Install with Homebrew
brew install --cask 1password
1Password — Official Website
Quick Take: 1Password
In August 2026, 1Password remains the best password manager for Mac developers and security-conscious professionals. Dual-key encryption, SSH agent, CLI Environments, Watchtower, Travel Mode, and new AI-safe credential handoff (MCP + Claude) keep it ahead of free rivals. The family plan is still strong value. Criticisms are honest: no free tier, Electron weight versus 1Password 7, and 2026 price bumps on Teams and Business. If you live in secrets, SSH keys, and shared vaults, it is still security infrastructure — not just a password box.
Best For
- •Developers who need SSH agent, CLI secret references, and MCP-safe agent logins
- •Families who want shared vaults with recovery without five separate tools
- •Business travelers who rely on Travel Mode at borders
- •Teams that need SSO, SCIM, and admin Watchtower
- •Professionals who refuse to trust master-password-only cloud vaults
What is 1Password?
1Password is a password manager from AgileBits that stores passwords, API keys, credit cards, SSH keys, passkeys, and secure notes in encrypted vaults. You remember one master password; 1Password remembers everything else. On Mac it remains the professional default for people who outgrew Apple Passwords and need cross-platform vaults, developer tooling, and family or team sharing. What still separates 1Password from most competitors is its dual-key security model. Your data is encrypted with two secrets: your master password and a 128-bit Secret Key created when you open the account. Both are required to decrypt, and neither is stored on 1Password's servers. Even a server breach leaves attackers with ciphertext they cannot usefully attack without your Secret Key. That architecture is why security-conscious developers and agencies still pay for it. For developers, 1Password is no longer just a password app. The SSH agent stores keys in the vault and signs Git commits without leaving private keys on disk. The CLI (op) and secret references inject vault values into shell commands, Docker, and CI. Developer Watchtower now scans local .env files and SSH material for plaintext secrets. In summer 2026 the Mac app also shipped a local MCP server so AI assistants can use 1Password developer tools without holding raw credentials, plus a Claude integration that lets the agent use logins and one-time codes under biometric approval without ever seeing the password. 1Password 8 (currently the 8.12.x line on Mac as of late July 2026) is still Electron-based — the main long-running complaint from people who loved the native 1Password 7. AgileBits has optimized it for Apple Silicon and macOS Tahoe 26.x, added Dark Mode icons for Tahoe, and brought native macOS AutoFill into public beta via Apple's Passwords API on Apple silicon Macs running macOS 14+. It is heavier than a pure AppKit app, but on M-series machines it is fast enough for daily work. Pricing as of August 2026 (USD, annual billing): Individual is about $3.99/month at regular rate (~$47.88/year; new-customer first-year promos often show $2.99/month), Families about $5.99/month regular for five people (promos near $4.49), Teams Starter Pack $24.95/month flat for up to 10 users, and Business $8.99 per user/month. There is still no permanent free tier — only a 14-day trial. Bitwarden remains the free alternative; Apple Passwords is free inside Apple's ecosystem. 1Password's polish, SSH/CLI stack, Travel Mode, Watchtower, and AI-agent credential handoff justify the fee for most professional Mac users.
Deep Dive: 1Password for Developers
How 1Password evolved from a password manager into developer security infrastructure.
History & Background
1Password launched in 2006 as a Mac-only password manager and spent a decade as the polished consumer alternative to LastPass. The developer pivot accelerated around 2021 with the SSH agent and CLI. By 2026 the product is security infrastructure for engineering teams: secret references, Connect, Environments, MCP for AI agents, and Watchtower for both humans and local secret sprawl.
How It Works
The security model centers on zero-knowledge encryption. Your vault is encrypted with a key derived from your master password + Secret Key using PBKDF2 with 650,000 iterations (as of 2026). The encrypted data syncs to 1Password's servers, but the decryption keys never leave your devices. The SSH agent runs as a local process that holds decrypted keys in memory (never on disk) and presents them to SSH clients when you approve via Touch ID. The CLI resolves secret references by contacting the local 1Password app (or Connect server) at runtime, injecting plaintext values into the environment only for the duration of the command.
Ecosystem & Integrations
1Password integrates with the developer toolchain at multiple points. The SSH agent works with any SSH client, including git. The CLI integrates with shell scripts, Docker, and orchestration tools. Connect provides an API for CI/CD systems (GitHub Actions, GitLab CI, Jenkins). VS Code and JetBrains plugins offer in-editor secret lookups. Tower (Git GUI) integrates with 1Password's SSH agent natively. The Terraform provider manages 1Password items as infrastructure-as-code.
