Security and privacy

Security audits of 1Password

1Password hosted services have been reviewed by multiple independent security firms.

1Password is periodically assessed to ensure it remains a secure way for you to share all your secrets.


1Password is SOC 2 type 2 certified. SOC, or Service Organization Control, is an independent auditing process that ensures that 1Password securely manages data to protect customers’ interests and privacy. To request a copy of the SOC 2 report, contact the 1Password Business team.

Learn more about SOC 2 certification of 1Password.


Bugcrowd, Inc. is engaged in an ongoing, private bug bounty program targeting the 1Password service and web-application. Testers are provided with details of the API.

This program is currently open to the public and has received submissions from 387 unique researchers. These issues ranged in scope and severity, with nine high priority issues being discovered during this time frame. Despite the presence of these high priority findings no user secrets were at risk. Additionally, as of January 1, 2020, all the high priority submissions from this program were confirmed to be resolved.

None of the identified issues resulted in a loss of Confidentiality, Integrity or Availability.

Full details are available in the Bugcrowd security review  


AppSec Consulting was contracted to perform a penetration test and code review of the 1Password application. The assessment was performed during July, 2018.

The security controls observed in the 1Password application were found to be substantial and unusually impressive.

Full details are available in the AppSec security review  


nVisium LLC was employed to perform a security assessment of the 1Password infrastructure. The assessment was performed during October and November, 2015.

It is nVisium's estimation that the current overall risk to AgileBits through the Cloud Infrastructure is low.

Full details are available in the nVisium security review  


CloudNative, Inc. was employed to analyze 1Password and provide best-practices guidance. The assessment was performed during September and October, 2015, prior to the public beta period.

Full details are available in the CloudNative security review  

Learn more