secrets management

1Password

1Password is a password manager with a developer platform. This profile covers what it does, how it is priced, and where it stops being the right choice.

What the product actually does

1Password stores credentials in an encrypted vault and syncs them between devices. The encryption model is the argument: the server holds ciphertext and the keys never leave the client, so a breach of the service does not expose the vaults.

The developer side is what distinguishes it from a consumer manager. The CLI and service accounts let a CI pipeline fetch a secret at build time, which is a materially better pattern than storing credentials in the pipeline's own configuration.

How pricing works once you are inside

Per user, per month, with business tiers that add administrative controls and reporting. The pricing is simple and does not have the module structure that makes identity providers hard to compare.

Service accounts for automation are included in the business tiers, which matters because automation accounts are what let a team remove secrets from source control entirely.

Where it breaks down

It is not a secrets manager in the infrastructure sense. There is no dynamic credential issuance, no lease and no automatic rotation tied to a database. A team that needs those has to pair it with something like Vault.

Shared vaults also degrade with size. An organisation that puts everything in one vault ends up with access that is broader than anyone intended.

What switching costs

Low to moderate. Vault items export, but the automation integrations and the access structure have to be rebuilt.

Sources

1Password public documentation and pricing page, read October 2026.