Future Development
Through 2026 AgileBits has pushed developer and agent-safe access: MCP server, Claude integration, Developer Watchtower .env scanning, native macOS AutoFill beta, and Tahoe UI polish. Expect continued investment in passkeys, identity provider depth for Business, and performance work on the Electron shell rather than a full native rewrite.
Key Features
Watchtower and Developer Watchtower
Watchtower continuously flags weak, reused, and breached credentials (checked against known breach datasets), accounts missing two-factor authentication, and sites that support passkeys. Developer Watchtower extends that idea to local developer risk: it scans for plaintext secrets in .env files and SSH material and surfaces remediation paths. Critical items can jump you into a generated replacement password flow on the site itself.
SSH Agent and Git commit signing
1Password can act as your SSH agent. Store SSH keys in a vault and present them only after Touch ID or master-password approval. Keys are decrypted in memory when needed and do not sit as plaintext files under ~/.ssh. The same mechanism supports Git commit signing. Per-host key selection is configured in agent.toml so production and personal keys stay separated.
CLI, secret references, and Environments
The op CLI reads vault items from the terminal. Secret references such as op://Development/PostgreSQL/url let config files store vault paths instead of plaintext. op run resolves those references at runtime. 1Password Environments and Connect cover local mounts and CI/CD so pipelines fetch secrets without baking them into repos.
Local MCP server and AI assistant integrations
Shipped in the 8.12 line in 2026, a local MCP server in the Developer tab lets AI assistants use 1Password developer tooling without holding vault keys. Companion integrations (including Claude support announced mid-July 2026) allow agents to use logins and one-time codes under biometric gates; credentials are not exposed to the model. This is the practical answer to "how do agents log in safely on a Mac?"
Native macOS AutoFill and Universal Autofill
Beyond the browser extension, 1Password for Mac beta integrated with Apple's native Passwords API so it can act as a system-level Credential Provider on Apple silicon (macOS 14+). Universal Autofill fills native app prompts and HTTP authentication dialogs. Phishing resistance remains URL-bound: credentials only fill when the host matches what you saved.
Passkeys and Travel Mode
1Password creates, stores, and syncs passkeys across devices with Touch ID / Face ID unlock. Travel Mode is still unique: from 1password.com you mark vaults Safe for Travel, then remove everything else from devices before a border crossing. Data is not merely hidden — it leaves the device until you turn Travel Mode off and re-sync.
Family sharing and recovery
The Families plan covers up to five people with shared vaults for household logins while personal vaults stay private. Organizers can recover member accounts when a master password is forgotten. Individual items can be shared via expiring secure links to people who do not run 1Password.
Business controls and SSO
Business adds custom groups and roles, vault policies, activity logs, SCIM provisioning, and SSO with providers such as Okta, Entra ID, OneLogin, and Duo. Admins get Watchtower posture without reading passwords. Many seats include a free Families plan for personal use.
Who Should Use 1Password?
1The Developer
A backend developer stores SSH keys, API tokens, database credentials, and service account passwords in 1Password. Their SSH agent is configured to use 1Password, so `git push` authenticates via Touch ID — no key files on disk. Development environment secrets use `op run` with secret references, so .env files contain vault paths instead of plaintext credentials. When they onboard a new team member, the team lead shares the development vault — instant access to all development credentials without sending passwords over Slack.
2The Family Manager
A parent manages passwords for a family of four. A shared 'Household' vault contains streaming services, Wi-Fi passwords, utility account logins, and the school portal. Each family member has a personal vault for their own accounts. When their teenager forgets a password, the parent can help through the family recovery feature. The parent's Watchtower catches that their partner is reusing the same password on 12 sites and helps them fix it. Total cost: $5.99/month for the whole family.
3The Business Traveler
A consultant who crosses international borders frequently carries a laptop with client credentials, internal tools, and sensitive documents. Before each trip, they enable Travel Mode. All vaults except 'Travel Safe' (containing airline logins and hotel credentials) are removed from their devices. If their laptop is inspected at customs, there's nothing sensitive to find. After clearing customs, they turn off Travel Mode and everything syncs back within minutes.
How to Install 1Password on Mac
1Password installs via Homebrew, direct download from 1password.com, or the Mac App Store.
Install via Homebrew
Run: brew install --cask 1password. This installs the 1Password desktop app. For the CLI, also run: brew install 1password-cli.
