Skip to main content

1Password review

1Password is the best password manager for Apple users and frequent international travelers

1Password review
(Image: © 1Password)

Our Verdict

With big improvements to its Windows and Android apps, 1Password isn't just for Apple users anymore, but it still lags behind LastPass.

For

  • Travel Mode to evade nosey border guards
  • Strong organizational tools
  • Secret Key encryption

Against

  • Weak mobile experience
  • Outdated design on desktop
  • No free tier
1Password specs

Platforms: Windows, Mac, iOS, Android, Linux, Chrome OS, Darwin, FreeBSD, OpenBSD
Free version: Not available
2FA: Yes
Browser plugins: Brave, Chrome, Edge, Firefox, Safari
Form filling: Yes
Mobile PIN unlock: Yes
Biometric login: Face ID, Touch ID on iOS & macOS, Windows Hello, Pixel Face Unlock, most Android fingerprint readers
Killer feature: Travel Mode

1Password is the favorite password manager of many Apple fans but is lesser known outside those circles. 1Password started out as a pay-once desktop application, but the company shifted to a $36 yearly subscription plan a few years ago.

Fortunately for 1Password, two of the other best password managers, Dashlane and LastPass, recently raised their subscription rates to match or surpass 1Password's. What seemed like a high price a few years ago no longer does.

As our 1Password review shows, the service has started to show signs of improvement, but it still lags behind the features and design of similarly priced competitors. LastPass provides a better experience, especially on non-Apple platforms, and has an excellent free tier.

1Password: Costs and what's covered

New users can try 1Password free for up to 30 days, but after that you'll need to choose between a personal plan —  $35.88 per year for a single user — or for a family plan that covers up to 5 users for $59.88 per year. Any additional users on a family plan will cost you $12 per year. 1Password has killed off its free mobile apps.

All users get syncing of unlimited passwords across all their devices, access to accounts online and offline, a password generator, a Security Audit, security alerts, email support, 1GB of secure storage and one year of item history to restore deleted data or passwords. The family plan adds sharing of passwords and documents, permission controls and account-recovery tools.

Mac users can still buy a single license for the 1Password standalone application for a one-time fee of $64.99, but this is not advertised. To purchase this version, you have to download 1Password 7 from the AgileBits website, then click "Need a license? We have those too" when prompted after opening the app for the first time. 

The standalone option lacks many of 1Password's advanced features, including sharing, restoring items, Travel Mode, and the Two-Secret Key Derivation security feature. You'll have to pay again for major version updates to the desktop application.

To sync the standalone desktop app's data with the mobile 1Password apps, you would need to make a one-time in-app purchase of $9.99 in the iOS and/or Android app to unlock the Pro features.

1Password 7 supports Windows 7 and above along with Microsoft .NET 4.6.2 or later. For macOS, you will need 10.13 High Sierra or later.

1Password X, the full-featured "new" browser extension, supports Linux and Chrome OS as long as you are using Brave, Google Chrome or Mozilla Firefox. The "old" browser extension is available for Brave, Chrome, Edge, Firefox, and Safari. (Opera and Vivaldi may be able to use one or both of the Chrome extensions.) There are also command-line 1Password interfaces for Windows, Linux and macOS/Darwin and Darwin's cousins FreeBSD and OpenBSD.

On mobile devices, 1Password requires iOS 12.2 or later and for Android at least Android 5.0 Lollipop.

For this review, I used 1Password on a 2017 MacBook Pro 15 running Windows 10 and macOS 10.14 Mojave, an iPhone 7 Plus, and a Google Pixel 3 running Android 9 Pie. Google Chrome was my primary browser across all platforms but testing on macOS and iOS was also done with Safari.

1Password: Setup

Your first step to get started with 1Password is to create an account on the 1Password site. You enter your name and email address, then confirm the 6-digit confirmation code sent to your email address. You also need to enter your credit-card information, but you won't be billed until the end of the 30-day free trial. 

(Image credit: 1Password)

Once this is done, you will receive a unique "Secret Key" (a 34-character set of letters and numbers) that acts in conjunction with your master password to protect your account. 

1Password will give you an "Emergency Kit" PDF to download that includes your email address, the secret key and a blank space to enter your master password. You are meant to print this out or digitally store it somewhere completely secure should you lose access to your account.

