How 1Password is designed to keep your data safe, even in the event of a breach | 1Password (2024)

As data breaches become increasingly common and scary headlines hit the news, you may be feeling a bit uneasy. Here’s the good news: if you’re a 1Password customer, there’s nothing you need to do and no reason for you to worry.

We’ll explain why below, but if you’re in a hurry you can rest easy knowing that:

• If you use 1Password, your information is safe. 1Password encrypts your vault data in a fundamentally different way than other password managers. Our dual-key encryption ensures a breach of 1Password’s systems would pose no threat to sensitive information stored in your vaults.
• 1Password encrypts crucial metadata to protect your privacy. In addition to the contents of your vaults, we also encrypt vault names and stored website URLs. Without them, someone who obtains your encrypted vault data would have no way to guess what’s inside – they wouldn’t know if they were cracking a vault with credit cards or cookie recipes.
• You don’t have to take our word for it. We invest heavily in being good citizens of the security community, involving third-party researchers for regular assessments, and offering the industry’s largest bug bounty to help us discover and resolve vulnerabilities before they can affect you.

Read on to discover how we built 1Password to render your vault data effectively useless to attackers, even if they somehow got their hands on it.

What would a breach of 1Password mean for your passwords?

1Password has never had a breach. But if one should occur, a breach of our systems would not put your sensitive vault data at risk.

When we designed the security architecture of 1Password, we had to account for the possibility that some day our servers could be compromised. When well-equipped, determined attackers target password managers, they do it because they believe the prize is worth the effort. After all, why compromise a single person’s data when you can potentially score millions of bounties?

1Password is built so that if attackers were to breach our systems, any vault data they obtain would be effectively useless to them, even if they had all the computing power in the world available to try cracking it open.

How is this possible?

How 1Password is different

A password manager is like a safe deposit box: a secure container to put things in, stored at a fortified offsite bank, and locked with a key (your account password).

If someone gains access to that bank, they can steal the box and try to pick the lock. At that point it’s only a matter of time before they crack the password…and it’s often much less time than we think.

That’s why with 1Password, your safe deposit box requires a combination of two keys to open, neither of which is ever seen (much less held) by 1Password.

1. The first key is your account password – this is the password you choose, and the only one you need to remember in order to access your vaults.
2. The second key, unique to 1Password, is called the Secret Key. It’s a 128-bit, machine-generated code that’s mathematically infeasible to crack.

Other password managers rely on just the first key to protect your data. The problem is that those keys are often much easier to guess because people need to be able to remember them. 1Password adds the unguessable Secret Key to strengthen the encryption and ensure there’s no practical way for your vault data to be cracked.

In daily use, you don’t need to think about the Secret Key because the 1Password apps take care of it for you. So you get all the security benefits of dual-key encryption while keeping the convenience of just one password that you need to remember to unlock your vaults.

If criminals ever did obtain a copy of your vault data, they’d need both the account password (which only you know) and the Secret Key (which only you have) in order to combine them and unlock your data. Without both keys, your data is effectively impossible to decrypt. Trying to crack the combined encryption scheme provided by this dual-key approach – even using every computer on Earth today – would take, conservatively, several times the known age of the universe.

Overkill? We don’t think so. It’s the least we can do to fulfill our promise of making sure your data never falls into the wrong hands.

Stay skeptical

We’re confident that our security model provides the best protection you can get, but we want you to feel just as confident about it.

It’s why we publish a detailed security white paper (download) that provides an in-depth look at our approach, including additional aspects that are unique to 1Password, like the Secure Remote Password (SRP) protocol.

But even that’s not enough. Things change fast in security, which is why we continually invest in our efforts to stay ahead of the game. The more we can scrutinize and improve how we do things, the more transparency and peace of mind we can offer you as you’re evaluating your options.

For example, we recently increased the rewards we pay out to security researchers. These external experts help us identify potential vulnerabilities in our systems so we can fix them before they affect customers.

In fact, our million-dollar bug bounty program is now the largest in the password manager space, and it joins other ongoing efforts like our third-party security audit program in making sure you always have trustworthy, up-to-date information you can use to evaluate our claims.

In other words, when we say we protect your data, you don’t have to take our word for it.

Ready to get started?

At the end of the day, trust is earned. So while we could ask you to simply trust us, we won’t.

We want you to stay skeptical, and we love it when you ask us the tough questions about how everything works. Our team is always standing by to help.

Whatever you do, don’t settle for “good enough” – we certainly don’t. Because when it comes to protecting your most precious information, “good enough”…isn’t good enough.

Pedro Canahuati

Chief Technology Officer