Create or Sign In to Your Account
Open 1Password. Either create a new account (you'll get a Secret Key — save your Emergency Kit immediately) or sign in with your existing account's email, Secret Key, and master password.
Install the Browser Extension
Go to 1Password > Settings > Browsers and install the extension for Safari, Chrome, or Firefox. The extension connects to the desktop app for authentication — unlock the app with Touch ID, and the extension unlocks too.
Enable Touch ID
1Password > Settings > Security > Touch ID. This lets you unlock with your fingerprint instead of typing your master password every time. You'll still need the master password after a restart or after 14 days.
Pro Tips
- • Print your Emergency Kit (contains your Secret Key) and store it somewhere physically secure. If you lose your Secret Key and all your devices, your data is unrecoverable.
- • Install the CLI (brew install 1password-cli) if you're a developer — the
opcommand and SSH agent features are worth setting up. - • Enable 'Integrate with 1Password CLI' in the desktop app settings to link the CLI to the desktop app for biometric authentication.
- • Import from your old password manager (LastPass, Bitwarden, Chrome) using 1Password's import tool: 1Password > File > Import.
Configuration Tips
Set Up the SSH Agent
1Password > Settings > Developer > SSH Agent: turn it on. Add your SSH keys to your vault (or let 1Password generate new ones). Add IdentityAgent "~/Library/Group Containers/2BUA8C4S2C.com.1password/t/agent.sock" to your ~/.ssh/config. Now ssh and git commands authenticate through 1Password with Touch ID. No more key files on disk.
Configure Secret References for Development
Instead of .env files with plaintext secrets, use 1Password secret references. Create a .env file with entries like DATABASE_URL=op://Development/PostgreSQL/url. Run your app with op run -- npm start. 1Password resolves the references at runtime. Share the .env file freely — it contains vault paths, not secrets.
Set Up Travel Mode Vaults
Before your first trip, go to 1Password.com > Vaults. Mark each vault as 'Safe for Travel' or not. Create a 'Travel' vault for airline, hotel, and transit credentials. When you toggle Travel Mode on, only 'Safe for Travel' vaults remain on your devices. Practice this once at home before relying on it at a border.
Customize Watchtower Alerts
1Password > Watchtower shows your security score. Address critical items first: compromised passwords (found in breaches), then reused passwords, then weak passwords. Enable passkeys on sites that support them — Watchtower identifies these. Set a quarterly reminder to check Watchtower and clean up flagged items.
Alternatives to 1Password
1Password competes with free ecosystem managers, open-source vaults, and enterprise identity suites. Choose based on price, developer depth, and platform mix.
Bitwarden
Open-source with a genuine free tier for unlimited passwords and devices. Premium is cheap (~$10/year historically for individuals). Choose Bitwarden if budget and self-hosting matter more than 1Password's SSH agent polish, Travel Mode, and AI-agent credential handoff.
Apple Passwords
Free, built into macOS and iOS, and strong for Safari-only Apple households with passkeys. Weak for Windows/Linux, team vaults, SSH agent workflows, and non-password secrets. Many Mac users run both: Passwords for casual sites, 1Password for work.
Dashlane
Similar consumer feature set with dark-web monitoring and a VPN add-on. 1Password usually wins for developers and families who care about Secret Key architecture, CLI/MCP tooling, and Travel Mode.
Proton Pass
Privacy-branded option inside the Proton suite with free and paid tiers. Attractive if you already pay for Proton Mail/VPN; thinner developer integrations than 1Password on Mac.
Pricing
As of August 2026 (USD). Individual: $3.99/month billed annually (~$47.88/year; promotional first-year annual pricing for new customers often shows $2.99/month). Families: $5.99/month billed annually for up to 5 members (promotional first-year rates often near $4.49/month). Teams Starter Pack: $24.95/month flat for up to 10 users (raised from the older $19.95 rate). Business: $8.99 per user/month billed annually, with SSO, SCIM, SIEM-oriented integrations, and admin Watchtower. Enterprise and MSP editions are quote-based. Every plan includes a 14-day free trial. There is no permanent free tier. Official FAQ still quotes roughly $48/year individual and $72/year family as the regular annual framing.