(Image credit: 1Password)

Like other password managers, 1Password does not have access to this information, so if you lose your master password, your data is gone. The one exception is that for family accounts you can designate a "recovery member" who can recover another family member's account.

Once you log into your account on the 1Password site, you'll be presented with a helpful little welcome section at the top left of the screen that guides you through installing 1Password apps across your devices. If you jumped ahead to installing apps, then this same guide is included as a note in your Vault. 

The software-installation process has improved since I last reviewed 1Password, with 1Password Mini automatically installing itself into the Mac menu bar. I did have to install the Chrome Browser extension, but 1Password Mini prompted me to do so immediately when I opened it.

If you were already using another password manager or the built-in password manager in your browser, you can import your existing data into 1Password. 1Password lags behind others in this department, with direct-import options only for LastPass, SplashID or previous 1Password data, as well as the CSV (a comma-separated values data sheet) import.

Fortunately, most password managers do offer an easy CSV export, so this shouldn't really present a problem. Dashlane is a notable exception, and that happened to be the service I was importing from. I needed to edit the CSV file to remove non-login data and align with 1Password CSV requirements before I could complete the import.

(Image credit: 1Password)

To install the 1Password app on your mobile devices, you will need the aforementioned "Emergency Kit" to complete this process. You can either enter your secret key scan the QR code on the Emergency Kit. After that's done, then 1Password is just like any other password manager: Simply enter your master password and your data will be synced automatically. 

1Password on the desktop

The desktop app for 1Password is still a pretty basic experience. Like RoboForm's desktop, it resembles a built-in utility more than a third-party app.This may be part of the appeal of 1Password for many long-time Mac fans. But for mobile-first users or fans of more modern design principles, the user interface will seem outdated and unintuitive.

(Image credit: 1Password)

Thankfully, the design is minimal and doesn't overwhelm you with options. Four primary sections display in the left column of the app: Vault, Watchtower, Categories and Tags. You can collapse or expand any of these sections if you wish.

Vaults helps you organize passwords into logical groups, such as work versus home or whatever fits your life. Family accounts have both private vaults and shared vaults by default. 

(Image credit: 1Password)

Watchtower breaks potential security concerns down into seven different sections. Compromised Websites and Vulnerable Passwords identify accounts or passwords that are part of known breaches, the latter drawing data from haveibeenpwned.com. Reused and Weak passwords are passwords you use across multiple services or that simply are not complex enough.

Unsecured Websites flags login pages that use the insecure "http" protocol rather than the secure "https" one. The Two-Factor Authentication section is a cool new feature that flags sites that support 2FA and will help you get it enabled. Finally, the Expiring section identifies any accounts, cards or services you have saved in 1Password that expire soon. 

(Image credit: 1Password)

The default view for 1Password displays all your items. Categories is how you can sort them. This list is going to vary depending on what you put into 1Password — there are 18 different pre-set categories available, so it could get quite lengthy if you use all of them.

Finally, we have Tags, which lets you tag any password entry with one or more labels of your own design, and then view all items so labeled simply by clicking on the name of tag. It's sort of your own Categories. 

You can definitely sense an appreciation for order in 1Password, as three of the four sections in the left column are dedicated to sorting and managing the items in your account. 

I still find the need to enter keyboard commands for form-filling and other relatively simple tasks to be unnecessary. The desktop application has other small inconveniences, such as forcing me to click before I can scan my fingerprint to log into the app.

After using the app for a few weeks, you'll probably grow accustomed to these annoyances. If you are already a hotkey ace, they likely won't bother you at all. For everyone else, LastPass or Keeper get the job done a little easier.

1Password: Travel Mode

1Password's Travel Mode is definitely a niche feature, but for those who value or need it, no other password manager really offers anything comparable. Basically, Travel Mode lets you keep passwords and other sensitive data safe from border inspectors who may want to inspect your devices and your social-media accounts.

(Image credit: 1Password)

To use Travel Mode, first flag your Vaults as "Safe for travel" or "Remove for travel." Then if you are going on an international trip, you toggle on Travel Mode in your profile on 1Password.com and it will remove any vaults flagged "Remove for travel" from your device.

This is the ultimate protection from anyone accessing your data even if your device is seized. When you get back home, toggle off Travel Mode and the vaults will be restored.

