecting secrets into shells, CI and configuration
  • SSH agent and Git commit signing backed by vault-stored keys
  • Service Accounts, Connect server and SDKs for automation
  • Watchtower reports on weak, reused or breached credentials

Typical workflows

  1. Replace plaintext .env files with op run and secret references
  2. Sign SSH sessions and Git commits with keys that never leave the vault
  3. Share infrastructure credentials with a team through a dedicated vault
  4. Provision users from an identity provider with SCIM

Strengths

  • Consistent, polished clients on every platform
  • Published security model with Secret Key and independent audits
  • Strong developer tooling (CLI, SSH agent, SDKs)
  • Team administration with SSO and reporting

Limitations

  • Subscription only; no free tier
  • Closed-source clients and hosted-only vault storage
  • No self-hosted server option
  • CLI-based secret injection adds a runtime dependency to scripts

Prerequisites

  • 1Password account subscription
  • Desktop app required for the SSH agent and biometric CLI unlock

Who it is for

  • Individuals and families
  • Development teams managing shared credentials
  • Enterprises with SSO and provisioning needs

Alternatives & comparison

Bitwarden covers the same end-user use cases with open-source clients, a free tier and an optional self-hosted server, which 1Password does not offer. HashiCorp Vault and Infisical are infrastructure secrets managers for machines and pipelines rather than personal password vaults, though 1Password's CLI and Service Accounts overlap with their simplest uses.

  • Bitwarden

    Open-source password manager with hosted and self-hosted server options, passkey support, organization sharing and a separate Secrets Manager for developers

    MixedFreemium
  • HashiCorp Vault

    Identity-based secrets manager providing encrypted key-value storage, dynamic database and cloud credentials, PKI and encryption-as-a-service, under the Business Source License

    Source-availableFree
  • Infisical

    Secrets, certificate and privileged-access management platform with an MIT-licensed core, available as a hosted service or self-hosted deployment

    MixedOpen source
  • SOPS

    Command-line tool that encrypts the values of YAML, JSON, ENV and INI files with age, PGP or cloud KMS keys so secrets can be committed to git

    Open sourceOpen source
  • Web Authentication (WebAuthn)

    W3C standard defining the browser API for creating and using public-key credentials, the basis of passkeys and FIDO2 hardware-key authentication

    Open sourceFree
Compare 1Password with its alternatives →

Sources & verification

Primary sources consulted for this record. Claims are tied to the fields each source supports; the automated link checker re-verifies every URL on a schedule.

  • Official documentation
    1Password Support

    https://support.1password.com/

    Supports: capabilities, workflows

    checked Nov 1, 2026
  • Official documentation
    1Password Developer

    https://www.1password.dev/

    Supports: capabilities, interfaces, languages

    checked Nov 1, 2026
  • Official site
    1Password

    https://1password.com/

    Supports: name, summary, operating_systems

    checked Nov 1, 2026
  • Policy page
    1Password Security

    https://1password.com/security

    Supports: privacy_posture

    checked Nov 1, 2026
  • Pricing page
    1Password Pricing

    https://1password.com/pricing

    Supports: pricing_model

    checked Nov 1, 2026
Confidence
High
Reviewed
Nov 1, 2026
Links
Verified · Nov 2, 2026

Spotted an error?

Broken link, outdated license, wrong category, or a tool that no longer exists? Tell us; reports are reviewed by the editor.

SOPS

SOPS project (CNCF) · Secrets management

Command-line tool that encrypts the values of YAML, JSON, ENV and INI files with age, PGP or cloud KMS keys so secrets can be committed to git

MPL-2.0Open sourceFreeLocalNov 2, 2026