# 1Password privacy rating

Closed source password manager from AgileBits with end-to-end encrypted sync across desktop, mobile, browser and command-line apps.

## Summary

1Password scores 45 out of 100 (grade D) on the password managers criteria. It meets 3 of 11 criteria: tells users about requests, end-to-end encrypted vault and full export. It partly meets no ads or data sales, independent audit, transparency report, TLS configuration and local or self-hosted option. It does not meet open source, no trackers or telemetry and security headers. It is based in Canada: Five Eyes member. Automated tests: SSL Labs grade B and Mozilla HTTP Observatory grade B-.

- Website: https://1password.com
- Jurisdiction: Canada. Five Eyes member.
- Home page trackers: none found
- Category: [Password managers](https://privacyratings.com/password-managers/)
- Grade: D (45/100)

## Criteria

| Criterion | Answer | Note | Evidence |
| --- | --- | --- | --- |
| Open source | No | Closed source. |  |
| No trackers or telemetry | No | The privacy policy says 1Password and its marketing partners use cookies and tracking technologies on its websites and products for analytics and advertising. | https://1password.com/legal/privacy |
| No ads or data sales | Partial | Funded by subscriptions, but the privacy policy says data shared with marketing partners may count as a sale or sharing of personal information. | https://1password.com/legal/privacy |
| Independent audit | Partial | Recent penetration test reports are only available through the 1Password Trust Center. The public full reports are older than three years. | https://support.1password.com/security-assessments/ |
| Transparency report | Partial | Publishes government request guidelines but no request counts. | https://1password.com/legal/law-enforcement |
| Tells users about requests | Yes | Seeks to notify users before disclosing data unless prohibited by law or where there is risk of harm. | https://1password.com/legal/law-enforcement |
| TLS configuration | Partial | Grade B | https://www.ssllabs.com/ssltest/analyze.html?d=1password.com&hideResults=on |
| Security headers | No | Grade B- (65/100+) | https://developer.mozilla.org/en-US/observatory/analyze?host=1password.com |
| Modern web standards | Not tested yet | Not tested yet. |  |
| End-to-end encrypted vault | Yes | Vault data is end-to-end encrypted with keys derived from the account password and Secret Key. | https://support.1password.com/1password-security/ |
| Local or self-hosted option | Partial | Vaults are stored only in the 1Password cloud. Data can be exported. | https://support.1password.com/export/ |
| Full export | Yes | Full export to the JSON-based 1PUX format, or CSV for logins and passwords. | https://support.1password.com/export/ |

Source: https://privacyratings.com/password-managers/1password/
Edit: https://github.com/privacyratings/privacyratings.com/edit/main/ratings/password-managers/1password.md