1Password Review 2026: Great Autofill, No Free Tier

1Password is the password manager that wins on experience: autofill is the most reliable in the category, the apps are the most polished, and the onboarding is the easiest to hand to someone who has never used a vault. The trade-offs are a mandatory subscription with no free tier, a closed-source client, and a 2026 price rise that changed the value calculation against Bitwarden. With no free plan underneath it, the 14-day trial is the whole evaluation window, so it is worth knowing what happens to a 1Password vault once that trial ends before you import anything.

This review analyses 1Password’s published security design documentation, its third-party assessment index, and its official pricing pages. It is documentation and audit analysis, not a hands-on trial.

The Secret Key architecture

1Password’s security model differs from most competitors in one structural way. In addition to your account password, a 128-bit Secret Key — presented to you as a 34-character string — is required to derive the keys that decrypt your vault. The Secret Key is generated locally on your device during signup and is never transmitted to 1Password’s servers.

The practical consequences are worth stating plainly:

• If an attacker takes a copy of your encrypted vault from 1Password’s infrastructure, your account password alone is not enough to decrypt it. They need the Secret Key too, and it is not on the server.
• If your account password is captured by a phishing page, a keylogger, or credential reuse, the account still cannot be unlocked from an unenrolled device.
• If you lose both your account password and your Secret Key, the vault is unrecoverable. 1Password cannot reset it, because 1Password never had the material required to do so.

That last point is the cost of the design. The Secret Key lives in the printable Emergency Kit PDF generated at signup. On a Families account every member has their own Secret Key, which is why family recovery exists as a separate mechanism: the family organiser can initiate recovery for a member who has lost access, which is the closest thing to a reset that the architecture permits. The Security Design documentation describes the full derivation, including AES-GCM-256 content encryption and PBKDF2-HMAC-SHA256 key derivation.

Audit history

1Password is not open source, so its assurance story rests on published third-party assessments rather than on public code review. The security assessments index documents the following:

Assessment	Assessor	Scope
Penetration test and code review	Independent Security Evaluators (ISE)	April–June 2020, full 1Password system
Security architecture and infrastructure audit	Onica	Architecture, infrastructure configuration, tooling and practices
ISO 27001:2022, 27017:2015, 27018:2019, 27701:2019	Accredited certification bodies	Information security management, cloud security, privacy
SOC 2 Type 2	Independent auditor	Secure data management and customer privacy
Public bug bounty	HackerOne	Service and web application; open to the public

Since 3 November 2025 the annual penetration test reports have been published through the 1Password Trust Center rather than as one-off blog posts. That is a meaningful improvement in transparency, but it is still a different assurance model from Bitwarden’s: you are reading auditors’ conclusions about code you cannot inspect, rather than inspecting the code. Both are legitimate. Which one you find more convincing is a judgement call, not a technical fact.

Platform support

Platform	Support	Notes
Windows	Native desktop app	Windows Hello unlock
macOS	Native desktop app	Touch ID unlock, deep system integration
Linux	Native desktop app	Official .deb, .rpm, AppImage and Flatpak builds
iOS / iPadOS	Native app	System autofill provider, Face ID / Touch ID
Android	Native app	Autofill service, biometric unlock
Chrome, Firefox, Edge, Safari, Brave	Extension	Inline fill menu directly in form fields
Web app	Browser	Full vault access without an installed client
CLI	Windows, macOS, Linux	Shell plugins, secret references for scripts and CI
Self-hosting	Not available	Cloud-only; no self-hosted server option

There is no self-hosting path. If keeping vault data on infrastructure you control is a requirement, this is a hard stop and no other feature compensates for it.

Autofill and Watchtower

Autofill is the clearest practical advantage 1Password has. The browser extension handles the awkward cases — iframed login forms, two-step username-then-password flows, financial portals with custom input components — more consistently than the open-source alternatives, and the inline fill menu appears in the field itself rather than requiring a trip to a toolbar popup.

Watchtower is the second differentiator, and it is a push feature rather than a pull one. It surfaces, in the main vault view rather than in a report you have to run:

• Compromised passwords, via Have I Been Pwned integration
• Weak and reused passwords
• Sites that support two-factor authentication where you have not enabled it
• Vulnerable, expiring or old-format payment cards
• Logins for domains that no longer resolve

Travel Mode remains unmatched. It removes vaults not marked “safe for travel” from your devices entirely, so a border-crossing device inspection finds nothing to inspect rather than finding an encrypted blob you can be asked to open. For journalists, lawyers and anyone crossing high-scrutiny borders, this is the reason to choose 1Password.

Pricing

Figures below are from 1Password’s official personal and business pricing pages as of August 2026, in USD, excluding tax.

