Is 1Password Safe? Its Chrome Permissions, Privacy and Ownership Checked

Is 1Password safe to use in Chrome?

Yes. 1Password encrypts every item before it leaves your device, uses a second secret that never reaches its servers, and has no publicly reported breach of customer vaults. The Chrome extension is one of the most permission-hungry add-ons you can install, but that is the price of filling logins on any site.

The real caveat is that 1Password's safety depends on things it cannot control: whether you installed the genuine extension, how strong your account password is, and whether the computer is free of malware. An infostealer that reads your screen or clipboard defeats any password manager, open source or not.

If you are still choosing a manager rather than vetting this one, start with our password manager picks, which weigh 1Password against free and open-source options.

How does 1Password encrypt your passwords?

1Password encrypts each vault item with AES-256 on your device, using keys derived from two inputs: the account password you remember and a random Secret Key stored only on your devices. 1Password calls this two-secret key derivation, and it is the main thing that separates it from most rivals.

Account password

The one password you type. It is run through a slow key-derivation function locally and is never sent to 1Password in a form the company can read.

Secret Key

A 34-character code created when you sign up, starting with a version prefix such as A3. It lives on your signed-in devices and in your Emergency Kit PDF, not on 1Password's servers.

End-to-end encryption

Items are encrypted before sync and decrypted only on your devices. 1Password staff cannot read vault contents or reset your password for you.

Secure Remote Password (SRP)

The sign-in protocol proves you know the password without transmitting it, so a network eavesdropper or a fake server learns nothing reusable.

Why the Secret Key matters: when encrypted vaults are stolen from a password manager's servers, attackers try to guess master passwords offline. With 1Password, a stolen vault is also locked by a random Secret Key that was never on the server, which pushes offline guessing out of practical reach even if your password is weak.

The flip side is recovery. Because nobody else holds the Secret Key, losing both it and your password on an individual account means losing the data. Family and business accounts let an organiser or admin start a recovery, which is a convenience with a small trust trade-off. See 1Password's Secret Key help page for where to find yours.

What permissions does the 1Password extension ask for?

Version 8.12.37.1 of the 1Password extension (Manifest V3) requests 15 API permissions plus access to all URLs. Chrome shows these as warnings like 'Read and change all your data on all websites', 'Manage your apps, extensions, and themes' and 'Communicate with cooperating native applications'.

The 'likely use' column reflects what each API is designed for and how 1Password behaves; the manifest itself does not state purposes. Our guides to the all-URLs permission and the tabs permission explain what those two warnings let any extension do, and the full permissions index covers the rest. Google's own permissions reference lists the exact warning text for each.

Why does 1Password need access to every website?

Because a password manager cannot know in advance where you will log in. The content script runs on <all_urls> and https://*/* so the 1Password icon can appear in any username field, including on sites you have never visited before.

The manifest also names specific domains, and they are worth reading. The 1password.com, .ca and .eu entries cover account sign-in pages in each region. Domains like b5dev.com, b5test.com and b5staging.com appear to be the company's own development and staging environments. http://localhost/* lets it fill on local development servers, which helps developers.

The kolide.com, .ca and .eu entries belong to Kolide, the device-trust company 1Password acquired in 2024, and matter mainly to business customers using its access tools. The manifest also lists a few third-party domains that it does not explain, so if a specific entry matters to your threat model, ask 1Password support what it is for.

What 1Password does not request is also telling: no history, no cookies and no clipboardRead. It can see the current tab's address to match logins, but it has no API access to your full browsing history or to cookies set by other sites.

Who owns 1Password, and has it ever been hacked?

1Password is a private Canadian company, headquartered in Toronto and founded in 2005 as AgileBits by Dave Teare and Roustem Karimov. It has never been sold to another company, and it has never had a publicly confirmed breach of customer vault data.

• 2005: AgileBits launches 1Password as a Mac app.
• 2019 onward: the company takes outside venture investment for the first time, later expanding into business and enterprise.
• 2023: 1Password detects suspicious activity on its internal Okta instance, linked to the wider breach of Okta's support system. It reported that no user data or vaults were accessed.
• 2024: 1Password acquires Kolide, which explains the Kolide domains in the extension manifest.

