1Password Review 2026: Security, Recovery and Costs

1Password combines a subscription password vault with its Secret Key design, autofill and family recovery features. The trade-offs are a mandatory subscription with no free tier, a closed-source client, and a 2026 price rise that changed the value calculation against Bitwarden. With no free plan underneath it, the 14-day trial is the whole evaluation window, so it is worth knowing what happens to a 1Password vault once that trial ends before you import anything.

This review analyses 1Password’s published security design documentation, its third-party assessment index, and its official pricing pages. It is documentation and audit analysis, not a hands-on trial.

The Secret Key architecture

1Password’s security model differs from most competitors in one structural way. In addition to your account password, a 128-bit Secret Key — presented to you as a 34-character string — is required to derive the keys that decrypt your vault. The Secret Key is generated locally on your device during signup and is never transmitted to 1Password’s servers.

The practical consequences are worth stating plainly:

• If an attacker takes a copy of your encrypted vault from 1Password’s infrastructure, your account password alone is not enough to decrypt it. They need the Secret Key too, and it is not on the server.
• The account password alone is insufficient to decrypt a stolen server-held vault; exposure of the Secret Key or an authorized device changes that threat model.
• Losing both account credentials makes a prepared recovery route essential. Family organizer recovery is a separate mechanism, described below.

That last point is the cost of the design. The Secret Key lives in the printable Emergency Kit PDF generated at signup. On a Families account every member has their own Secret Key, which is why family recovery exists as a separate mechanism: the family organiser can initiate recovery for a member who has lost access, which is the closest thing to a reset that the architecture permits. The Security Design documentation describes the full derivation, including AES-GCM-256 content encryption and PBKDF2-HMAC-SHA256 key derivation.

1Password and YubiKey: protect new-device sign-in

A YubiKey adds a second-factor check when authorizing a new device; it does not replace the account password or Secret Key, or require a tap on every local unlock. Follow the 1Password and YubiKey setup guide to choose a compatible key, register a spare and prepare recovery. The distinction follows 1Password’s two-factor documentation.

Audit history

1Password is not open source, so its assurance story rests on published third-party assessments rather than on public code review. The security assessments index documents the following:

Since 3 November 2025 the annual penetration test reports have been published through the 1Password Trust Center rather than as one-off blog posts. That is a meaningful improvement in transparency, but it is still a different assurance model from Bitwarden’s: you are reading auditors’ conclusions about code you cannot inspect, rather than inspecting the code. Both are legitimate. Which one you find more convincing is a judgement call, not a technical fact.

Platform support

There is no self-hosting path. If keeping vault data on infrastructure you control is a requirement, this is a hard stop and no other feature compensates for it.

If every device in your household is Apple, the free built-in option is the one to beat: see 1Password versus Apple Passwords on iPhone and Mac.

Autofill and Watchtower

Evaluate autofill on the browsers and forms you actually use before paying. The Bitwarden vs 1Password comparison includes sourced user reports with mixed experiences; those reports do not establish a universal reliability winner.

Watchtower is the second differentiator, and it is a push feature rather than a pull one. It surfaces, in the main vault view rather than in a report you have to run:

• Compromised passwords, via Have I Been Pwned integration
• Weak and reused passwords
• Sites that support two-factor authentication where you have not enabled it
• Vulnerable, expiring or old-format payment cards
• Logins for domains that no longer resolve

Travel Mode remains unmatched. It removes vaults not marked “safe for travel” from your devices entirely, so a border-crossing device inspection finds nothing to inspect rather than finding an encrypted blob you can be asked to open. For journalists, lawyers and anyone crossing high-scrutiny borders, this is the reason to choose 1Password.

Pricing

Figures below are from 1Password’s official personal and business pricing pages as of August 2026, in USD, excluding tax.

Two caveats on those figures. First, 1Password raised individual and family plan prices by up to 33% effective 27 March 2026, as reported at the time; the numbers above are post-increase. Second, the personal pricing page currently advertises a first-year promotional rate for new customers on annual billing — $2.99/month for Individual and $4.49/month for Families — which reverts to standard pricing at renewal. Budget on the standard rate, not the promotional one.