Tier	Price	Included
Individual	$3.99/mo billed annually ($47.88/yr)	Unlimited items and devices, Watchtower, Travel Mode, 1 GB document storage
Families	$5.99/mo billed annually ($71.88/yr)	Up to 5 members, shared and private vaults, family recovery, 1 GB per person
Teams Starter Pack	$24.95/mo billed annually	Up to 10 members, shared vaults, role-based permissions, security alerts, developer tools
Business	$8.99/user/mo billed annually	Identity provider integrations (Okta, Entra ID, OneLogin, Duo), advanced permissions, enhanced Watchtower
Free tier	None	14-day trial only

Two caveats on those figures. First, 1Password raised individual and family plan prices by up to 33% effective 27 March 2026, as reported at the time; the numbers above are post-increase. Second, the personal pricing page currently advertises a first-year promotional rate for new customers on annual billing — $2.99/month for Individual and $4.49/month for Families — which reverts to standard pricing at renewal. Budget on the standard rate, not the promotional one.

The comparison that matters: 1Password Individual at $47.88/year costs exactly what Bitwarden Families costs for six people. That gap is laid out in full in the Bitwarden vs 1Password comparison.

Family and team plans

The Families plan is where 1Password’s design pays off most clearly. Each of the five members has a private vault the organiser cannot read, plus shared vaults for household logins. Family recovery lets an organiser help a member who has lost their account password or Secret Key regain access — the only sanctioned recovery route in a system with no server-side key escrow. For a household where one person is the de facto IT department, that mechanism is worth more than the price difference against cheaper plans. Our family manager roundup sets the $71.88/year for five against the rest of the field.

On the business side, Teams Starter Pack is a flat rate for up to ten people, which is unusually simple for small teams. Business adds SSO through the major identity providers, custom access control and reporting. Note that SSO-unlocked business accounts cannot export data at all — see below.

Import and export

Import coverage is broad. The migration documentation names direct support for Bitwarden, Dashlane, KeePass, KeePassXC, Keeper, LastPass, RoboForm and Delinea Secret Server, plus Chrome, Firefox, Edge, Brave and Safari, generic CSV, and 1Password’s own .1pux and .1pif formats. On iOS 26 or later and Android 14 or later, direct app-to-app transfer works through the Credential Exchange standard.

Export deserves more attention than it usually gets, because 1Password’s restrictions here are real and are the strongest lock-in argument against it. Per the export documentation:

• Export is available in the Mac, Windows, Linux, iOS and Android apps, but not the browser extension.
• The desktop apps produce .1pux (complete) or CSV (Login and Password items only — no security questions, linked items, custom fields, or 2FA backup codes).
• Passkeys can currently only be exported from iOS and Android.
• If you unlock 1Password with SSO, you cannot export your data at all. For business users on an identity provider, the exit path is closed by design.
• Exports are plaintext. 1Password’s own warning is unambiguous: “Anyone with access to your exported data files will be able to read your passwords.” There is no encrypted export option equivalent to Bitwarden’s password-protected JSON.

If you are choosing a manager partly on how easily you could leave it, this section, not the pricing table, is the one to weigh.

Verdict

Score: the best paid password manager, if the price and the closed source are acceptable.

• Best for: households of two to five who want it set up once and working, anyone who needs Travel Mode, non-technical users being onboarded remotely, and small teams that want a flat-rate plan without deploying anything.
• Security posture: the Secret Key is a genuine architectural advantage against server-side compromise and credential stuffing. Certifications and annual pentests are published; the code is not.
• Weakest point: no free tier, no self-hosting, and an export story with real restrictions — plaintext-only files, and no export at all under SSO.
• Configure this first: print the Emergency Kit and store it physically, separate from your devices. Enable Travel Mode vault flags before you need them, not at the airport.
• Price verdict: $47.88/year is defensible for the individual experience and clearly worth it for a household that will use family recovery. It is not defensible purely on security grounds when Bitwarden is free.

Who should skip 1Password

• Anyone who needs a free tier. There is no free plan and there will not be one. Bitwarden’s free tier does everything a solo user needs.
• Self-hosters. There is no server you can run. Bitwarden Server or Vaultwarden is the answer, or KeePassXC if you want no server at all.
• People who require open-source clients. The assurance model here is “trust the auditors”. If your requirement is “inspect the code”, this product cannot satisfy it.
• Anyone who objects to subscription-only pricing. There is no perpetual licence. KeePassXC is free forever and reads an open vault format.
• Business users who need a guaranteed exit path. SSO-unlocked accounts cannot export. Confirm that constraint against your own data-portability requirements before rolling it out.
• Cost-sensitive families. Six seats on Bitwarden Families cost less than one 1Password Individual seat.

---

This site runs no affiliate links to 1Password. Pricing is subject to change; confirm current figures on 1Password’s own pricing page before subscribing.

See also

• Docker homelab tutorials
• homelab firewall guide

Related across the network

• What Is PGP Encryption Explained: How It Works — securemailguide.com

Related on this site

• How Password Manager Lab Ranks Password Managers