1Password: Browser extensions

Looking beyond the standalone app, things can get a little confusing. First of all, 1Password has two sets of browser extensions. One set requires the 1Password desktop app to function, while the newer set, called 1Password X, stands alone. (LastPass does something similar with its "binary component" extensions.)

Then there's 1Password Mini, which is a Menu Bar dropdown on macOS but also requires the desktop app to be present. Both the first-generation extensions — available for Brave, Chrome, Edge, Firefox, and Safari — and 1Password Mini are really intended as quick search-and-go access to your passwords rather than alternatives to the primary app

1Password X is the collective name for the newer browser extensions for Brave, Chrome, Edge and Firefox (but not Safari) that offer standalone functionality. This is how Chrome OS users can access 1Password, and how Linux users can have a graphical 1Password interface.

While 1Password X it isn't as full-featured as the primary app by any means, it covers the basics as well as the functions of the standard extensions and 1Password Mini.

Pop-up windows are used to save any new passwords or insert your existing usernames and passwords. You can also generate new passwords in 1Password X, either to your specifications or completely automatically — it will simply create a 30-character password by default when presented with a new password field.

Certain aspects of 1Password X still in development will further match its functions with those of the standalone app, making for a much more robust experience in the future.

1Password mobile apps

While 1Password on iOS is still the better mobile app, things have considerably improved for Android users on Android 8.0 Oreo and later. Both platforms' now apps support form-filling and biometric login for apps and password entry. 

Android users on Android 7.1.2 or earlier can still use the 1Password keyboard by adding it to their devices via the accessibility settings. Logging in with the keyboard is not as convenient as using a single fingerprint tap, but with the quick keyboard switching it's really only two extra taps, so it's not a horrible inconvenience.

(Image credit: 1Password)

Like most password managers, 1Password lets you unlock the mobile apps with a PIN instead of the full master password. It also lets you use Face ID or Touch ID on iOS, Face Unlock on Pixel 4 phones, and most Android fingerprint readers.

The overall look of the mobile apps remains the same as the last time I reviewed them, and they still look better than the desktop. 1Password X shares some of the mobile apps' design cues, so there is reason to hope that desktop users will enjoy a more modern interface soon. 

(Image credit: 1Password)

The overall functionality of the mobile apps remains incomplete compared to the desktop app. You can access to all your items and add new ones, but none of the Watchtower features are available to either mobile app, and on the Android app, you cannot create new vaults. However, you can make changes to the settings for Watchtower, which seems odd for a feature that you can't otherwise access. 

While I would like to see 1Password bring its mobile apps closer to the desktop experience, the apps do their basic job of password handling well, and for most users that is likely enough. Anyone looking for a richer mobile experience should try LastPass or Dashlane.

1Password: Security

1Password uses the same 256-bit AES encryption that most password managers use, along with a master password that is known only to the user. 

Their secret sauce continues to be the 34-character long Secret Key generated when you create your account. It acts in tandem with your master password to create an encrypted password database with 128 bits of entropy that is for all intents and purposes uncrackable. The only password manager I tested that does anything similar is Blur with its backup passphrase.

1Password is now Service Organization Controls (SOC 2) compliant. That means it's certified by the American Institute of Certified Professional Accountants and has to undergo audits and thoroughly document its security policies and procedures.

(Image credit: 1Password)

1Password has also added support for two-factor authentication (2FA). AgileBits used to claim 2FA was unnecessary due to each 1Password user's secret key, but the company finally gave in and added this welcome layer of security.

1Password users can choose between an authenticator app with time-based one-time password (TOTP) such as Authy or Google Authenticator, or a physical U2F security key like Yubico's YubiKey or Google's Titan key, for their 2FA method. SMS-based texted codes are not supported for security reasons.

1Password review: Bottom line

1Password has taken a couple of steps in the right direction, with the design and functionality of 1Password X giving me hope that 1Password will push its design forward. The apps remain great from a functional standpoint, and for those that like the basic look and feel of the desktop application, 1Password is a reasonable choice. 

The fact that 1Password's strongest competitors have raised their subscription rates in helps 1Password as well, as it is no longer near the top of the price chart. Overall, however, I would still recommend trying LastPass or saving some money by going with Keeper, as both deliver superior design and features.