SECURE YOUR 1PASSWORD ACCOUNT

Protect the password manager that protects your other accounts.

Your password manager can hold the credentials, recovery information and authentication codes that protect your digital life. Secure 1Password itself before relying on it to protect everything else.

Your password manager deserves stronger protection than an ordinary account.

1Password uses an account password and a unique Secret Key as important parts of its security model. The Secret Key is stored on devices you've used and in your Emergency Kit, and 1Password says it does not have a copy that it can recover for you.

What is the Secret Key?
The Secret Key is a unique 34-character code that works together with your 1Password account password. It helps protect and encrypt your 1Password data. It is not a normal password and it is not a backup code.
What is the Emergency Kit?
The Emergency Kit is a document containing important information needed to access your 1Password account, including your sign-in address, email address, Secret Key and a place to record your account password.
What is two-factor authentication?
Two-factor authentication adds another authentication step after your password. 1Password currently supports authenticator apps and compatible security keys.
Should I store 1Password's own 2FA code inside 1Password?
No. 1Password specifically recommends using a different authenticator app for the authentication codes protecting the 1Password account itself.
What if my phone or computer is stolen?
Use your device's official remote-lock or erase tools where available, then sign in to 1Password from a trusted device, regenerate your Secret Key when appropriate, save a new Emergency Kit and deauthorize the lost device.
1PASSWORD SECURITY

Secure the vault before trusting it with your keys.

Work through these checks one at a time. Your password manager should become one of the strongest-protected accounts you own.

Protect your 1Password account password

Your 1Password account password protects access to your password vault. It should be strong, private and used only for 1Password.

Click to see protection steps

Step-by-step

  1. Use a strong, memorable 1Password account password.
  2. Do not reuse it for your email, banking or social-media accounts.
  3. Never send your account password to another person.
  4. Do not store it in an ordinary message, note or email.
  5. Be suspicious of anyone claiming to be 1Password Support and asking for your password.
  6. If you believe the password has been exposed, change it as soon as possible.

VERIFY: Confirm that your 1Password account password is unique, private and not reused anywhere else.

Protect your Secret Key

Your Secret Key works together with your 1Password account password to protect your account and encrypt your data. It is not the same thing as a backup code.

Click to see protection steps

Step-by-step

  1. Treat your Secret Key as highly sensitive information.
  2. Never post it online or send it to another person unnecessarily.
  3. Do not confuse your Secret Key with your account password.
  4. Do not assume 1Password can simply reset or recover a lost Secret Key.
  5. Make sure you know where your Secret Key is stored.
  6. Keep a current copy of your Emergency Kit.

VERIFY: Confirm that you can locate your Secret Key without exposing it to anyone else.

Save your Emergency Kit

The 1Password Emergency Kit contains the information you may need to regain access to your account, including your Secret Key and a place for your account password.

Click to see protection steps

Step-by-step

  1. Sign in to your 1Password account.
  2. Open your account management area.
  3. Select the option to Save Emergency Kit.
  4. Keep a printed copy somewhere physically secure.
  5. Consider keeping a secure digital copy where you can access it during an emergency.
  6. Never leave the Emergency Kit publicly accessible.

VERIFY: Confirm that you have a safe Emergency Kit and that another person cannot casually access it.

Turn on two-factor authentication

Two-factor authentication adds another authentication layer to your 1Password account. 1Password currently supports authenticator apps and security keys.

Click to see protection steps

Step-by-step

  1. Sign in to 1Password.com.
  2. Select your name in the top-right corner.
  3. Select Manage Account.
  4. Open More Actions → Manage Two-Factor Authentication.
  5. Choose Set Up App if you are using an authenticator app.
  6. Complete the verification process and safely store the backup information provided during setup.

VERIFY: Confirm that two-factor authentication is enabled and that you have a safe recovery method before signing out.

Consider a security key

A hardware security key such as a compatible FIDO security key can provide a strong second factor for your 1Password account.

Click to see protection steps

Step-by-step

  1. Obtain a compatible FIDO security key.
  2. Sign in to 1Password.com.
  3. Open Manage Account.
  4. Go to More Actions → Manage Two-Factor Authentication.
  5. Select Add a Security Key.
  6. Register the key and give it a recognizable name.
  7. Keep a second security key in a secure location if practical.

VERIFY: Confirm that your security key works before relying on it as your primary second factor.

Do not store 1Password's own 2FA code inside 1Password

1Password itself recommends using a different authenticator for the authentication code protecting your 1Password account.

Click to see protection steps

Step-by-step

  1. Use a separate authenticator app for your 1Password account's authentication code.
  2. Do not put the authentication code for your 1Password account into the same 1Password vault you are trying to protect.
  3. Keep your authenticator backup information secure.
  4. Make sure you have a recovery plan before losing access to your authenticator device.

VERIFY: Confirm that your 1Password account's second factor does not depend entirely on the same vault you are trying to protect.

Protect your recovery information

Recovery information can restore access when normal sign-in fails. It must therefore be protected almost as carefully as the account itself.

Click to see protection steps

Step-by-step

  1. Keep recovery information somewhere secure and private.
  2. Do not send recovery information through social media or ordinary chat.
  3. Do not give recovery information to an unexpected caller.
  4. Make sure your recovery email account is itself protected.
  5. Review your recovery arrangements periodically.

VERIFY: Confirm that your recovery method is available to you but not easily available to an attacker.

