1Password

This guide gets you from "I have passwords scattered across a browser, a notes file and my memory" to a clean, single vault that fills every login on demand and shares access to your team without anyone emailing a credential again. It is for anyone running more than a handful of accounts who wants password hygiene to be automatic, and for small teams who need to hand out access as a structure rather than a favour. By the end you will have 1Password set up the right way, the daily workflow running without friction, and the power features that turn it from a password box into the spine of how you manage secrets.

Getting set up

The first decision is the account type, and it matters more than people expect. A personal account protects your vault with a master password plus a separate account key, so even 1Password cannot read your data. A team or business account adds shared vaults, admin controls and provisioning, and it changes how you think: access becomes something you grant and revoke centrally, not something locked in one person's head. If you run anything resembling a company, start on the business tier even as a solo operator, because retrofitting team structure later is more painful than starting with it.

Once the account exists, install everywhere you actually work: the desktop app, the browser extension, and the mobile app. The browser extension is the piece that earns its keep daily, so do not skip it and rely on copy-paste. Turn on biometric unlock (Touch ID, Face ID, Windows Hello) so unlocking is a fingerprint rather than a re-typed passphrase, and you stop being tempted to weaken the master password just to type it less.

Save your Emergency Kit, the document holding your account key, somewhere genuinely safe and offline. If you lose the account key on a personal plan, nobody recovers your vault, which is the point of the design and also the one way to lock yourself out permanently. Treat that piece of paper as seriously as a passport.

Before you import anything, plan your vaults. Vaults are the unit of sharing, so decide the structure up front: a Private vault for you alone, a shared household or team vault for things others need, and separate vaults for anything with a different access boundary (client work, finance, infrastructure). Then import your existing passwords (from a browser or another manager), and run the built-in audit to find the reused and weak ones.

How to actually use it

The order that delivers value fastest is import, then clean, then live in it.

Start by importing every credential you can find, including the ones rotting in your browser. Then open the security audit (1Password calls it Watchtower) and work the list: reused passwords first, because one breach there exposes several accounts, then weak passwords, then any flagged in a known breach. For each one, visit the site, change the password, and let 1Password generate a long unique replacement. You are not trying to fix everything in a day; you are trying to kill the reuse that turns one leak into many.

Once the vault is clean, change your habit: never type a password again. When you sign up for something new, let the extension suggest and save a generated password. When you log in, let it fill. When the browser offers to save a password, decline and let 1Password capture it instead, so you keep one source of truth rather than two half-full ones.

Then push past passwords. Store the things you currently keep in a notes app or a drawer: card details for faster checkout, secure notes for licences and recovery codes, identities for forms, and software keys. The more of your sensitive small data lives here, the more the single-vault habit actually holds.

Power moves

The feature that separates a pro is sharing through vaults, not through messages. When a teammate needs access to an account, you add the item to a shared vault and grant them the vault, and when they leave you revoke it in one place. Nobody ever pastes a password into a chat again, and offboarding stops being a frantic password-reset spree.

Turn on the one-time-password feature so 1Password stores your two-factor codes alongside the login and fills both together. This sounds like putting all your eggs in one basket, and it is a real trade-off, but for most accounts the convenience that makes you actually use unique passwords outweighs the theoretical loss, with your truly critical accounts kept on a separate hardware key.

For sharing outside your team, use the secure-link feature instead of email: it creates a link that expires and can be limited to specific recipients, so a one-off credential hand-off does not sit in someone's inbox forever.

If you build or operate software, 1Password reaches into developer territory: it stores SSH keys and can act as your SSH agent, it manages environment secrets, and it ships a command-line tool. That means a script can pull a secret at runtime from the vault rather than from a plaintext .env file, which is a genuine security upgrade for any real workflow.

Where it fits your stack

In a growth and ops stack, 1Password is the layer underneath everything that needs a login or a key. It plugs into the browser where most of your marketing and ops tools live, so every SaaS account fills automatically. On the team side, it integrates with identity providers for single sign-on and automated provisioning, so people get the right vaults when they join and lose them when they leave.

