1Password in 2026: the secret key, versions, and passkeys

When LastPass was breached in 2022, the attackers made off with encrypted copies of customer vaults and the metadata wrapped around them. The aftermath handed every password manager the same interview question: what, exactly, would an attacker get out of your servers? 1Password has been answering that question for a decade with two words — secret key — and the answer is still the strongest card it holds.

Here is 1Password as it actually exists in late 2026: the two-key security model, the state of version 8, what the subscription buys, what it does for two-factor authentication, and the criticisms that survive contact with the facts.

The secret key: 128 bits the server never sees

Create a 1Password account and something unusual happens before you have chosen anything: the app generates a 128-bit Secret Key on your device. It looks like a serial number — 34 letters and numbers in blocks, as 1Password's security team describes it — and the readable version never leaves your hardware.

Your vault's encryption key is derived from two ingredients: that Secret Key and your account password. The security model combines them so that neither alone is enough, and 1Password's security page compresses the design into one line: a password the company never stores, plus a 128-bit Secret Key it never receives. The server holds ciphertext, and a verifier that lets it check your password at sign-in without learning it.

The breach math follows. An attacker who exfiltrates every byte 1Password stores gets encrypted blobs whose key includes 128 bits of randomness that was never uploaded anywhere. Cracking the vault means attacking the combined key, not merely guessing your password — the Secret Key alone contributes its 128 bits, and your password adds whatever entropy it has on top. That is why 1Password's answer to server-compromise scenarios has aged better than most: the stolen blobs are useless without something that exists only on your devices.

The trade cuts both ways, and 1Password does not hide it. Forget the account password and lose the Secret Key — no signed-in device, no printed Emergency Kit — and the data is gone. Nobody can recover it, including 1Password. The Emergency Kit, the PDF you are prompted to save at signup, exists precisely because the Secret Key is as unforgiving as it is protective. About your Secret Key in the support docs is the canonical reference.

Still version 8, still subscription-only

1Password 8 arrived in 2021 as a full rewrite — one codebase across desktop and mobile — and it remains the current major version. As of late 2026 there is no 1Password 9. The release notes show the apps marching along the 8.10.x line, with the company's energy going into passkeys and adjacent products rather than a version-number event. Any guide still selling you a "1Password 7 license" is describing the purchase model that retired when version 8 shipped.

There has never been a free tier. What exists is a 14-day trial, then a subscription, as the plans page lays out: Individual from $3.99 a month and Families from $5.99 a month for up to five members, both including Watchtower breach alerts, billed annually as of late 2026. On the business side, 1Password's pricing lists a Teams Starter Pack at $24.95 a month for up to 10 users and Business at $8.99 per user per month.

Plan	Price, late 2026	Seats
Individual	from $3.99/month	1
Families	from $5.99/month	up to 5
Teams Starter Pack	$24.95/month	up to 10
Business	$8.99 per user/month	5+

For context, the individual rate works out to roughly $48 a year — about two and a half times Bitwarden's $19.80 Premium, a gap the best free password managers of 2026 covers from the other direction.

What 1Password does for two-factor

It stores TOTP codes in the vault

Any 1Password item can hold one-time passwords. Scan the QR code when a site offers 2FA, and the six-digit code lives in the item, filling in beside the password at sign-in — the support guide calls this using 1Password as an authenticator. It is genuinely convenient, and it is the standard argument for the password-manager-as-authenticator approach.

It is also the standard counter-argument. A TOTP seed stored next to the password it protects collapses two factors into one vault: whoever opens the vault gets both halves of the login. We build a dedicated 2FA vault for exactly this split — secrets encrypted in the browser before upload, Argon2id guarding login, TOTP and HOTP and Steam Guard with per-key settings — but the honest version of the advice is simply to keep the factors in separate places, whichever tools you use. The best TOTP apps in 2026 surveys the dedicated options.

It takes hardware keys seriously

The 1Password account itself can require a second factor at sign-in, and the strongest option is a hardware security key. Register a YubiKey or its siblings from your account page — the support doc walks the path: sign in on 1password.com, then More Actions, Manage Two-Factor Authentication — after which sign-ins from new devices ask for the key's touch. Business plans go further and can enforce security-key 2FA account-wide, turning phishing against the vault itself into a dead end. The hardware keys guide covers what the keys do and where they fall short.

Note what the key is and is not. The YubiKey guards sign-in, but the data's confidentiality still rests on the Secret Key and your password. Lose the key and you face an account-recovery process, not a decryption problem.

Watchtower and passkeys

Watchtower, the account-health dashboard, ships on every plan including Individual — the pricing page lists breach alerts as a baseline feature. It flags credentials that appear in known breaches and nags about weak and reused passwords, which is the quiet hygiene work that keeps a vault trustworthy over years.