The comparison that matters: 1Password Individual at $47.88/year costs exactly what Bitwarden Families costs for six people. That gap is laid out in full in the Bitwarden vs 1Password comparison.

Family and team plans

The Families plan is where 1Password’s design pays off most clearly. Each of the five members has a private vault the organiser cannot read, plus shared vaults for household logins. Family recovery lets an organiser help a member who has lost their account password or Secret Key regain access — the only sanctioned recovery route in a system with no server-side key escrow. For a household where one person is the de facto IT department, that mechanism is worth more than the price difference against cheaper plans. Our family manager roundup sets the $71.88/year for five against the rest of the field.

On the business side, Teams Starter Pack is a flat rate for up to ten people, which is unusually simple for small teams. Business adds SSO through the major identity providers, custom access control and reporting. Note that SSO-unlocked business accounts cannot export data at all — see below.

Import and export

Import coverage is broad. The migration documentation names direct support for Bitwarden, Dashlane, KeePass, KeePassXC, Keeper, LastPass, RoboForm and Delinea Secret Server, plus Chrome, Firefox, Edge, Brave and Safari, generic CSV, and 1Password’s own .1pux and .1pif formats. On iOS 26 or later and Android 14 or later, direct app-to-app transfer works through the Credential Exchange standard.

Export deserves more attention than it usually gets, because 1Password’s restrictions here are real and are the strongest lock-in argument against it. Per the export documentation:

• Export is available in the Mac, Windows, Linux, iOS and Android apps, but not the browser extension.
• The desktop apps produce .1pux (complete) or CSV (Login and Password items only — no security questions, linked items, custom fields, or 2FA backup codes).
• Passkeys can currently only be exported from iOS and Android.
• If you unlock 1Password with SSO, you cannot export your data at all. For business users on an identity provider, the exit path is closed by design.
• Exports are plaintext. 1Password’s own warning is unambiguous: “Anyone with access to your exported data files will be able to read your passwords.” There is no encrypted export option equivalent to Bitwarden’s password-protected JSON.

If you are choosing a manager partly on how easily you could leave it, this section, not the pricing table, is the one to weigh.

Verdict

Score: the best paid password manager, if the price and the closed source are acceptable.

• Best for: households of two to five who want it set up once and working, anyone who needs Travel Mode, non-technical users being onboarded remotely, and small teams that want a flat-rate plan without deploying anything.
• Security posture: the Secret Key is a genuine architectural advantage against server-side compromise and credential stuffing. Certifications and annual pentests are published; the code is not.
• Weakest point: no free tier, no self-hosting, and an export story with real restrictions — plaintext-only files, and no export at all under SSO.
• Configure this first: print the Emergency Kit and store it physically, separate from your devices. Enable Travel Mode vault flags before you need them, not at the airport.
• Price verdict: $47.88/year is defensible for the individual experience and clearly worth it for a household that will use family recovery. It is not defensible purely on security grounds when Bitwarden is free.

Who should skip 1Password

• Anyone who needs a free tier. There is no ongoing free plan in the current pricing. Bitwarden’s free tier does everything a solo user needs.
• Self-hosters. There is no server you can run. Bitwarden Server or Vaultwarden is the answer, or KeePassXC if you want no server at all.
• People who require open-source clients. The assurance model here is “trust the auditors”. If your requirement is “inspect the code”, this product cannot satisfy it.
• Anyone who objects to subscription-only pricing. There is no perpetual licence. KeePassXC is free forever and reads an open vault format.
• Business users who need a guaranteed exit path. SSO-unlocked accounts cannot export. Confirm that constraint against your own data-portability requirements before rolling it out.
• Cost-sensitive families. Bitwarden Families includes six seats at the same published annual price as one 1Password Individual seat.

This site runs no affiliate links to 1Password. Pricing is subject to change; confirm current figures on 1Password’s own pricing page before subscribing.

Related across the network

• What Is PGP Encryption Explained: How It Works — securemailguide.com

Related on this site

• How Password Manager Lab Ranks Password Managers