# 1Password — Password Management

1Password by AgileBits Inc. holds a panel rating of 3/5 from 6 AI judges (category median 2/5), as of 2026-10-15. Provenance: Rest of world; sovereignty: not determined.

- Vendor: AgileBits Inc. (https://1password.com)
- Category: [Password Management](https://whats-best.ai/software/password-management.md)
- Provenance (editorial classification): Rest of world
- Canonical page: https://whats-best.ai/software/password-management/1password
- Alternatives: https://whats-best.ai/software/password-management/1password/alternatives ([markdown](https://whats-best.ai/software/password-management/1password/alternatives.md))
- Data as of: 2026-10-21 · evaluated 2026-10-15 · oldest source captured 2026-10-13

**AI-generated.** Every score, rationale and verdict here is written by a panel of AI judges from public evidence — an analysis, not a hands-on test. Every fact quotes the vendor page it was read from. No score can be bought. How scores are made: https://whats-best.ai/methodology

## At a glance

- Vendor: AgileBits Inc.
- Headquarters: Not stated on the vendor’s pages as of 13 Oct 2026
- Data hosting: Not stated on the vendor’s pages as of 13 Oct 2026
- Free plan: Not stated on the vendor’s pages as of 13 Oct 2026

## The panel's verdict

1Password, a password manager from AgileBits Inc., scored highest on sharing and access control and on audit and policy, both at a uniform 7, with identity integration close behind at 7 to 8. Judges credited SSO unlock over OpenID Connect with PKCE, SCIM provisioning that suspends users on deprovisioning, five Business permissions plus a Manage Vault grant, and an events feed to named SIEM targets. Sovereignty is the weak point at a uniform 3: Secure Data hosting is customer-selectable in the EU, US or Canada and item sharing is stored in the EU, but the vendor address is Toronto, support and email services are hosted primarily in the United States and Canada, and we found no public information on a subprocessor list with locations. Deployment and portability drew the widest spread, 4 to 6, as judges weighed broad client and import coverage against an export documented as unencrypted and no public information on self-hosting or offline access. Security architecture sits at 6 to 7, with the newest dated assessment from 2020; the pricing page publishes no per-user figures.

**Speaks for it:**
- Vault sharing runs on five Business permissions plus a Manage Vault grant that grants and revokes access without any item viewing or editing, and Business client settings can block export, printing and copy or share outside the app.
- Unlock with SSO over OpenID Connect with PKCE supports named providers, and SCIM provisioning creates users, drives group access and suspends members on deprovisioning with immediate confirmation.
- Events Reporting streams sign-in attempts, item usage and audit events to named SIEM targets including Splunk, Microsoft Sentinel, Elastic and Datadog, with scoped, expiring bearer tokens.
- The published security design names AES-GCM-256, PBKDF2-HMAC-SHA256, a 128-bit Secret Key and SRP, beside unaltered reports from ISE and Onica and a public HackerOne bounty.
- Clients cover macOS, Windows, Linux, iOS, Android, browsers and a CLI, with Secure Data hosting customer-selectable in the EU, US or Canada.

**Held against it:**
- Sovereignty sits at a uniform 3 — the vendor address is in Toronto, support and email services are hosted primarily in the United States and Canada, and we found no public information on a subprocessor list with locations.
- The documented export formats are an unencrypted.1pux archive and a CSV file, and we found no public information on whether attachments survive export or on offline access during a vendor outage.
- We found no public information on a self-hosted or on-premises deployment option.
- The newest dated assessment is from 2020 and the Onica report carries no date, and we found no public information on ISO 27001 or SOC 2 certification or on disclosed incident history.
- We found no public information on enforced master-password or MFA policies, on hardware-key or FIDO2 MFA options, or on a statement that the vendor cannot derive the vault key under SSO unlock.

**Best for:**
- You run your team on a major identity provider and will use the Business plan — SSO unlock over OpenID Connect with PKCE and SCIM provisioning that confirms users without delay and suspends them on deprovisioning are documented there.
- You need governed sharing — five Business permissions, a Manage Vault grant split from viewing and editing, and client settings that block export, printing and copying outside the app.
- You need audit evidence in your SIEM — sign-in attempts, item usage and audit events stream to named targets including Splunk, Microsoft Sentinel, Elastic and Datadog, with Watchtower, breach, device and twelve-month usage reports.
- You are migrating from another password manager and want documented import from Bitwarden, KeePass, Keeper or LastPass with clients across every major platform and a CLI.