Passkeys are the other half of the modern story. 1Password saves and signs in with passkeys in the browser, stores them alongside passwords, and lets you organize and share them like any other item. You can even sign in to 1Password itself with a passkey instead of the account password — the company argues the security holds because the Secret Key stays in the mix. For a product whose brand is "two secret things," adding passkeys without dropping the Secret Key was the conservative move, and it was the right one.

Why families and teams keep choosing it

The unspectacular truth about 1Password's position is polish. The apps exist everywhere — Windows, macOS, Linux, iOS, Android, every major browser — and behave the same way everywhere. The Families plan covers five people with shared vaults and a recovery role: an organizer can rescue a member who forgets the password, which is the failure mode that quietly kills family password management in every other product. Business plans sweeten the deal in a way people miss: every business user gets a free 1Password Families membership for personal use, which moves the household onto the tool the office already pays for.

That consistency is the product. The Secret Key is why security people recommend it. The apps are why everyone else stays.

The honest case against it

Three criticisms survive scrutiny. It is subscription-only — no free tier, no lifetime license, and roughly $48 a year for what Bitwarden and KeePass do without charge. The clients are closed source: 1Password publishes its security design and commissions outside assessments, but you cannot read the code that encrypts your vault, so a slice of trust in AgileBits is structural rather than optional. And the price compounds for households: five people on Families are paying for fit and finish, not stronger encryption — the cryptography argument favors several cheaper rivals.

What 1Password does not deserve is the lazy version of the trust critique. After the LastPass breaches, "another password manager gets hacked" became a genre, and 1Password's answer — a Secret Key never uploaded, combined with a password never stored — is the specific, checkable design difference. The LastPass guide covers what actually went wrong there. Export exists and always has, so the door out stays open. The real decision is whether the polish is worth the premium, not whether the lock works.

Frequently asked questions

Is there a free version of 1Password?

No, and there never has been. 1Password offers a 14-day trial, then requires a subscription: Individual from $3.99 a month and Families from $5.99 a month for up to five members as of late 2026, per the official plans page. There is no ad-supported tier and no grandfathered free plan. If free is the requirement, Bitwarden, Proton Pass, and KeePass all store unlimited passwords without charge — the best free password managers of 2026 compares them — and 1Password's pitch is that the money buys the apps and the support, not better encryption.

Can 1Password be my authenticator app?

Yes. Any login item can store one-time passwords: scan the site's QR code into the item and the TOTP code appears beside the password, ready to autofill at sign-in. Standard TOTP is handled well, including items with custom digits and periods. The caveat is architectural — a seed stored beside the password it protects collapses two factors into one vault, so whoever opens the vault gets both. Plenty of careful people still do it for the convenience. The alternative is a dedicated authenticator that never touches your password store, which is the split we would argue for.

Can I use a YubiKey with 1Password?

Yes, in two distinct roles. The main one is second-factor sign-in: register one or more security keys from your account page — sign in on 1password.com, then More Actions and Manage Two-Factor Authentication — after which new devices require the key's touch. Business accounts can enforce security-key 2FA organization-wide. The second role is independent: a YubiKey can hold passkeys for other sites with no 1Password involvement. What the key never does is encrypt the vault itself — that remains the Secret Key's job, which is why a lost YubiKey is a recovery chore, not data loss.

What happens if I lose my Secret Key?

The Secret Key is generated once, on your device, and 1Password never receives a readable copy, so it cannot be reissued. If you lose it while still signed in somewhere, you can read it in the app's settings and print a fresh Emergency Kit. If you lose it along with the account password and every signed-in device, the vault is unrecoverable by anyone, 1Password included. That is the design working as intended. Save the Emergency Kit at signup and store it the way you store a house key — somewhere physical, findable, and not on the same devices it protects.

Is 1Password 9 out yet?

No. As of late 2026 the current major version is still 8, with the 8.10.x line carrying the desktop and mobile releases — the release-notes site is the place to check. 1Password's development effort since the version 8 rewrite has gone into passkeys, Watchtower improvements, and business features rather than a renumbering. A guide referencing 1Password 7 licenses is describing the pre-2021 world, when you could buy the app outright. The subscription apps are what exist now, and the 8.x line is a mature one rather than a stale one.

If you land on 1Password for passwords, consider keeping the second factor somewhere else entirely. The guest generator needs no account: paste a Base32 secret, an otpauth:// link, a QR image, or a Google Authenticator export, and the code appears — computed in the page, stored nowhere, gone on reload. The features page has the vault version.