Short answer: 1Password reported a security incident in 2023 involving its employee-facing Okta tenant, but said its investigation found no access to customer data. The company had said in January 2023 that it had never had a breach; that was a dated company statement, not independent proof that no security incident had ever occurred.
What happened in 2023?
In an October 23, 2023 incident report, 1Password said it detected suspicious activity in its Okta instance on September 29. That Okta tenant was used to manage employee-facing applications. The company said an attacker accessed the tenant with administrative privileges and that it traced the activity to the breach of Okta’s Support System.
As an Amazon Associate I earn from qualifying purchases.
1Password reported that its investigation found no evidence of access to systems outside Okta and concluded that no user data or other sensitive systems were compromised. It later said its Google instance was not affected. These are 1Password’s findings and account of the incident, not an independent verification. Read 1Password’s incident report.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsAn employee identity-management system being accessed is a real security incident. It is not, by itself, evidence that customer vaults were accessed or decrypted. The available account of this event does not establish either outcome.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Why did 1Password say it had never had a breach?
On January 10, 2023, months before the Okta-related event was disclosed, 1Password executive Pedro Canahuati wrote, “1Password has never had a breach.” That statement describes the company’s position at that time. It should not be read as a current, independently proven guarantee or as proof that no security incident occurred later. See the January 2023 security explainer.
“Hacked” and “breach” can refer to different things: an intrusion into a company system, a stolen customer account, or the exposure of encrypted vault data. The 2023 incident falls into the first category based on the company’s report; its report says customer data was not accessed.
Rank #2
- PHISHING-RESISTANT 2FA: Cryptographically binds to real domains, making phishing attacks impossible unlike SMS codes or authenticator apps.
- 3-SIDE CAPACITIVE TOUCH: Tap the end, left, or right side to authenticate, so it works in any orientation or crowded USB port.
- MULTI-COLOR LED INDICATOR: Blue means ready, blinking blue means tap now, green means success, and red means error for instant status feedback.
- IP68 WATERPROOF & BATTERY-FREE: Crush-resistant one-piece construction survives daily carry on a keychain or in a bag for years without any batteries.
- UNIVERSAL COMPATIBILITY: Works with Google, Microsoft, Apple, GitHub, AWS, and any FIDO2 / U2F / WebAuthn service, storing up to 100 passkeys.
How does 1Password say it protects vault data?
1Password describes its system as end-to-end encrypted and based on two secrets: the account password chosen by the user and a machine-generated 128-bit Secret Key. According to the company, the account password is not stored with vault data or sent over the network. Its support documentation names AES-GCM-256 authenticated encryption and PBKDF2-HMAC-SHA256 key derivation. It also describes Secure Remote Password (SRP) authentication, which is designed to authenticate without sending the password over the internet. These are descriptions of 1Password’s design, not a claim that every attack is impossible. 1Password’s security model documentation.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The design aims to keep vault contents protected even from someone who can access stored encrypted data without the necessary secrets. Encryption does not neutralize every risk: malware on an unlocked device, phishing, stolen sign-in details, weak or reused passwords, or a software vulnerability can create different paths to account or information exposure. The 2023 Okta report does not say any of those occurred.
Rank #3
- USB-C or tap via NFC for easy authentication on any compatible device. No drivers needed; optional Kensington software available for advanced management features.
- Works across Windows, macOS, iOS, Android, ChromeOS, and supports Passkeys and Apple ID.
- Slim, keychain-ready form for easy carry and on-the-go authentication
- IP68-rated for dependable performance
- FIDO CTAP 2.1 for enhanced security features (e.g. resident credentials, Passkey support) and backwards compatibility with CTAP 2. FIDO2 L2 certified security for phishing resistant protection against identity theft and unauthorized access.
What other safeguards and information practices matter?
1Password documents controls including automatic locking, browser code-signature validation, phishing protection that fills credentials only on saved sites, and Watchtower alerts. The company says Watchtower checks saved credential issues locally on the device; for that check, it says users’ websites and passwords are not sent to 1Password or another party. See 1Password’s security features and privacy policy.
That does not mean the provider holds no account or operational information. 1Password’s privacy policy describes collecting information such as account type and ownership, payment details, usage information, IP address, connected devices, name, email address, and profile picture. It says vault items and metadata such as titles, URLs, tags, and custom icons are encrypted.
Rank #4
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
The same policy says 1Password will promptly disclose any risk and provide a transparent account of events in the event of a breach, and refers to applicable Canadian and GDPR breach-notification requirements. That is the company’s stated policy; disclosure promises are not a substitute for evaluating an incident report when one occurs.
Recommended Free Tools
What do audits and certifications establish?
1Password’s audit page lists ISO 27001:2022, ISO 27017:2015, ISO 27018:2019 and ISO 27701:2019 certifications, as well as SOC 2 Type 2. It says annual penetration-test reports have been distributed through its Trust Center since November 3, 2025. The page also says its bug-bounty program moved to HackerOne in December 2024 and is public. These are useful assurance signals, but any certification or assessment has a defined scope and period; none proves a provider can never be compromised. Review 1Password’s audits and security information.
Best Value
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
The same page identifies an Independent Security Evaluators penetration test and code review performed in April and June 2020. That dated assessment should not be treated as independent validation of every current feature or system. 1Password’s security white paper landing page lists Release 0.5.2 dated March 5, 2026; the document’s version and date matter when assessing what it covers. See the security white paper.
What should a 1Password user do?
The 2023 report does not establish that customers need to respond to a vault exposure. For account hygiene, use a strong, unique account password, keep devices and browsers updated, lock devices when unattended, and be cautious about entering credentials after following unexpected links. Pay attention to official incident notices and account-security guidance rather than assuming that encryption alone eliminates risk.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