**Avoid if:**
- Your procurement requires an EU contracting entity or a visible subprocessor chain — the vendor address is in Toronto, support and email are hosted primarily in the United States and Canada, and we found no public information on a subprocessor list with locations.
- Your auditors require recent, dated assessments — the newest dated published assessment is from 2020 and the other named report carries no date.
- Your exit plan requires encrypted exports — the documented formats are the 1Password Unencrypted Export (.1pux) and a CSV file.
- You plan to run 1Password Teams — SSO unlock, automated provisioning, Events Reporting and the five-permission model sit on the Business plan, and Teams accounts reach most reports only through a trial.

## Scores by judge and criterion

Scores out of 5, each judge scoring independently against the published rubric (v1). "n/r" = not rated: the vendor publishes no price.

| Criterion | The CISO | The Identity Engineer | The Compliance Auditor | The SME Owner | The DevOps Engineer | The Skeptic |
| --- | --- | --- | --- | --- | --- | --- |
| Encryption model & independent audits | 3/5 | 3.5/5 | 3.5/5 | 3/5 | 3/5 | 3/5 |
| Sharing, roles & recovery | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 |
| SSO, directory sync & provisioning | 3.5/5 | 3.5/5 | 4/5 | 3.5/5 | 3.5/5 | 3.5/5 |
| Audit logs, policies & reporting | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 |
| Hosting choice, offline access & export | 2.5/5 | 2.5/5 | 3/5 | 3/5 | 2.5/5 | 2/5 |
| European sovereignty | 1.5/5 | 1.5/5 | 1.5/5 | 1.5/5 | 1.5/5 | 1.5/5 |
| Pricing transparency | n/r | n/r | n/r | n/r | n/r | n/r |
| **Weighted verdict** | **3/5** | **3/5** | **3/5** | **3/5** | **3/5** | **3/5** |

### The judges

- **The CISO** (v1.0): Answers to the board for the day the vault vendor is breached. Wants a whitepaper that says which fields are encrypted and which are not, audits by named firms with dates, a bug bounty, and an incident history written down rather than discovered in the press.
- **The Identity Engineer** (v1.0): Runs Entra ID for two thousand staff and owns the joiner-mover-leaver process. Wants SCIM that suspends a leaver's vault the moment the account is disabled, an SSO unlock whose key model is documented, and FIDO2 keys and passkeys supported for the vault itself.
- **The Compliance Auditor** (v1.0): Prepares the ISO 27001 and NIS2 evidence and has to show who could see the firewall admin password last March. Wants event logs that cover views and copies, export to the SIEM, enforceable policies, and the contracting entity, hosting and subprocessors named.
- **The SME Owner** (v1.0): Runs a forty-person company where the shared passwords currently live in an Excel file. Wants shared vaults the team actually uses, a way back in when someone forgets the master password, credentials handed over when someone leaves, and a per-user price with SSO not hidden two tiers up.
- **The DevOps Engineer** (v1.0): Would rather run the vault in the company's own data centre than trust another SaaS with root credentials. Wants a documented self-hosted deployment with backup and high availability, open-source code to read, a CLI and API for pipelines, and an export that loses nothing.
- **The Skeptic** (v1.0): Has read the breach post-mortems. Reads "zero knowledge" next to unencrypted URLs and item names, "independently audited" with no report, "SSO unlock" where the vendor holds half the key, and "admin recovery" that means the vendor can decrypt — and treats a missing incident history as an answer.

## European sovereignty — proven facts

Built only from facts on the vendor's own pages; a dimension we could not prove is left open, never scored as zero. Headline: not determined.

| Dimension | Finding | Points | Source |
|---|---|---|---|
| Legal entity | Not determined | — | — |
| Ownership | Not determined | — | — |
| Data residency | Not determined | — | — |
| Subprocessors | Not determined | — | — |

## Key facts

Each fact is the vendor's own statement, cited to the source page it was read from ([S*n*] → Sources).

