1Password extension breaks Bitwarden passkey support

Forum|Forum|2 months ago
June 14, 2026
6 replies
104 views

Hi,

I'm currently using both Bitwarden and 1Password in Firefox for various reasons. I have passkeys disabled in the 1Password Firefox extension settings, and this setup used to work quite well for the past year or so.

However, recently something must have changed: When the 1Password extension is enabled (even with passkeys disabled), Bitwarden apparently does not get the chance to register its passkey handler anymore, and every request falls through to the browser/OS default implementation (macOS in my case).

There's a theory being discussed in https://github.com/bitwarden/clients/issues/20973, according to which 1Password has recently started preventing overrides of the navigator.credentials.get/create APIs. I can't speak to the accuracy of that, but if this is true, I'd consider it a pretty aggressive approach:

At the very least, disabling the "offer to sign in with passkeys" option in 1Password should disable this new "blocking shim" behavior, as there is absolutely no reason for it in that scenario.

Beyond that, I'm also not sure that preventing other API shims from being installed is justified in the first place: Couldn't 1Password instead offer similar UX to Bitwarden, i.e. always show a blocking pop-up with an option to select a passkey (if any) or to defer to the next implementation in the chain, whether that's the browser/OS implementation or another password manager shim? This doesn't leak any passkey presence information either and seems less aggressive than just locking out the competition.

Passkeys

Pinned Reply By 1P_Dave

Hello folks,

Our development has released a fix for this issue, please update to the latest version of 1Password in the browser: How to keep 1Password up to date in your browser

While 1Password isn’t generally designed to be used alongside other password managers in the same browser, and doing so may lead to unexpected behaviour, the previously reported issue should no longer occur.

-Dave

0

0xadde

It’s clear 1Password is preventing other Password Managers from being able to fill in Passkeys. I’m just wondering why? Is there a security consideration behind this?

It would be awesome to hear the reason behind this so the community becomes aware of the limitations of this technology and move forward towards a solution.

If this on the other hand was done to harm the competition, it’s actually harming the Passkey ecosystem by making it unstable. E.g.: User is using 1Password on PC but also another Password Manager that they have on a phone as well. User registers Passkey on the phone hoping to get it synced on PC too. Passkey syncs to the PC, but its usage is blocked by 1Password in the PC’s browser. This makes Passkeys unreliable.

Edge DevTools showing warnings that the JavaScript methods used to fill Passkeys can’t be hooked by other Password Managers (in this case Bitwarden) while 1Password is enabled. Also shown that the code is part of a script injected by the 1Password browser extension.

1P_Dave

1Password Employee

Hello @lxgr and @0xadde! 👋

Thanks for reporting this! This is something our developers are already aware of. While 1Password isn't generally designed to run alongside other password managers in the same browser, it makes sense to hand off passkey requests to another manager when passkey saving and filling is turned off in 1Password.

I've added both of your comments to the internal bug report, and a fix is currently in the works for a future update to 1Password in the browser.

-Dave

L

lister

As a first step, it would be enough for 1Password to stop overriding navigator.credentials.create when the passkey feature is disabled in the settings. That would be an ideal quick fix.

I also noticed that this does not happen consistently. On https://www.passkeys.io/, Bitwarden works correctly even when 1Password is enabled. However, on https://github.com, the following warnings appear in the console:

Cannot overwrite navigator.credentials.create method while 1Password is enabled <anonymous code>:5:13731
Cannot overwrite navigator.credentials.get method while 1Password is enabled <anonymous code>:5:13731

After that, Bitwarden does not appear.

When 1Password is enabled, GitHub even displays the following message above the passkey button (in librewolf): "This browser or device is reporting partial passkey support."

1P_Gem

1Password Employee

Hi @lister, thanks for your suggestion. I’ve added your report and the details you’ve provided to the internal tracker for the issue for our developers to see.

0

0xadde

Seems 1Password browser extension was updated to prevent overwriting navigator.credentials.get when “Offer to sign in with passkeys” is disabled in the extension settings.

1P_Dave

1Password Employee

Hello folks,

Our development has released a fix for this issue, please update to the latest version of 1Password in the browser: How to keep 1Password up to date in your browser

While 1Password isn’t generally designed to be used alongside other password managers in the same browser, and doing so may lead to unexpected behaviour, the previously reported issue should no longer occur.

-Dave

Sign up

1Password employees: Sign in with SSO

Login to the community

1Password employees: Sign in with SSO