1Password Review

This is an expert-researched assessment, not a claim that TopRatedSoftware ran a controlled password manager laboratory. We compared 1Password's pricing, features and security pages, its privacy policy, its developer documentation and its October 2026 command-line release notes, as published on October 20, 2026. We have not used 1Password day to day ourselves, so this review describes what 1Password documents rather than how its apps feel in use.

That distinction matters particularly for password manager reviews. A provider can document its architecture and an auditor can inspect defined controls, but neither proves how every future app build or server will behave under every condition. Our 4.7 rating reflects 1Password's documented security design, independent certification, broad platform support and developer tools. It does not mean the product is risk-free, that an audit is permanent certification, or that a password manager will solve all of a user's security needs.

1Password uses industry-recommended encryption algorithms with a dual-key model, so only you hold the keys that decrypt your data. All vault information is end-to-end encrypted with 256-bit AES. Signing in uses Secure Remote Password, which authenticates your account without sending your credentials over the internet, and 1Password says it is regularly assessed by independent experts.

Access needs two things: your account password and a Secret Key. Watchtower alerts you to weak, reused or breached passwords. 1Password also says it only fills details after checking that the browser was signed by an identified developer, clears secrets from the clipboard, and asks for your input before showing or filling data. The company is SOC 2 Type 2 certified for data confidentiality, integrity and availability.

The privacy policy separates two kinds of data. Your vault contents are encrypted with keys only you possess, and 1Password says it has no access to them unencrypted. Account and service data, such as your name, email address, payment details and support requests, is collected so 1Password can run the service, and payments go through a PCI-compliant processor. 1Password is a Canadian company headquartered in Toronto, Ontario.

The US Cybersecurity and Infrastructure Security Agency (CISA) recommends using a password manager to generate and store a strong, unique password for every account, at least 16 characters long, and turning on multifactor authentication, especially for email, social media and financial accounts. Reusing one password across accounts, CISA warns, leaves you open to account takeovers.

1Password covers each of those points: its generator creates strong, unique passwords, Watchtower flags weak and reused ones, and it can store two-factor codes itself. What it cannot do is protect an account whose master password is weak, so CISA's advice to remember only one strong master password applies here too.

1Password stores logins in encrypted vaults, along with bank accounts, payment cards, addresses and secure notes. Its built-in generator creates strong, unique passwords, and the apps save and autofill credentials. It can also store two-factor authentication codes, so you do not need a separate authenticator app, and it supports passkeys for passwordless sign-in on supported websites and apps.

You can share items with anyone, including people who do not use 1Password, through links that expire, and you can track the history of what you shared. The Families plan covers 5 people, with unlimited shared vaults and simple admin controls for managing access.

The apps run on macOS, iOS, watchOS, Windows, Android and Linux, with browser extensions for Chrome, Safari, Edge, Firefox and Brave. Travel Mode hides selected vaults while you cross a border, and you can sign in with Apple, Google or Facebook accounts.

Developers get more. 1Password Developer stores SSH keys, API tokens and infrastructure secrets, and its command-line tool lets you use secrets during development. In October 2026, 1Password CLI 2.41.0 added an --environment flag to the op run command, which loads secrets from 1Password Environments. 1Password also documents ways to give AI coding agents access to secrets without putting them in prompts, config files or agent memory.

During its current promotion, 1Password Individual costs $2.99 a month and Families costs $4.49 a month, both billed annually. The regular prices are $3.99 and $5.99 a month. Individual covers one person and Families covers 5, each with 1GB of storage.

Both plans include password generation, autosave and autofill, sharing with anyone, and alerts for weak or compromised credentials. Families adds unlimited shared vaults and admin controls. Business plans, from Teams Starter Pack to Enterprise, add SSO unlock, custom policies and device insights.

There is no free plan. You can try 1Password free for 14 days without a credit card and cancel anytime, but after that you need a subscription. Bitwarden, by comparison, has a free plan and charges $1.65 a month for Premium.

Choose 1Password if you want a documented security design and are happy to pay for it: end-to-end encryption, a Secret Key alongside your password, SOC 2 Type 2 certification and regular independent assessment. It also suits households that share logins, since the Families plan covers 5 people with unlimited shared vaults.

Developers have extra reasons to look at it. The same account can hold SSH keys and API tokens, inject secrets from the command line, and give AI coding agents scoped access to credentials. Shell plugins let AI command-line tools authenticate with your fingerprint instead of keeping API keys in shell profiles, and plugins for Claude Code and Cursor check .env files before an agent runs commands.

Look elsewhere if you want a free plan or the lowest price. 1Password requires a subscription after the 14-day trial, the advertised prices are promotional, and the regular Individual price is $3.99 a month. Families is cheaper per person: $4.49 a month for 5 people works out to about 90 cents each. Bitwarden's free plan, by contrast, already covers unlimited devices.