In January, after several years away from 1Password, I resumed using it at work and also began migrating my family from Bitwarden to 1Password Families. I decided to move my family to 1Password because Bitwarden has gotten extraordinarily buggy. Based on past experience with 1Password, I thought it would be better.
I may have been wrong. Since I’ve resumed using 1Password, I’ve encountered a lot of significant issues. I initially kept a running tally of them in a Mastodon thread. However, since then I’ve decided to start auto-deleting my Mastodon posts after a year, so that thread is eventually going to disappear. I think my experience with 1Password is worth preserving for the benefit of anyone else who might be considering using 1Password and wants to know what they’re getting into. Therefore, I am back-filling the contents of that thread into this post, and moving forward if I encounter any additional issues I will record them both here and in that thread.
January 17, 2026
1Password’s SSO implementation, which we’re using at work to integrate 1Password login with Okta, is immature and has a lot of UX issues. Generally speaking, it does not appear to be particularly robust from a UX point of view (I have no reason to doubt it’s robustness security-wise.
For example: if you try to log into 1Password via SSO on a new device, it’s supposed to display a prompt on existing devices to approve the login. However, if you have a linked personal account that’s unlocked while your work account is locked, you won’t see the prompt or any instructions for how to retrieve it until it occurs to you to unlock your work account. This is shitty UX.
January 17, 2026
1Password is integrated with only one email masking service, Fastmail. In contrast, Bitwarden has integrations with numerous services, including the one I use, Addy.io. Until 1Password gets around to adding an integration with Addy.io (which I’m not holding my breath for; people have been asking for this for a while), I guess I have to use the separate Addy.io extension for this. Definitely not a great UX.
In contrast, Bitwarden supports integrations with a number of email masking services, including Addy.io.
January 17, 2026
There’s no way to tell the 1Password browser extension not to prompt to save passwords on a particular website. Again, I’m not holding my breath that they’re going to fix this any time soon because people have been asking for it for a long time. This is another area where 1Password lags behind Bitwarden.
January 17, 2026
Significant bug: the 1Password CLI allows you to retrieve items as JSON using the item title or unique ID. You’re supposed to be able to then edit it and upload the edited JSON via the CLI to save the changes. However, when you retrieve an item from your “Private” vault using its title instead of its ID, the resulting JSON file calls the vault “Personal” rather than “Private”, and then when you try to upload the changes the JSON is rejected because of the vault name mismatch.
January 21, 2026
1Password support says they are unable to reproduce this issue. I have responded with a Python script that demonstrates the issue by calling the 1Password CLI, along with the output I see when I run that script to show that I have described the behavior accurately.
January 17, 2026
The 1Password desktop app has robust export functionality, which I’m pretty sure is new since my last stint using 1Password.
Good for them for adding this! Data portability is important.
Unfortunately, it’s only available in the app, not in the browser extension or on the website.
More unfortunately (significant bug), it doesn’t appear to work on Linux. The export command is there, but when I enter my password and click the button to do the export, nothing happens.
It works fine on macOS.
January 21, 2026
As explained by 1Password support, this is because the 1Password app refuses to export data unless the kernel parameter kernel.yama.ptrace_scope is non-zero.
I don’t think individual apps should get to dictate the security settings I’m required to deploy across my entire computer, but if they insist on doing that, they need to tell the user that’s what’s wrong instead of failing silently, especially since many Linux distros set ptrace_scope to 0 by default.
January 17, 2026
Another bug:
The 1Password browser extension is supposed to integrate with the app, so that e.g. you can unlock the extension by unlocking the app and when you ask the extension to edit the item it opens it for editing in the app automatically.
This works fine for me on macOS. It does not work on Linux. Support claims it’s supposed to work but hasn’t yet told me how to fix it. We’ll see if/when they are able to address this. It should work out-of-the-box or tell the user why it’s not working.
January 21, 2026
As explained by 1Password support, this is because Vivaldi isn’t trusted by default by the 1Password app on Linux, so I have to go edit a custom config file to tell the app to trust it. It’s unclear why Vivaldi is trusted on macOS but not Linux. And, again, if this is the problem, then the extension or app should tell me this is the problem instead of just silently failing and forcing me to contact support for assistance.
January 17, 2026
When you change your 1Password password while the desktop app is locked, the next time you go to unlock it you need to enter your old password, but it doesn’t tell you this. Bitwarden’s behavior is superior and obviously correct: the Bitwarden app logs you out and requires you to log in with your new password.
If you don’t use the app for a long time and when you go to use it you can’t remember your old password, you have to reset the app using a reset button buried deep in the settings.