Pros
- ✓Dual-key encryption (master password + Secret Key) remains best-in-class architecture
- ✓SSH agent, CLI secret references, Environments, and local MCP cover modern developer and AI-agent workflows
- ✓Watchtower plus Developer Watchtower catch breaches, weak reuse, and local plaintext secrets
- ✓Travel Mode uniquely removes sensitive vaults from devices at borders
- ✓Native macOS AutoFill beta and Universal Autofill improve system-wide filling on Apple silicon
- ✓Family plan still excellent value for shared household vaults with recovery
- ✓Passkeys, CTAP2 authenticators, and expiry alerts keep authentication modern
- ✓Business SSO/SCIM and free Families perk scale cleanly for teams
Cons
- ✗No permanent free tier — Bitwarden and Apple Passwords undercut on price
- ✗1Password 8 remains Electron-based and heavier than the old native 1Password 7
- ✗Losing the Secret Key without a logged-in device means permanent data loss
- ✗Teams Starter Pack and Business prices rose in 2026 ($24.95 flat / $8.99 seat)
- ✗Support is email and community oriented — no phone support for most plans
Community & Support
1Password has an active community forum (1password.community) where users ask questions and AgileBits staff respond directly. The developer documentation at developer.1password.com is thorough, covering SSH agent setup, CLI usage, Connect server deployment, and secret reference syntax. Support is email-based with a 24/7 chatbot for common questions; there's no phone support. The subreddit r/1Password is active but smaller than competing password manager communities. AgileBits publishes a security blog and participates in regular third-party security audits. The company's track record on security is clean — no breaches, transparent about their architecture, and responsive to security researchers.
Video Tutorials
Getting Started with 1Password
More Tutorials
How to use 1Password 2026 | The Only 1Password Tutorial & Review You’ll Need! 🔥
VPNpro • 48.1K views
1Password Tutorial (2025) | Step-by-Step Beginners Guide
MinorCo • 25.7K views
Use the 1Password extension to save and fill passwords on your Mac
1Password • 93.2K views
Frequently Asked Questions about 1Password
About the Author
Expert Tips for 1Password
Mac power users increasingly care that AI agents can complete browser tasks without clipboard password pasting; 1Password's Claude and MCP work is the differentiator Bitwarden has not matched on macOS yet.
Teams that budgeted $19.95 for the Starter Pack need to re-forecast at $24.95 — the July 2026 increase is real and shows up on renewals, not just new carts.
Native AutoFill beta still needs Apple silicon and macOS 14+; Intel Mac holdouts should keep the browser extension as their primary fill path.
Related Technologies & Concepts
Related Topics
Developer Security Tools
Tools for managing secrets, SSH keys, and credentials in development workflows.
Sources & References
Fact-CheckedLast verified: Aug 9, 2026
Key Verified Facts
- 1Password Individual regular annual pricing is about $3.99/month (~$48/year) with common new-customer promos at $2.99/month.[cite-1, cite-2]
- Teams Starter Pack is $24.95/month flat for up to 10 users and Business is $8.99 per user/month as of 2026.[cite-3]
- 1Password for Mac 8.12 adds a local MCP server so AI assistants can access developer tools from the Developer tab.[cite-4]
- 1Password added Claude support so the AI can use logins and one-time codes without seeing the password.[cite-5]
- Native macOS AutoFill via Apple's Passwords API entered public beta on Apple silicon (macOS 14+) in May 2026.[cite-6]
- 11Password Personal Pricing
Accessed Aug 9, 2026
"Individual and Families monthly prices with annual billing and 14-day trial."
- 21Password Pricing Guide 2026
Accessed Aug 9, 2026
"Summarizes Individual $2.99 promo / $3.99 regular and Families $4.49 promo tiers."
- 31Password Business Pricing
Accessed Aug 9, 2026
"Teams Starter Pack $24.95/month and Business $8.99 per user/month."
- 41Password for Mac Release Notes
Accessed Aug 9, 2026
"8.12.x notes covering local MCP server, CTAP2, and developer tooling."
- 51Password for Claude Integration
Accessed Aug 9, 2026
"Claude can use 1Password logins and OTPs without seeing passwords."
- 6May 2026 1Password Announcements
Accessed Aug 9, 2026
"Native macOS AutoFill beta using Apple Passwords API on Apple silicon."
- 71Password Travel Mode Documentation
Accessed Aug 9, 2026
"Official Travel Mode behavior for removing non-safe vaults from devices."
- 81Password Security White Paper
Accessed Aug 9, 2026
"Documents dual-key encryption with master password and Secret Key."
Research queries: 1Password pricing 2026 Individual Families Business; 1Password Mac 8.12 MCP Claude AutoFill 2026; 1Password vs Bitwarden Apple Passwords 2026