1Password

Make recovery part of setup. Individual and family members can generate a recovery code, but its use requires access to the account email and results in a new Secret Key and account password. Family organizers and authorized team administrators can help recover other members' accounts; teams should assign more than one person that responsibility. Recovery routes differ by account type, so store the right materials securely before relying on the vault.

Decide which secrets should be personal, shared within a vault or sent through a temporary link. In an organization, vault permissions control viewing and editing separately from managing access; a person who can manage a vault does not automatically gain permission to read its items. Review external-sharing policy, membership changes and audit needs before rollout.

Test the websites, browsers and devices that matter to you. Autofill and passkeys depend on compatible destinations, while Watchtower flags issues rather than fixing them automatically. Review plan-specific administration, sharing and recovery terms, then confirm the current charge after any introductory promotion. The profile describes vendor-documented features, not a security audit or a guarantee that every account is protected.

Share deliberately. Families can use shared vaults; 1Password also describes expiring links for sharing individual items with people who do not have an account. Business and team administrators can grant vault permissions to people or groups. Review the recipient and the permission before sharing a sensitive item.

Review security alerts. Watchtower highlights saved items with compromised, weak or reused passwords and other security issues, including sites that support stronger sign-in options. Its findings tell a person what may need attention; the person still has to change credentials or settings at the affected service. Business offers organizational Watchtower reporting for shared vaults.

Manage work access. Business documents granular permissions for viewing, editing, exporting and sharing vault items, with controls assigned by person, group and vault. It also supports integrations with identity providers and reports on use. These controls require an administrator to configure roles and recovery responsibility for the organization's actual structure.

Limit what travels on a device. Travel Mode removes vaults that are not marked safe for travel from the apps and browser extension when the device is opened and connected. It is included with subscriptions, with team control available in Business. The vendor cautions that an unlocked browser extension can still lead to 1Password.com, where Travel Mode can be turned off; treat it as a planned device-access measure, not a guarantee against inspection.

Plan a 1Password migration before creating a desktop export. In 1Password 8, desktop 1PUX or limited CSV files are unencrypted; do not email or store the export online, and delete it when finished. CSV carries only Login and Password items, while desktop export currently does not export passkeys. If passkeys matter, confirm that a supported iOS or Android Credential Exchange path works with your destination, or plan to create replacement passkeys at the relevant sites.

Before using a 1Password item link for a credential handoff, test with a harmless item. The Help article says a unique link shares a separate copy without password history; later edits to the original do not update that copy. Choose the recipient and link lifetime carefully, then rehearse stopping an old share and sending a fresh link after a change. If the credential itself needs retiring, change it at the underlying service.

Plan a Families member's move before removing their account. A family organizer can suspend access temporarily or remove the member. Removal ends that person's access to shared items; the person then has 30 days to sign in on 1Password.com and move personal items to a new account. Unshared personal items left after that window are permanently deleted. Before removal, make sure the member has their Secret Key and account password and plan the transfer of needed personal items during that 30-day window.

For a Teams or Business staff exit, inventory work credentials in the person's Employee vault before deleting their account. This vault is not directly shared with teammates, and 1Password warns that deletion permanently removes items left there. Have the member move needed work items into an authorized shared company vault and verify them before suspension, then rotate shared passwords and tokens they could access. If the member has already left, the vendor describes account recovery by someone with recovery permission and access to the member's email; plan that contingency before deletion.

Choose Archive for a 1Password item you want out of everyday use but may need again: the vendor says archived items leave ordinary search and autofill suggestions and can be restored later. Deleting an item instead puts it in Recently Deleted for 30 days, with permanent destruction possible sooner. In a shared vault, check the assigned archive, delete and restore permissions, then try both paths with a harmless item before using them for important credentials.

If a 1Password Business team uses Unlock with SSO, rehearse access during an identity-provider or Internet outage on each device type. Normal SSO app unlock needs a connection. An administrator can enable biometric unlock for a limited offline period on supported devices when prior SSO credentials remain cached; devices without biometrics cannot use that route. Offline unlock is unavailable in the browser, and Windows without a TPM or Linux needs Internet again after quitting and restarting the app. Test lock, restart and browser cases with a non-sensitive account before relying on SSO during an outage.

For a contractor's 1Password access, check whether a guest account's single-vault limit fits the work. A team owner or administrator can invite the guest, who must accept and be confirmed before a vault is shared. Organization guests have no Employee vault and can access only one vault at a time; consider member promotion if they need an Employee vault or several shared vaults. Check the selected plan's included allowance, maximum guest count and extra-guest costs. Rehearse vault permissions with harmless items and plan credential changes at offboarding: the vendor warns that guests may have copied items before access was removed.

During 1Password team offboarding, a suspended or deleted member may still access items on an offline device until their next attempt to unlock while connected. Local data removal also requires the app to be unlocked and online. Plan around that delay: rotate shared passwords and tokens the person could access, and check the connected and offline cases with an authorized test account and device. Treat the account action and device cleanup as separate checks.

Before treating 1Password as an undo button for a team password change, separate its two history views. View password history is available for Login and Password items; password fields in other item types require opening a prior item version. In the desktop app or on 1Password.com, a permitted user can select a previous item version and Restore Item, after which other versions remain in the history. For an organization vault, the vendor says restoration requires Edit Items or View Item History permission; check the specific vault and account role. Have an authorized teammate rehearse a harmless edit and restoration, then check the service separately. Restoring a vault item's old value does not roll back a password change at the website.

Before choosing a lock timeout for a 1Password rollout, map every app, browser extension and 1Password.com session the team uses. Unlock and auto-lock choices are not synced between devices, and the web app can have a different timer in each browser. Check whether an extension is integrated with the desktop app, since that changes where its lock settings are managed. 1Password Business can enforce settings across desktop, mobile, web and extension for business accounts, but its current Linux policy enforces auto-lock only; 1Password policy also takes precedence over mobile device management settings. Have an authorized administrator compare fictional idle and device-lock scenarios on each required platform, then verify the selected plan, policy rights and actual behavior with harmless data before rollout.