**Compliance**
- Business ip indemnification: yes [S4]
- DPA reference: https://1Password.com/legal · yes [S4]
- Encryption zero knowledge: no · yes [S3]
- GDPR complaint right: Europe · United Kingdom · Switzerland · yes [S3]
- ISO certifications: 27001:2022 · 27017:2015 · 27018:2019 · 27701:2019 [S6]
- Pentest reports distribution: 1Password Trust Center · 2025-11-03 [S6]
- Security design white paper: Security Design White Paper linked from page [S5]
- SOC 2: yes [S6]
- Transfer safeguards: yes · yes · yes · yes [S3]
- Warranty malicious code: yes [S4]

**Data**
- 1pif import path: use 1Password 7 for importable format · 1pif [S13]
- 1pux format: 1pux · csv [S13]
- Article published: 2026-08-28 [S13]
- CSV included fields: Title · Website · Username · Password · One-time password · Favorite status · Archived status · Tags · Notes [S13]
- Deletion: Individuals · Family account owners · yes [S3]
- Encrypted email contact: yes [S3]
- End user account admin access: yes · yes · yes [S3]
- Export: yes [S3]
- Export available: yes [S13]
- Export tools: yes [S5]
- Marketing opt out email: yes · yes [S3]
- Retention on termination: 30 [S4]
- User rights: access · correction · download · deletion · objection · restriction · withdraw_consent · communication_preferences · complaints [S3]
- V7 formats: 1pif · csv · txt [S13]

**Hosting**
- Account config locations: Canada · European Union · United States [S3]
- Data residency options: EU · US · Canada · yes [S3]
- Hq address: 4711 Yonge St, 10th Floor, Toronto Ontario, M2N 6K8, Canada [S2]
- Item sharing region: EU [S3]
- Support hosting regions: United States · Canada [S3]

**Integrations**
- Bearer token lifecycle: yes [S11]
- Cli version requirement: 2.36.0-beta.02 [S10]
- Credential exchange: Credential Exchange · yes · iOS · iPadOS 26 or later [S14]
- CSV import: CSV · yes [S14]
- Custom client API: yes [S11]
- Events API: yes [S12]
- Events reporting plan: 1Password Business [S11]
- Identity providers: SCIM · Google Workspace · JumpCloud · Microsoft Entra ID · Okta · OneLogin [S10]
- Mobile direct import: yes · iOS · Android [S14]
- Pux import: 1Password Unencrypted Export (.1pux) · yes [S14]
- Saas integrated services: yes · yes [S3]
- Siem providers: Blackpoint Cyber · Blumira · CrowdStrike · Datadog · Elastic · Huntress · LevelBlue · Microsoft Sentinel · Palo Alto Networks · Panther · Rapid7 · Splunk · Stellar Cyber · Sumo Logic · Todyl · Other [S11]
- SSO supported idps: Auth0 · Duo · Google · JumpCloud · Microsoft Entra ID · Okta · OneLogin · Ping · Other · yes [S9]
- Standalone migration: yes · migrate standalone vault data to a 1Password account [S14]
- Status page: https://1password.statuspage.io/ [S4]
- Supported sources: Chrome · Firefox · Edge · Brave · Safari · Bitwarden · Dashlane · Delinea Secret Server · KeePass · KeePassXC · Keeper · LastPass · RoboForm [S14]
- Token expiration event types: yes · yes [S11]

**Legal**
- Address: 4711 Yonge St, 10th Floor, Toronto, Ontario, M2N 6K8, Canada [S5]
- Address: 4711 Yonge Street, 10th Floor, Toronto, Ontario, M2N 6K8, Canada [S4]
- Address: 4711 Yonge St, 10th Floor, Toronto, Ontario, M2N 6K8, Canada [S8]
- Address: 4711 Yonge St, 10th Floor, Toronto, Ontario, M2N 6K8, Canada [S9]
- Brand exclusion kolide: yes [S3]
- Canada oversight: Office of the Privacy Commissioner of Canada [S3]
- Company address: 4711 Yonge St, 10th Floor, Toronto Ontario, M2N 6K8, Kanada [S1]
- Company address: Toronto · 4711 Yonge St, 10th Floor · Canada · Ontario [S11]
- Company name: AgileBits (1Password) [S5]
- Entity: 1Password · AgileBits Inc. [S4]
- Entity name: AgileBits Inc. · 1Password [S3]
- Export compliance: Canada · United States [S4]
- Governing law: Ontario, Canada [S4]
- Headquarters: Toronto · Canada · Ontario [S3]
- Last updated: 2024-09-12 [S4]
- Notice effective date: 2025-12-29 [S3]
- Privacy contact email: privacy@1Password.com · yes [S3]
- Privacy office address: 4711 Yonge St, 10th Floor, Toronto, Ontario, M2N 6K8 Canada [S3]
- Terms change notice: 30 [S4]

