1password Security

1Password hosted services have been reviewed by multiple independent security firms.

1Password is periodically assessed to make sure it remains a secure way for you to share all your secrets.

Cure53

1Password is SOC 2 type 2 certified. SOC, or Service Organization Control, is an independent auditing process that makes sure that 1Password securely manages data to protect customers’ interests and privacy. To request a copy of the SOC 2 report, contact the 1Password Business team. Learn more about SOC 2 certification of 1Password. 1Password includes a security audit feature that’s really worth checking out after you’ve got the bulk of your passwords entered in. The audit can check for duplicate passwords, weak passwords. Disclaimer: I work for AgileBits, makers of 1Password. Thanks for asking me to answer this, Marc Bodnick. The short answer is that your data is safe in 1Password. Fundamental design choices were made to protect everything you store in 1Password.

Cure53 was engaged to perform a pentest on the web based components of 1Password. The assessment was performed in October 2020.

Full details are available in the Cure53 report

SOC

Learn more about SOC 2 certification of 1Password.

Bugcrowd

Bugcrowd, Inc. is engaged in an ongoing, private bug bounty program targeting the 1Password service and web-application. Testers are provided with details of the API.

This program is currently open to the public and has received submissions from 387 unique researchers. These issues ranged in scope and severity, with nine high priority issues being discovered during this time frame. Despite the presence of these high priority findings no user secrets were at risk. Additionally, as of January 1, 2020, all the high priority submissions from this program were confirmed to be resolved.

None of the identified issues resulted in a loss of confidentiality, integrity, or availability.

Full details are available in the Bugcrowd security review

ISE

Independent Security Evaluators (ISE) was engaged to perform a penetration test and code review of the 1Password system. The assessment was performed during April and June, 2020.

Full details are available in the ISE security assessment report

Onica

Onica was engaged to perform an assessment and audit of existing 1Password security architecture, infrastructure configurations, tools, and practices.

The review of the current AWS environments showed evidence that the AgileBits teams have undertaken significant research and gained a solid understanding of best practices from a platform level. The fundamentals of security best practices are being executed in the implementation.

Full details are available in the Onica security audit report

AppSec

AppSec Consulting was contracted to perform a penetration test and code review of the 1Password application. The assessment was performed during July, 2018.

The security controls observed in the 1Password application were found to be substantial and unusually impressive.

Full details are available in the AppSec security review