1Password
1Password stores passwords, passkeys, card details and private notes, and fills login details in apps and websites. It’s made by AgileBits, based in Canada.
Criminals have used its name in fake downloads or scams, so get it only from 1password.com.
What it is
1Password keeps passwords and other private information in encrypted vaults. People use it to create different passwords for each account, fill login details and share selected information with family members.
With Accessibility permission, Universal Autofill can inspect running apps to find and fill login fields. Screen Recording permission lets it scan setup codes and QR codes on your screen. The maker says these scans stay on your Mac and no screen or audio recordings are saved.
1Password says your vault data is encrypted and your account password is never sent to the company. It publishes security advisories and updates for reported flaws. Its documentation recommends keeping the app up to date.
Who makes it
AgileBits, trading as 1Password, is a privately held Canadian security software company established in 2005. Its legal name is AgileBits Inc.. Its website is 1password.com.
Is it the real one?
Every Mac app carries a signature from the developer who made it. Apple checks who the developer is before handing out the certificate, and macOS refuses to open an app whose signature has been tampered with.
The real 1Password is signed by AgileBits Inc., Apple team ID 2BUA8C4S2C. A copy signed by anyone else isn’t from AgileBits. HARD’s Mac app checks this for you; to check by hand, open Terminal and run codesign -dv "/Applications/1Password.app", and look for that TeamIdentifier.
Its bundle ID, the name macOS knows it by, is com.1password.1password or com.agilebits.onepassword7 or com.agilebits.onepassword4 or com.agilebits.onepassword-osx. Download it only from 1password.com, not from an ad or a link someone sends you.
Fakes. In September 2025, researchers reported fake GitHub downloads impersonating 1Password and other Mac apps to spread Atomic password-stealing malware through Terminal commands. In October 2025, Malwarebytes reported fake 1Password breach emails designed to steal account credentials.
What it connects to
In normal use, 1Password talks to these places on the internet. A firewall that asks before apps connect, like the one in HARD’s Mac app, will show them.
| Address | Why |
|---|---|
*.1password.com | Account services and app updates. |
*.1password.ca | Account services for Canadian accounts. |
*.1password.eu | Account services for European accounts. |
*.1passwordservices.com | Supporting services, telemetry and subscriptions. |
*.1passwordusercontent.com | Saved files and profile pictures. |
app-updates.agilebits.com | App updates. |
cache.agilebits.com | Website and software icons. |
api.pwnedpasswords.com | Checks for exposed passwords through Watchtower. |
What it can see
macOS asks you before an app can use these. You can change them any time in System Settings → Privacy & Security.
| Permission | What it’s for |
|---|---|
| Accessibility | Optional Universal Autofill uses it to identify and fill login fields in apps and browsers. |
| Automation | Allows Universal Autofill to identify password prompts and fill your Mac login password in Terminal or iTerm2. |
| Screen Recording | Scans setup codes and one-time password QR codes displayed on your screen. |
Security record
Problems with 1Password or AgileBits in the last three years, newest first. Keeping the app up to date covers the ones that were fixed.
| When | What happened | Source |
|---|---|---|
| Malicious instructions could steer an AI assistant using an unlocked browser extension into accessing the web vault; 1Password added an option to disable automatic web sign-in. | ↗ | |
| Deceptive webpages could trick users into autofilling an item; extension version 8.11.7.2 expanded optional confirmation prompts, but the maker says clickjacking has no complete technical fix. | ↗ | |
| The maker disclosed that malware controlling a Mac could impersonate browser communication to obtain secrets, describing this as a browser limitation it could not resolve. | ↗ | |
| A flaw could let malware use an older app version to access 1Password secrets in the macOS Keychain; version 8.10.38 fixed it. | ↗ | |
| A flaw could let malware on the same Mac impersonate trusted 1Password integrations; version 8.10.36 fixed it. | ↗ |
References
- Deploy 1Password for Mac and Windows support.1password.com
- 1Password7.app — Allow in the Background 1password.community
- Certificates, Provisioning Profiles, and Expiration Dates 1password.com
- Rules for modified signed app access — Apple Developer Forums developer.apple.com
- 1Password Modern Slavery Transparency Statement 1password.com
- Download 1Password for macOS 1password.com
- About the 1Password security model support.1password.com
- About macOS Privacy & Security settings for Universal Autofill support.1password.com
- If you see 1Password would like to record this screen on your Mac support.1password.com
- How to keep 1Password up to date support.1password.com
- 1Password for Mac release notes releases.1password.com
- 1Password ports and domains support.1password.com
- Large-Scale Attack Targeting Macs via GitHub Pages Impersonating Companies blog.lastpass.com
- Phishers target 1Password users with convincing fake breach alert malwarebytes.com
- Security advisory for AI-assisted browsing interactions with the 1Password browser extension 1password.com
- DOM-based extension clickjacking support.1password.com
- August 2024 security update 1password.com
- CVE-2024-42218 for 1Password 8 for Mac support.1password.com
- CVE-2024-42219 for 1Password 8 for Mac support.1password.com
- The signature on a real installed copy, read by HARD with
codesign.