**Pricing**
- Aws benefits: Simplified procurement · Consolidated billing · Scalable and flexible deployment [S2]
- Aws marketplace: yes [S2]
- Billing cycle: yes · monthly · yearly [S4]
- Business currency: USD [S4]
- Business direct billing: www.1Password.com · www.1Password.eu · www.1Password.ca · yes [S4]
- Business payment terms: 30 [S4]
- Business quarterly reconciliation: quarterly [S4]
- Business suspension: 30 [S4]
- Business taxes: customer · yes [S4]
- Business user based: per_user [S4]
- Cancellation: online account management page · customer support [S4]
- Currency: USD [S4]
- Fee change notice: yes [S4]
- Free trial: yes · yes [S4]
- Quote based: yes · yes [S2]
- Refunds discretionary: yes [S4]
- Tax responsibility: customer [S4]

**Product**
- Account recovery capability: restore access for family or team members who can't sign in or unlock 1Password [S8]
- Adoption report: yes [S12]
- Aes encryption: AES-GCM-256 · yes [S5]
- AI agent runtime credentials: yes [S2]
- Audit report availability: yes [S6]
- Audit trail: yes [S2]
- Auto lock: yes · auto-lock [S5]
- Bug bounty hackerone: 2024-12 · HackerOne [S6]
- Bug bounty public: yes [S6]
- Bug bounty scope: 1Password service · web-application · yes [S6]
- Business auto renewal: yes [S4]
- Business client settings: Business offers granular client settings including export to unencrypted file, item history restore, import, copy/share outside 1Password, move, and print [S7]
- Business data access: yes [S4]
- Business permissions: 5 · View Items · Create Items · Edit Items · Archive Items · Delete Items [S7]
- Business refund on termination for cause: yes [S4]
- Business usage reports: 1Password Business · yes [S7]
- Business watchtower report: yes [S12]
- Clipboard management: yes · automatic clipboard clearing [S5]
- Code signature validation: yes · code signature validation before autofill [S5]
- Controller processor roles: yes · yes [S3]
- CSV import items: Logins · Credit Cards · Secure Notes · 1Password.com account [S14]
- Data deletion on termination: 30 [S4]
- Default admin access: administrators manage vaults by default; option can restrict to team owners only [S7]
- Deprovisioning suspension: yes · yes [S10]
- Developer offering: yes [S1]
- Developer secrets discovery report: yes · yes [S12]
- Device report: yes [S12]
- Device self remediation: yes [S2]
- Device trust capabilities: Device health monitoring · Pre-built check library · Guided self-remediation · IdP Integrations · Cross-platform support [S2]
- Device trust module: yes [S1]
- Domain breach report: yes · yes · yes [S12]
- Employee vault: yes · no · no [S7]
- End to end encryption: yes [S5]
- Enterprise password manager: yes [S1]
- Epm capabilities: Protect apps outside SSO · Granular vault permissions · Multi-tenant support · Developer toolkit · Audit-ready activity logs [S2]
- Events reporting capabilities: data retention control · custom graphs and dashboards · custom alerts · cross-referencing with other services [S11]
- Events reporting event types: sign-in attempts · item usage · audit events [S11]
- Events reporting permission: owner · administrator [S11]
- Features listed: Autofill · Access reviews · Access requests · Account Governance · Health checks · Advanced device compliance · SaaS Manager integrations · SaaS discovery · SaaS workflows · IT asset management · License management · Watchtower insights [S1]
- Flexible unlock methods: biometrics · system authentication · device unlock [S5]
- Free family account privacy: yes [S3]
- Free trial cta: yes [S2]
- Immediate confirmation: yes [S10]
- Ise assessment: 2020 · penetration test · code review · ISE [S6]
- Just in time privileged access: yes [S2]
- Law enforcement disclosure: yes · yes [S3]
- Manage vault permission: Manage Vault grants/rerevokes access, changes permissions, deletes vault; excludes viewing/editing [S7]
- Min age: 16 [S3]
- Msp editions: yes [S1]
- Onica audit: security architecture · infrastructure configurations · tools · practices · Onica [S6]
- Onica aws review: yes [S6]
- Open data formats: SQLite [S5]
- Optional telemetry: yes [S5]
- Overview report: yes [S12]
- Password not stored: yes · yes [S5]
- Passwordless guidance: yes [S2]
- Pbkdf2 key derivation: key derivation · PBKDF2-HMAC-SHA256 [S5]
- Phishing protection: yes · phishing protection via domain matching [S5]
- Plan requirement: 1Password Business · automated provisioning [S10]
- Platforms supported: macOS · Windows · iOS · Android · Browser · Linux · CLI [S1]
- Privacy policy stance: shared information used only to provide service and support [S5]
- Privileged access capabilities: Zero standing privileges · Cloud, K8s, and database support · Intent-based dynamic guardrails · Audit-ready session logs · AI agent privilege control enforced at runtime [S2]
- Privileged access model: Zero standing privileges / just-in-time access [S1]
- Provisioning capabilities: yes · yes · yes · yes [S10]
- Recovery 2FA reset: yes [S8]
- Recovery blocked until complete: yes [S8]
- Recovery bulk cli: 1Password CLI · yes [S8]
- Recovery bulk completion UI: complete multiple pending recoveries at once via People filter Recovery Pending [S8]
- Recovery email notifications business: 1Password Business · customizable recovery notification recipients [S8]
- Recovery emergency kit new: yes [S8]
- Recovery emergency kit optional: yes · Emergency Kits turned off for organization · Unlock with SSO [S8]
- Recovery new secret key: yes · yes [S8]
- Recovery notification verified domains: notify any email address on verified domains [S8]
- Recovery permissions: family organizer · team administrator or owner · custom group with Recover Accounts permission [S8]
- Recovery recommend two recoverers: at least two family or team members able to recover accounts [S8]

