CITT

    Scan results

    1Password: Password Manager

    Android

    1Password is a trusted password manager app used by millions of people and over 175,000 businesses. It offers strong password generation, autofill, two-factor authentication support, passkey generation, and secure storage for passwords, credit cards, secure notes, and other sensitive information.

    CITT SCORE
    90
    out of 100
    TRUSTED

    Quick Verdict

    Best for: Anyone managing passwords across devices and teams

    What It Means For You

    Vault data stays on the device and is not sold or shared with advertisers. Sentry receives crash reports if the app encounters an error, and Google services handle push notifications and on-screen rendering. Passwords, notes, and payment details are not sent to third-party marketing or analytics platforms.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (16)

    Data Security

    5 total
    1 Medium
    4 Info

    Network Security

    2 total
    1 Medium
    1 Info

    Code Security

    6 total
    4 Low
    2 Info

    Privacy

    2 total
    1 Low
    1 Info

    Third-Party Risk

    1 total
    1 Info

    Third-Party Services

    Sentry, Firebase Cloud Messaging, Google Play Services, Google Places SDK, Google ML Kit Vision, Google Play Billing, Glide, Kolide MDM, Apollo GraphQL, Google Accompanist

    Security Strengths

    • ✓AES-256-GCM encryption with hardware-backed Android KeyStore and StrongBox HSM support
    • ✓Vault database encrypted entirely within native Rust core — zero Java-layer SQLite access
    • ✓Firebase Analytics explicitly disabled with no advertising or behavioral tracking SDKs
    • ✓Automatic clipboard clearing with configurable delay and user-triggered immediate clear
    • ✓Biometric key invalidation on enrollment changes with setUnlockedDeviceRequired enforcement
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    sensitive data
    password manager
    enterprise
    location
    financial

    Package

    com.onepassword.android

    Version

    8.11.18 (versionCode 81118036)

    Analysis Date

    Feb 17, 2026

    Classes Analyzed

    26,561

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Very Secure

    Key Findings

    Data Security - 5 findings (1 medium, 4 info)

    Network Security - 2 findings (1 medium, 1 info)

    Code Safety - 0 findings

    Privacy - 2 findings (1 low, 1 info)

    Privacy Concerns

    What Data is Collected

    1Password requests access to the device camera for scanning documents, the clipboard for copying and pasting saved items, and biometric sensors for unlocking the app.

    Third-Party Data Sharing

    The following third-party services receive limited operational data from this app:

    • Sentry - Receives anonymized crash reports when the app encounters a problem. Vault contents are not included.
    • Firebase Cloud Messaging - Handles push notifications for account alerts and sync events.
    • Google Play Services - Provides core Android device integration.
    • Google Places SDK - Supports location features for travel card display.
    • Google ML Kit Vision - Powers camera-based document and code scanning.
    • Google Play Billing - Manages in-app subscription and purchase flows.
    • Glide - Loads website logos and app icons displayed in the vault.
    • Kolide MDM - Provides device health checks for enterprise-managed deployments.
    • Apollo GraphQL - Handles structured data exchange with 1Password servers.
    • Google Accompanist - Supports on-screen layout and rendering.

    Stored passwords, secure notes, and payment details are not accessible to any of these services.

    Understanding the Scores

    CategoryScore
    Security92/100
    Privacy88/100
    Data Security95/100
    Network Security88/100
    Code Safety95/100
    Data Collection100/100
    Data Sharing100/100
    User Control100/100

    Positive Security Features

    • Vault contents are protected with strong local encryption, keeping stored items readable only to the account holder
    • Data sharing with third parties is limited to operational functions: crash reporting, push notifications, billing, and enterprise device health
    • Users retain complete control over their vault, including the ability to export or permanently delete data
    • The app earns top marks for data collection scope, data sharing restraint, and user control

    Areas for Improvement

    • Some network communication settings could be configured more strictly to provide stronger protection when using public or untrusted networks.
    • A small number of internal storage practices could be made more conservative to reduce the chance of sensitive metadata being retained longer than needed.

    About This Analysis

    This scorecard is produced through automated static analysis of the published Android package. Scores reflect the security and privacy posture of the code at the time of the scan.

    App Details

    • App: 1Password: Password Manager
    • Package ID: com.onepassword.android
    • Version: 8.11.18 (build 81118036)
    • Platform: Android
    • Scan Date: February 17, 2026

    Right of Reply

    Developer not yet contacted