January 21, 2026
1Password support claims the behavior I saw here is not supposed to be that way and they were unable to reproduce the problem. Great, I’m happy for them. 🤷🤦
January 17, 2026
Similarly, when you change your 1Password password while the extension is locked, the next time you unlock it has to be with your old password. However, that’s not the end of it. At least for me, after I unlocked the extension with my old password, it immediately locked again and wouldn’t accept either my old or new password.
I had to turn off browser sync to not mess my other browsers, remove the extension, reinstall it, log back in, put all my settings back, and turn browser sync back on.
January 17, 2026
There is one vault in 1Password Families called “Shared” which is automatically accessible to all family members. It is impossible to create other vaults with that behavior. It should be, since vaults are not just used to manage permissions, they are also used to logically separate items. For example, I would like to be able to create a separate vault called “Streaming”, accessible to everyone in our family, with all of our streaming logins in it.
Can’t do it. Bad UX.
January 17, 2026
The 1Password desktop app seems to occasionally ask me to reauthenticate with two-factor authentication for no discernible reason.
Sometimes it asks me to do this twice in a row.
Sometimes when I change my password so I have to enter the new one into the desktop app, it prompts me for the password twice even though I entered it properly the first time.
January 20, 2026
Another significant bug (in my opinion): in the generator history, the browser extension does not actually remember all of the passwords and PIN codes you generate. It only remembers the ones that get copied or auto-filled into a web page. I generated a PIN code recently, then entered it into a phone call I was in the middle of to activate a new debit card, then went back to the generator to pull it out of the history to save it, and it wasn’t there. This is bad.
January 20, 2026
An annoying but minor functional issue: when the 1Password extension is locked and you click the 1Password icon to in a login field to autofill it, 1Password should automatically pop up an unlock prompt rather than just displaying a little notice that you need to unlock the extension, unnecessarily forcing the user to do the extra work of moving the mouse over to the extension icon and clicking on it. Bitwarden gets this right.
January 21, 2026
1Password support pointed out that when the browser extension is successfully integrated with the app and it’s locked, when you click on the 1Password icon in a form field the app automatically prompts you to unlock.
That’s nice, dear, but I want the extension to be user-friendly even when the user chooses not to use the app. It seems like pretty obvious UX that when the app isn’t available, the extension unlock prompt should pop up instead of the app unlock prompt.
Snark aside, credit where credit is due: 1Password’s technical support is and has always been good, and they deserve props for telling me how to solve the problems that there are solutions for and engaging with me in constructive discussion about the others. A lot of companies don’t do that anymore or never did.
(This doesn’t excuse the fact that there shouldn’t be so many problems that I need to contact them about, but that’s not technical support’s fault.)
February 9, 2026
Today I attempted to archive some old 1Password items in the browser extension in Vivaldi. I searched for the items I wanted to archive, selected each one, and selected the “Archive” menu command. Nothing appeared to happen. Each one should have disappeared from view as I archived it but they didn’t.
I tried archiving one of them again, and I got “an error occurred.”
I looked in the desktop app and found that some of them had been archived successfully and others hadn’t.
I archived the rest of them in the desktop app. They all continued to remain visible in the browser extension. I quit and restarted the browser and then they were finally no longer visible in the extension.
February 24, 2026
Today I noticed a Watchtower alert in the 1Password browser extension about two-factor authentication. I expanded the alert and it told me I could store 2FA info in 1Password for this site, and had an “Edit item” button to start doing that. The button should open the item for editing (as it says right there on the button), but when I click the button it does nothing. D’oh.
March 5, 2026
If you are using the 1Password app and browser extension, and the extension’s set to integrate with the app, and you tell the extension that you want to edit an item, it opens it in the app for editing.
However, if you already have another item open for editing in the app, that’s what you see, rather than the item you told the extension you wanted to edit.
You must close the item you have open for editing in the app and then tell the extension again what you want to edit.
This is poor UX.
March 5, 2026
If you have two 1Password accounts configured in the app, and one of them is locked, and you tell the browser extension that you want to unlock it, then it correctly opens the app to do the unlocking, but once you’ve unlocked the account in the app the extension pop-up still says that it’s locked. To make that go away you have to close and reopen the pop-up. More poor UX.
March 5, 2026
This is not good. As @case2tv reports there (if that post is still up when you read this), you can disable 1Password’s travel mode without needing to reauthenticate in any way, as long as the browser extension is unlocked. So, e.g., a border patrol agent can make you unlock your laptop and then turn off travel mode and get into all your vaults, even the ones not marked safe for travel.
@case2tv says he’s already reported this to 1Password; I’ve reported it as well.