**Support**
- Bug bounty: yes [S1]
- Channels: yes · yes [S10]
- Integration vendor support: Datadog Support · Panther Support · Sumo Logic Support · 1Password Business team [S11]
- Security contact: 1Password Support [S5]
- Security team contact: 1Password Security team · no [S6]
- SSO troubleshooting docs: troubleshooting guides available for SSO setup and sign-in issues [S9]
- Standard support: https://support.1password.com/ · yes [S4]
- Trust center: yes [S1]

34 more facts on the canonical page: https://whats-best.ai/software/password-management/1password

## Questions

### Is 1Password European?

No. whats-best.ai classifies 1Password as Rest of world.

### Where does 1Password store data?

Not stated on the vendor’s pages as of 13 Oct 2026.

### Does 1Password have a free plan?

Not stated on the vendor’s pages as of 13 Oct 2026.

### What are the best alternatives to 1Password?

As of 21 Oct 2026, the panel rates [Password Depot (3.5/5)](https://whats-best.ai/software/password-management/password-depot), [Keeper (3/5)](https://whats-best.ai/software/password-management/keeper) and [Passbolt (3/5)](https://whats-best.ai/software/password-management/passbolt) highest among the other 18 Password Management products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is [Password Depot](https://whats-best.ai/software/password-management/password-depot) (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: [how scores are made](https://whats-best.ai/methodology#ordering). The full list, with European products first: [1Password alternatives](https://whats-best.ai/software/password-management/1password/alternatives).

## What this page leaves out

- 24 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 7 data facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 4 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 3 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 2 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 1 compliance fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 1 subprocessors fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 3 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown.
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement.

## Sources

- [S1] Vendor homepage: https://1password.com/de (checked 2026-10-13)
- [S2] Pricing page: https://1password.com/pricing (checked 2026-10-13)
- [S3] Privacy policy: https://1password.com/legal/privacy (checked 2026-10-13)
- [S4] Terms of service: https://1password.com/legal/terms-of-service (checked 2026-10-13)
- [S5] Encryption model & independent audits — found from sitemap: https://support.1password.com/1password-security/ (checked 2026-10-13)
- [S6] Encryption model & independent audits — found from sitemap: https://support.1password.com/security-assessments/ (checked 2026-10-13)
- [S7] Sharing, roles & recovery — found from sitemap: https://support.1password.com/create-share-vaults-teams/ (checked 2026-10-13)
- [S8] Sharing, roles & recovery — found from sitemap: https://support.1password.com/recovery/ (checked 2026-10-13)
- [S9] SSO, directory sync & provisioning — found from sitemap: https://support.1password.com/sso/ (checked 2026-10-13)
- [S10] SSO, directory sync & provisioning — found from sitemap: https://support.1password.com/provisioning/ (checked 2026-10-13)
- [S11] Audit logs, policies & reporting — found from sitemap: https://support.1password.com/events-reporting/ (checked 2026-10-13)
- [S12] Audit logs, policies & reporting — found from sitemap: https://support.1password.com/reports/ (checked 2026-10-13)
- [S13] Hosting choice, offline access & export — found from sitemap: https://support.1password.com/export/ (checked 2026-10-13)
- [S14] Hosting choice, offline access & export — found from sitemap: https://support.1password.com/import/ (checked 2026-10-13)

---

Cite as: whats-best.ai, "1Password — Password Management", AI panel analysis, as of 2026-10-21. https://whats-best.ai/software/password-management/1password

Corrections: https://whats-best.ai/correct/671?target=page