1Password is the password manager people recommend when they do not know what you need. That is mostly deserved \u2014 it is the most polished product in the category \u2014 but it also has two characteristics that make it wrong for a meaningful number of buyers.<\/p>\n
There is no free tier, and there is no self-hosting. If either is a requirement, stop reading and look elsewhere. If neither is, this is probably the best product available.<\/p>\n
This review is based on 1Password’s documented features and published security architecture rather than on independent testing, and it says so plainly where that matters.<\/p>\n
Most password managers encrypt your vault with a key derived from your master password. If an attacker steals the encrypted vaults from the vendor’s servers, the only thing standing between them and your data is how good your master password was.<\/p>\n
1Password adds a second factor to the encryption itself: the Secret Key<\/strong>. This is a 128-bit key generated on your device during setup, never transmitted to 1Password, and combined with your master password to derive the encryption key.<\/p>\n The practical consequence is significant. A server-side breach does not give an attacker something they can brute-force offline, because they are missing a high-entropy key that never existed on 1Password’s infrastructure. Authentication also uses SRP, so the master password itself is never sent over the network even during login.<\/p>\n This is a genuine design advantage, and few competitors replicate it. It is the strongest argument for the product.<\/p>\n The trade-off: you must keep the Secret Key.<\/strong> Lose both it and your signed-in devices, and 1Password cannot recover your vault. That is the correct behaviour for a zero-knowledge system, and it catches people out.<\/p>\n Items are organised into vaults, which can be personal or shared. Shared vaults are how families and teams distribute credentials without messaging them around, and the permission model on business plans is granular enough to be useful.<\/p>\n The item types go well beyond logins: secure notes, credit cards, identities, software licences, SSH keys, API credentials, documents.<\/p>\n Monitors your vault for reused passwords, weak passwords, credentials appearing in known breaches, sites that support two-factor you have not enabled, and expiring items. It surfaces this as a prioritised list rather than a wall of warnings, which is why people act on it.<\/p>\n This is the feature most likely to materially improve your security in the first week.<\/p>\n Temporarily removes vaults you have not marked as travel-safe from your devices, so a border inspection cannot reveal them. Genuinely useful for journalists, lawyers and anyone crossing borders with sensitive client data; irrelevant for most people.<\/p>\n 1Password supports storing and using passkeys, and was early to it. As more services adopt passkeys, having them in the same vault as your passwords rather than locked to one device ecosystem is a real convenience.<\/p>\n The CLI, SSH agent and secrets-injection tooling are unusually good, and a genuine reason engineering teams pick 1Password over cheaper options.<\/p>\n This is where 1Password separates from the field. The desktop and mobile apps are fast, coherent and pleasant, browser autofill is reliable, and setup is guided well enough that non-technical family members manage it.<\/p>\n That matters more than it sounds. A password manager only works if people use it. The most secure product that your team abandons after a month provides nothing.<\/p>\n 1Password is subscription-only across individual, family, and business tiers. It moved away from one-time licences years ago and has not returned, which remains a live objection for some long-time users.<\/p>\n There is a free trial but no permanently free tier \u2014 a meaningful gap given that Bitwarden’s free tier covers unlimited passwords on unlimited devices.<\/p>\n Pricing changes periodically and varies by region and plan, so verify current pricing on 1Password’s own page rather than relying on figures quoted in reviews.<\/p>\n Being direct about the limits:<\/p>\n Families.<\/strong> The shared vault model and the quality of the apps make it the one non-technical relatives will actually adopt.<\/p>\n Small businesses without dedicated IT.<\/strong> Straightforward admin, good onboarding, sensible defaults.<\/p>\n Development teams.<\/strong> The CLI, SSH agent and secrets tooling are best-in-class.<\/p>\n Anyone crossing borders with sensitive data.<\/strong> Travel Mode has no real equivalent elsewhere.<\/p>\n Anyone who needs free.<\/strong> Bitwarden, and it is not a compromise.<\/p>\n Anyone who must self-host.<\/strong> Bitwarden’s self-hosted server or Vaultwarden.<\/p>\n Anyone who objects to subscriptions.<\/strong> Enpass still offers a one-time purchase.<\/p>\n Anyone who requires open-source clients.<\/strong> Bitwarden or KeePassXC.<\/p>\n It depends what you value. Bitwarden’s free tier is genuinely capable and open source. 1Password gives you the Secret Key architecture, better apps, Watchtower and Travel Mode. If polish and adoption across a family or team matter, the subscription is defensible. If not, Bitwarden is not a downgrade in security terms.<\/p>\n If you also lose access to every device already signed in, your vault cannot be recovered \u2014 not by you and not by 1Password. This is a consequence of the zero-knowledge design. Save the Emergency Kit somewhere physical.<\/p>\n 1Password disclosed a security incident in 2023 affecting an internal system, and reported that customer vault data was not compromised. The Secret Key architecture is specifically designed so that a server-side compromise does not expose vault contents. Check their published incident reports for current detail.<\/p>\n No. There is a trial, but no permanently free tier. If free is a requirement, Bitwarden is the standard recommendation.<\/p>\n Yes, for both storing and using them, and it was an early adopter. Keeping passkeys in a cross-platform vault avoids being locked into a single device ecosystem.<\/p>\n Yes, particularly small businesses without dedicated IT and development teams that will use the CLI and secrets tooling. Organisations with heavy compliance reporting requirements may find Keeper’s admin controls a better fit.<\/p>\n 1Password is the best-executed password manager available, and the Secret Key architecture is a real security advantage rather than marketing. The apps are good enough that people who resist password managers will actually use it, which is the property that determines whether one works at all.<\/p>\n The two hard limits are the absence of a free tier and the absence of self-hosting. Neither is a flaw so much as a product decision, but both disqualify it for specific buyers.<\/p>\n If you can pay and do not need to self-host, this is the one to beat.<\/p>\nCore Features<\/h2>\n
Vault organisation<\/h3>\n
Watchtower<\/h3>\n
Travel Mode<\/h3>\n
Passkey support<\/h3>\n
Integrations for developers<\/h3>\n
Apps and Usability<\/h2>\n
Pricing<\/h2>\n
What It Does Not Do<\/h2>\n
\n
Who It Suits<\/h2>\n
Who Should Look Elsewhere<\/h2>\n
Common Mistakes to Avoid<\/h2>\n
\n
FAQs<\/h2>\n
Is 1Password worth paying for when Bitwarden is free?<\/h3>\n
What happens if I lose my Secret Key?<\/h3>\n
Has 1Password ever been breached?<\/h3>\n
Can I use 1Password for free?<\/h3>\n
Does 1Password support passkeys?<\/h3>\n
Is 1Password good for businesses?<\/h3>\n
Verdict<\/h2>\n
Key Takeaways<\/h2>\n