RMFInsider

Affiliate disclosure: this post contains affiliate links. If you buy through them, RMF Insider may earn a commission at no extra cost to you.

I run a 1Password review the same way I run a vendor risk assessment: what’s the architecture, what’s the breach history, and what happens when it fails. As an ISSO who spends the workweek reading vulnerability scan output and audit findings, I don’t trust a password manager because the marketing page says “military-grade encryption.” I trust it because the design holds up when someone actually tries to break it — and one already has, against a competitor.

This 1Password review is about that design: the Secret Key architecture, Watchtower, passkeys, and Travel Mode, plus where I think it’s genuinely worth the subscription and where a cheaper tool does the job just as well.

Why the LastPass Breach Still Matters in 2026

LastPass’s 2022 breach exposed more than 25 million encrypted vaults. That’s not a rounding error in an incident report — that’s the entire threat model failing at once.

The damage didn’t stay theoretical. Security researchers have since linked the stolen vault data to more than $150 million in cryptocurrency thefts, as attackers cracked weak master passwords offline at their leisure. In November 2025, the UK’s Information Commissioner’s Office fined LastPass £1.2 million over the incident. That’s three years of consequences from a single architectural weakness: once the vault data was exfiltrated, the only thing standing between an attacker and your accounts was your master password’s entropy.

I bring this up not to pile on a competitor but because it’s the clearest real-world case study of why single-factor vault encryption is a bad bet. If your password manager’s vault security depends entirely on a string you typed and might reuse elsewhere, you’ve built a single point of failure into your entire digital life.

The Secret Key: What Makes This 1Password Review Different

1Password’s answer to the LastPass problem is architectural, not procedural. Every account gets a 34-character Secret Key generated on your device at signup. That key never touches 1Password’s servers — it’s combined locally with your account password to derive the encryption key for your vault.

The practical effect: if 1Password’s servers were ever breached and the encrypted vault data stolen, that data alone is not brute-forceable. An attacker needs both your account password and the Secret Key that only exists on your registered devices. It’s the same layered-authentication logic I apply to system access reviews — no single credential should be sufficient to compromise the whole system.

The company backs this up with a zero-knowledge model using AES-256 encryption, meaning 1Password itself cannot read your vault contents even if compelled to. And unlike LastPass, 1Password has never had a vault breach. A 2023 incident involved a compromised third-party identity provider used by 1Password’s own IT team — attackers got into internal tooling, not customer vault data. Worth noting, worth distinguishing, and worth being precise about, since conflating the two would be the same kind of sloppy analysis I’d flag in a POA&M.

Ready to set it up properly? Pair it with a hardware key for your master account, which closes the last gap the Secret Key doesn’t cover — someone shoulder-surfing or phishing your account password directly.

Watchtower: Passive Monitoring That Actually Gets Used

Watchtower is 1Password’s built-in breach monitoring, and it’s the feature I check most often without thinking about it. It flags vault entries tied to known data breaches, weak or reused passwords, and expiring items, surfacing them the same way a vulnerability scanner surfaces a stale finding — front and center, not buried in a settings menu.

The value isn’t the alert itself. It’s that Watchtower turns “I should probably rotate old credentials someday” into a specific, actionable list. I treat it the same way I treat a ConMon dashboard: if it’s not visible and specific, it doesn’t get acted on.

If you’re building out a broader continuous monitoring habit for your own accounts the way you would for a system boundary, this lines up with the same discipline covered in our ConMon checklist — the tools differ, but the principle of continuous, not one-time, review is identical.

Passkeys: Less to Manage, Less to Lose

1Password can generate, save, and autofill passkeys directly, which matters more than it sounds like on first read. A passkey is phishing-resistant by design — there’s no shared secret an attacker can trick you into typing into a fake login page, because the private key never leaves your device or vault.

What I like about 1Password’s implementation specifically is that it doesn’t lock passkeys to a single device ecosystem. Store them in 1Password and they sync across platforms the same way your passwords do, instead of being stranded in whatever device generated them. For anyone who’s tried to migrate an Apple Passkey to a Windows machine, you know why that portability matters.

Travel Mode: Built for Border Crossings and TDY

This is the feature that gets undersold in most reviews, and it’s the one I actually use. Travel Mode lets you mark specific vaults as safe for travel; everything else disappears from the device entirely, not just hidden behind a lock screen.

That distinction matters at a border crossing or during a customs secondary inspection, where “hidden” data that’s still technically present on the device can still be compelled or extracted. Travel Mode actually removes the vault data from the local copy until you turn it back on post-travel.

For anyone doing TDY travel or working conferences overseas, this is worth planning around the same way you’d plan device sanitization before deployment. It pairs naturally with locking down what’s on the laptop itself — see our take on travel router setup for the network side of that same trip.

Pricing and the Honest Tradeoffs

Here’s the actual pricing, no rounding: Individual is $3.99/month billed annually, Families is $5.99/month for up to 5 members, Teams Starter is a flat $19.95/month for up to 10 users, and Business runs about $7.99 per user per month. There’s a 14-day trial if you want to test the workflow before committing.

Now the cons, because a review that only lists strengths isn’t a review.

• Subscription-only. There’s no one-time-purchase legacy license anymore, so you’re paying indefinitely for something you’ll use every single day for the rest of your working life.
• Bitwarden is free, or $10/year for premium, and covers the core password-manager use case — encrypted storage, autofill, TOTP codes — without a subscription tier that pushes past $4/month. If your threat model doesn’t need Travel Mode or Watchtower’s polish, Bitwarden is a legitimate budget answer.
• Proton Pass runs about $2.49/month, is open-source, and adds email alias generation — a real differentiator if you’re trying to reduce your exposed footprint across sites.
• RoboForm is the value option at $0.99–$2.49/month, competent for basic password management but without 1Password’s Travel Mode or Secret Key architecture.

I still pay for 1Password because Watchtower and Travel Mode are features I use on a weekly and quarterly basis respectively, not checkbox features I’ll never touch. If your use case is simpler, the alternatives below are worth pricing out first.

[AFFILIATE-LINK: 1Password]

[AFFILIATE-LINK: Proton Pass]

[AFFILIATE-LINK: RoboForm]

Verdict

1Password earns its subscription price through architecture, not branding. The Secret Key means a server-side breach doesn’t automatically mean a vault compromise — a distinction LastPass’s history makes concrete rather than theoretical. Watchtower and Travel Mode are the features that turn “password manager” into an actual security practice instead of a convenience app.

If you’re studying for a security certification and want to understand how credential architecture decisions like this get evaluated in a formal risk framework, our CISSP study plan covers the identity and access management domain this maps directly to.