Feature Request: Passkey-first sign-in and Watchtower checks for weak authentication and recovery paths

Hi 1Password team and community,

I'd like to suggest two related improvements to 1Password and Watchtower, motivated by a growing security concern here in Japan.

Background: Protecting accounts when personal information has already been compromised

Japan has recently experienced a series of large-scale personal data breaches.

For example:

• Times Car / Park24  reported that approximately 1.46 million encrypted identity-document images, including driver's licenses, showed evidence of exfiltration. The company noted that this does not necessarily mean the contents were readable by attackers.
• Sourcenext , which distributes 1Password in Japan, reported a breach potentially affecting approximately 22.5 million member records, with passwords among the potentially exposed data fields. Fortunately, 1Password vault data was not involved.

These incidents made me reconsider an assumption behind account security: Can we still rely on personal information as proof of identity when so much of it may already be compromised?

Even if we use strong, unique passwords and passkeys, attackers may attempt to exploit weaker account recovery procedures, SMS-based verification, or identity verification processes.

I'm not suggesting that these particular breaches have already led to such attacks. My concern is that leaked personal information could make targeted impersonation and account recovery abuse more practical.

This brings me to two feature requests.

1. Prefer passkeys when both passkeys and passwords are available

When a passkey is already saved for a website, I'd like 1Password to make it the preferred sign-in option wherever the website's login flow allows it.

I found a related earlier request:

Feature request: Disable password autofill when passkey present 

I agree with the general intention, although I don't necessarily want password autofill to be completely disabled.

Instead, I'd prefer a passkey-first experience, where:

• Passkey sign-in is presented prominently when available.
• Password-based sign-in remains accessible when needed.
• Users are less likely to submit a password unnecessarily when they already have a working passkey.

Even when websites still support passwords, 1Password could help users consistently choose the more phishing-resistant authentication method.

2. Extend Watchtower to identify weaker authentication and account recovery paths

This is the more important request from a security perspective.

Watchtower already helps users identify compromised passwords, reused passwords, and websites supporting passkeys and MFA.

However, having a passkey does not necessarily mean an account is fully protected by passkey-level security.

Many websites still allow traditional password-based login after passkey enrollment. Some may also permit account recovery through SMS, email, or other methods that could potentially be abused.

I'd love to see Watchtower provide an additional security assessment covering these alternative paths.

For example, Watchtower could help users identify:

• Accounts with a passkey where password-based login may still be available.
• Accounts where SMS-based authentication or recovery may remain possible.
• Accounts that support disabling traditional password-based login.
• Accounts where stronger recovery methods are available.
• Accounts whose fallback or recovery security has not yet been verified.

I realize that 1Password cannot automatically determine every account-specific security setting from outside a website.

A realistic first step might be to use publicly documented authentication and recovery policies, combined with optional user-confirmed settings.

It would be important to distinguish between "known to be supported," "confirmed enabled for this account," and "unknown," rather than presenting uncertain information as a verified vulnerability.

Even a simple "Review fallback and recovery methods" category in Watchtower would be valuable.

Why I think this matters

Passkeys provide excellent protection against phishing and credential theft. But if an attacker can still gain access through a weaker alternative authentication or recovery process, the overall account security may be limited by that process.

I understand that account recovery is a difficult problem and that websites must balance security against the risk of locking legitimate users out.

I'm not asking 1Password to eliminate recovery mechanisms or block password authentication unconditionally.

Rather, I'd like 1Password to help users understand the actual security posture of their accounts and make informed choices about their available authentication and recovery methods.

As personal data breaches become increasingly common, we need security tools that help protect us even when our personal information can no longer be assumed private.

I believe Watchtower is particularly well positioned to help with this.

Thank you for considering these suggestions. I'd be interested to hear whether something along these lines has already been discussed or considered by the team and members.