March 13, 2026
1Password support says:
This behavior is expected. Travel Mode is meant to keep your selected vaults viewable to you but there isn’t a way to prevent users from accessing your data is your device has been compromised or handed over to someone. If you believe someone will ask you to unlock 1Password during your travels, I recommend removing the browser extension completely before you travel.
I write back:
This is nonsense. Here is what your webpage hyping Travel Mode says:
“If you regularly travel to far-flung destinations, you might be worried about the possibility of a customs or border official asking you to unlock your phone.”
“If a police officer or customs agent asks you to unlock your phone, they will only see the vaults you’ve marked as safe to travel.”
In other words, that page EXPLICITLY SAYS that the purpose of travel mode is to protect your sensitive vaults from people who get their hands on your devices even if they are still able to see your other vaults.
Your answer above directly contradicts what the referenced page says is the purpose of Travel Mode.
That page claims a level of protection which the feature simply does not provide.
I do not appreciate the prevarication.
1Password support sends back a much better response:
I can understand your frustrations as I too expressed my frustrations to our developers for the contradictions. I’m sorry for not including that in my original reply.
Everything that has been discussed internally is that Travel Mode is meant as a preventative for Vaults and not an end all method to protect your information from people who have access to your device through 1Password.com. Travel Mode was introduced long before “magic unlock” and its delegated session management. My team and I have let our developers know how magic unlock makes Travel Mode almost pointless when someone who has access to your device can turn off Travel Mode by simply navigating to 1Password.com.
I’m contacting our docs team to see if they can update the article you provided to mitigate any future confusion or frustration.
I write back:
If this had been your first answer then I would be a lot less cranky right now.
Having said that, it’s mind-boggling to me that 1Password would choose to “fix” this by updating the documentation vs. fixing the feature by requiring the user to reauthenticate before performing sensitive operations such as turning Travel Mode off.
March 5, 2026
When you create a 1Password account, an item containing your 1Password username, password, and secret key is created automatically in your private vault. When you change your password, this item is automatically updated with the new one.
I think this is dubious behavior security-wise—I don’t think this info should be stored in your vault unless you choose to put it there—but leaving that aside, this vault item is special in two other ways which I think are both wrong:
- The timestamp on this vault item is not correct. E.g., I changed my 1Password password last week, but the timestamp on the item says “Last edited Sunday, January 26, 2020 at 4:46:13 PM”.
- 1Password does not save historical versions of this item, unlike most items where you can see and revert to previous versions.
I don’t think there should be “magic” items in your vault that behave weirdly like this.
April 22, 2026
The #1Password app on #Linux has a configuration setting you can enable to tell it to start on login, and it works… sometimes. And sometimes it doesn’t, and you have to launch the app by hand after you log in.
(I’m running into this issue on GNOME on Debian Testing.)
I’ve reported the problem to 1Password. 🤷
(A workaround which seems to work most of the time is to edit ~/.config/autostart/1password.desktop, after you’ve enabled autostart in the 1Password app, and add the following line at the bottom: X-GNOME-Autostart-Delay=5. Note that you may have to redo the change each time the 1Password app updates.)
May 1, 2026
This is what happens in the 1Password web app when I click the “Manage access” button while viewing the contents of a vault.
Specifically, it pops up an incompletely rendered modal which is supposed to be the access management modal, and it stays there, incompletely rendered, forever. Sweet.
May 2, 2026
A 1Password employee replies to my Mastodon post about this: “Well that’s not right at all. So sorry about this, Jonathan. I will look into this and forward it on to the team.”
May 4, 2026
Another reply from 1Password on Mastodon: “Just following up on this one: we’ve also been able to reproduce this bug. We’ve filed a ticket for it and will look into it. Thanks for the report!”
August 3, 2026
I noticed today that this bug is fixed, though I have no idea exactly when between May 4 and today they fixed it.
August 2, 2026
Earlier I wrote about how on Linux if you don’t have the ptrace_scope kernel parameter set to 1, 1Password won’t let you export your data; any attempt to export silently fails.
It turns out the app also requires to have ptrace_scope set to 1 if you want to attach a file to a 1Password item. Again, when you attempt to do it without having ptrace_scope set, it fails completely silently with no explanation of what’s wrong or what to do about it.
This is shitty UX.
August 2, 2026
I ran into a situation where an item I added to my vault via the desktop app was visible on the computer where I added it, and was visible in the app on a diffferent computer, but wasn’t visible in the web app several minutes after I’d added it. It magically showed up in the web app eventually without my doing anything to provoke that.
This is not ideal.