Ownership changes are the quiet risk with browser extensions: a trusted add-on is sold and the new owner pushes a harmful update. 1Password is a large company whose product is the extension, so that pattern is unlikely here, but it is why a closed-source extension with <all_urls> access deserves an occasional look at its update notes.

On transparency, 1Password publishes a security design white paper, runs a public bug bounty and lists third-party audits on its security page. The apps are not open source, so you rely on auditors rather than reading the code yourself. Our methodology explains how we weigh that against open-source rivals.

What are the real risks of using 1Password?

The realistic ways people lose data with 1Password rarely involve breaking its encryption. They involve the account owner, the device or a fake copy of the software.

• Copycat extensions. A lookalike listing with the same icon and all-sites access could read everything you type. The genuine extension ID is aeblfdkhhhdcdjpifhhbdiojplfjncoa.
• Phishing and fake support. 1Password will never ask for your Secret Key or account password by email, chat or phone. Anyone who does is a scammer.
• Infostealer malware. Once malware runs on your computer, it can capture your vault while it is open. Keep the OS updated and avoid cracked software.
• A reused account password. The Secret Key protects against offline cracking, but a reused password plus a phished Secret Key still opens the account.
• Shared vault mistakes. In family and team accounts, anyone with access to a shared vault sees everything in it. Keep private items in your own vault.
• Lost recovery details. On an individual plan with no Emergency Kit, forgetting your password means the data is gone.

None of these are unique to 1Password. They apply to every manager in our security and privacy category, which is why the setup steps below matter more than which brand you pick.

How do you set up 1Password more safely in Chrome?

Install from the official listing, pair the extension with the desktop app, add two-factor authentication to your 1Password account and turn off Chrome's own password saving. Menu labels can shift between versions, but the paths below match current releases.

1. Open chrome://extensions, click Details on 1Password and confirm the ID in the address bar is aeblfdkhhhdcdjpifhhbdiojplfjncoa. Remove any other extension that claims to be 1Password.
2. Install the 1Password desktop app for Windows, Mac or Linux and sign in. The extension connects through nativeMessaging, so Touch ID, Windows Hello or your system login can open it and it locks when the app locks.
3. In the desktop app, open Settings > Security and set the auto-lock timer to something short, plus lock on sleep and when the screen locks.
4. Sign in to your account on 1Password.com, open your profile and turn on two-factor authentication. Use an authenticator app or a security key, not codes stored inside 1Password itself.
5. Go to chrome://password-manager/settings and switch off Offer to save passwords and passkeys, so logins are not split between two managers.
6. Leave Allow in Incognito off in the extension's Details page unless you actively need it.
7. Open Watchtower in the app and fix anything flagged as compromised, reused or weak, starting with email and banking.

If you travel across borders with sensitive data, 1Password's Travel Mode can remove chosen vaults from your devices until you switch it off from the website.

Is 1Password safer than Bitwarden or other password managers?

On encryption, the major managers are close; 1Password's Secret Key gives it an edge if servers are ever breached. On transparency, open-source Bitwarden and Proton Pass let anyone inspect the code. The right pick depends on which risk worries you more.

For a head-to-head on price, autofill and recovery, read Bitwarden vs 1Password. Compared with Chrome's built-in Google Password Manager, 1Password adds the Secret Key, shared vaults and works across browsers, while Google's option is free and needs no extension at all.

Should you trust 1Password with your passwords?

Yes, if you want a paid, polished manager with an extra layer of protection against server breaches. Its broad Chrome permissions are proportionate to autofill, its ownership has been stable for two decades, and its one notable incident did not reach customer data.

Look elsewhere if you need to audit the source code yourself, want a free plan, or refuse to run any closed-source extension with all-sites access. Bitwarden or Proton Pass cover those needs with similar encryption.

Our full 1Password profile tracks its listing, permissions and updates over time, and you can browse other safety explainers on the blog.