For the technical side of the stack it connects to the tools that hold secrets: the CLI feeds credentials into scripts and CI, the SSH agent handles server access, and secret references let an app read a key from the vault instead of from a committed file. The effect is that credentials stop being copied into a dozen places and start living in one place that the rest of your tooling reads from.

Pitfalls to avoid

The biggest mistake is a weak or memorable master password. Everything rests on it, so make it a long passphrase you can remember but nobody can guess, and never reuse it anywhere else.

The second is losing the account key. Save the Emergency Kit offline before you do anything else, because there is no reset button by design.

The third is half-adopting it: saving some passwords in 1Password and letting the browser keep the rest. Two sources of truth means you never trust either, and you fall back to old habits. Pick 1Password, turn off the browser's own password saving, and migrate fully.

The fourth, on teams, is dumping everything into one shared vault. That hands everyone access to everything and defeats the structure. Split vaults by access boundary from the start.

Finally, do not treat the audit as a one-time chore. New weak and breached passwords appear over time, so check Watchtower occasionally and keep the reuse count at zero.

INTERVIEW EWOUD: How do you structure your vaults across personal, business and client work, and what is the rule you use to decide which vault something goes in?

INTERVIEW EWOUD: Do you use the 1Password CLI or secret references in your agentic and ops workflows, and if so, what does that setup look like in practice?

INTERVIEW EWOUD: What is the one hard-won 1Password tip you would give someone setting it up for the first time?

1Password is a password and secrets manager that stores logins, passkeys, and other credentials in end-to-end encrypted vaults across desktop, mobile, and browser. Business tiers add admin controls, SSO unlock, SCIM provisioning, and a developer layer (CLI, SDKs, and a secrets-injection MCP server). It is aimed at individuals, families, and teams that need shared credential storage with centralised administration.

Lean B2B teams and founders needing shared, centrally managed credential and secrets storage

1Password is a password manager and secrets vault. It stores your logins, cards, secure notes, and software keys behind one master password (plus an account key on personal plans), then fills them on demand across your browser, phone, and desktop. The core promise is that you remember one strong passphrase and the app remembers everything else, encrypted, so each of your accounts can carry a long unique password you never have to type or recall.

Where it fits

The main use case is the obvious one: stop reusing passwords and stop storing them in a browser or a notes file. It covers individuals, families (shared vaults for the household logins), and teams, where the business tier adds admin controls, provisioning, and shared team vaults so credentials follow a structure rather than living in one person's head. It also reaches past plain passwords into things developers and operators care about, like SSH keys, environment secrets, and a command-line tool, so it can sit underneath a real workflow rather than only the browser.

It is genuinely for anyone who runs more than a handful of accounts and wants password hygiene to be automatic, and for small teams that need to share access without emailing credentials around. It is less the right fit if you want a fully self-hosted, offline-only vault you control end to end, since 1Password is a hosted, subscription product, or if you only ever use one device and a couple of logins, where the setup is more than you need.

The honest take

The strengths are real. The apps are polished and consistent across platforms, the browser autofill is reliable, and the security model is well regarded and clearly documented. Sharing through vaults is the feature that earns its keep on a team, because access becomes a structure you manage rather than a favour you do by message. The reach into SSH keys, secrets, and a CLI makes it useful well beyond consumer password storage.

The trade-offs are equally real. It is subscription-only, so this is an ongoing cost, not a one-time purchase, and there is no free personal tier in the way some rivals offer (it does run trials and has had free options for specific groups). You are trusting a hosted service with your most sensitive data, which is a deliberate choice some people will not want to make. And if you ever leave, exporting and migrating a full vault to another tool is workable but not effortless. None of this is disqualifying; it is the price of the convenience.

INTERVIEW EWOUD: What is your personal verdict on 1Password, and your rating out of five?

INTERVIEW EWOUD: Is 1Password in your own stack, and why or why not?

INTERVIEW EWOUD: What is the one line you would tell a peer who is deciding on it?