Generate a recovery code when appropriate

1Password currently provides recovery codes that can be used to regain access when you cannot use your normal account credentials.

Click to see protection steps

Step-by-step

  1. Sign in to 1Password.com.
  2. Open the account recovery options.
  3. Generate a recovery code if the feature is available for your account.
  4. Store the recovery code securely.
  5. Do not keep the recovery code in an exposed text file or public cloud folder.
  6. Treat it as sensitive recovery information.

VERIFY: Confirm that your recovery code is stored securely and that you know where to find it if an emergency occurs.

Review authorized devices

A password manager contains the keys to many other accounts. Knowing which devices have access to it is therefore essential.

Click to see protection steps

Step-by-step

  1. Sign in to your 1Password account.
  2. Review the computers and mobile devices associated with the account.
  3. Identify devices you no longer own or recognize.
  4. Remove or deauthorize devices that should no longer have access.
  5. Pay particular attention after selling, giving away or losing a device.

VERIFY: Confirm that every device with access to your 1Password account is one you recognize and still control.

Secure the 1Password browser extension

The browser extension can access and fill credentials, so your browser and extension environment are part of your security boundary.

Click to see protection steps

Step-by-step

  1. Install the 1Password extension only from an official browser store or 1Password source.
  2. Keep your browser updated.
  3. Keep 1Password updated.
  4. Be cautious when approving unexpected browser-extension prompts.
  5. Lock 1Password when you are finished using a shared computer.

VERIFY: Confirm that your browser, 1Password extension and computer are all under your control.

Protect shared vault items

Sharing a password with another person should not mean sharing your entire password vault.

Click to see protection steps

Step-by-step

  1. Share only the specific item that another person actually needs.
  2. Avoid putting unrelated credentials into a shared location.
  3. Review who has access to shared vaults.
  4. Remove access when a person no longer needs it.
  5. Change credentials when appropriate after access has been revoked.

VERIFY: Confirm that each shared item is visible only to people who genuinely need access.

Use 1Password to protect other accounts

A password manager is most useful when it helps you create unique credentials instead of encouraging password reuse.

Click to see protection steps

Step-by-step

  1. Generate a different password for every important account.
  2. Store the credentials in the correct 1Password vault.
  3. Enable two-factor authentication on important services.
  4. Store recovery information for those services where appropriate.
  5. Review old or reused passwords periodically.

VERIFY: Confirm that your most important accounts no longer depend on one reused password.

Be careful with one-time passwords

1Password can store one-time passwords for other services, but the authentication method protecting your own 1Password account should be kept separate.

Click to see protection steps

Step-by-step

  1. Use 1Password to store OTPs for other services when appropriate.
  2. Follow the security requirements of the service you are protecting.
  3. For the 1Password account itself, use a separate authenticator app or compatible security key.
  4. Never disclose a one-time password to an unexpected caller.

VERIFY: Confirm that you have not accidentally created a circular security setup around your 1Password account.

If your device is lost or stolen

Losing a device containing 1Password does not automatically mean losing your vault, but you should immediately protect the account and the device.

Click to see protection steps

Step-by-step

  1. Use your device manufacturer's Find My Device or remote-lock/erase feature where available.
  2. Sign in to 1Password.com from a trusted device.
  3. Regenerate your Secret Key when appropriate.
  4. Save your new Emergency Kit.
  5. Deauthorize the lost or stolen device.
  6. Review your account and other sensitive credentials for suspicious activity.

VERIFY: Confirm that the lost device can no longer be used as a trusted route into your 1Password account.

If you forgot your account password

Do not assume that losing your 1Password account password is the same as losing your Secret Key. Use the official recovery process available for your account type.

Click to see protection steps

Step-by-step

  1. Stop trying random passwords repeatedly.
  2. Locate your Emergency Kit if you have one.
  3. Check whether your account has an available recovery method.
  4. Use only the official 1Password recovery process.
  5. If you are part of a family or team account, check whether an authorized organizer or administrator can help with account recovery.

VERIFY: Confirm that you are using 1Password's official recovery process rather than a third-party 'account recovery' service.

If you believe your 1Password account is compromised

A suspected compromise should be treated seriously because a password manager may contain credentials for banking, email, social media and other critical services.

Click to see protection steps

Step-by-step

  1. Stop using the suspected compromised device for sensitive account changes if possible.
  2. Sign in from a trusted device.
  3. Change your 1Password account password if appropriate.
  4. Regenerate your Secret Key when appropriate.
  5. Deauthorize devices you do not recognize.
  6. Review your 1Password account and vault activity for anything suspicious.
  7. Change the passwords of your most important accounts, starting with email, banking and identity accounts.

VERIFY: Confirm that the 1Password account has been secured and that your highest-value accounts have also been reviewed.

Something does not look right?

If you find an unfamiliar login, changed recovery information, unexpected security alerts or another sign that someone may have accessed your account, stop the normal security check and move to the recovery process.

I think my account is compromised →
Still need help?

If you have worked through the relevant settings and something still looks wrong, do not give your security secrets to someone promising to fix the account. Use the service's official support and recovery resources for service-specific account problems.

For broader cybersecurity problems, you can also use the professional assistance pathway on this platform.

Need Professional Help? →
1password security is not a one-time task.

Review important account settings periodically, especially after a password change, device change, suspicious message or unexpected login alert.

VERIFY BEFORE YOU TRUST.

← Back to Secure Your Accounts