Skip to main content
R
Roger
December 5, 2025
Solved

Items moved between vaults leave a copy in Recently Deleted

  • December 5, 2025
  • 2 replies
  • 119 views

Even a simple solution like a popup message stating that the item was persisted in "Recently Deleted" would go a long way towards addressing this with very little developer effort.

It is amazing that unknown password leaks are not a priority. Then again, how could it be a priority if most users are not aware of the situation and therefore never raise it as a concern?

Best answer by 1P_Dave

Thank you for the feedback, I've shared your suggestions with our team internally. 

-Dave

PB-52364687

2 replies

1P_Dave
1P_Dave
1Password Employee
December 5, 2025

Hello @Roger! 👋

Thank you for the feedback! The original thread hasn’t had any activity in over four years, so to keep things organized and up-to-date, I split your message into a new thread where we can continue the conversation.

1Password uses a vault-based architecture where each vault is independently encrypted. Because of this, items aren’t literally transferred between vaults. Instead, when you “move” an item, 1Password creates a brand-new copy of that item inside the destination vault, encrypted with that vault’s unique key, and then deletes the original item from the source vault, placing it in Recently Deleted. After 30 days that deleted item is permanently removed. This approach ensures each vault remains cryptographically isolated. By giving every vault its own private encryption key, 1Password can support secure sharing of individual vaults while keeping all others completely private.

There’s no risk of password leakage in this process, because the deleted item never leaves its original vault. The “Recently Deleted” view isn’t a shared or separate location: each vault has its own Recently Deleted area, encrypted with the same private key as all other items in that vault.

-Dave

R
RogerAuthor
December 7, 2025

I don't see a way back to the original article from this one, so adding a link to it here for clarity.

https://www.1password.community/discussions/1password/why-are-items-moved-between-vaults-listed-in-recently-deleted-bad-security-model/24346

I performed the following steps

  1. New item created in Private
  2. Move item to shared vault (could easily be done by accident)
  3. Moved item back quickly to Private (easy to think it was exposed for seconds)
  4. Logged in as diff user with access to the shared vault
  5. Went to their deleted items
  6. Restored the item

 

So once the item was shared, even for a second, it can not be unshared.

Maybe one or more of the following would make sense

  1. A popup to state a copy was saved in Recently Deleted
  2. A popup to confirm you want to expose the item to other users since it can not be undone
  3. If shared user has never seen item, do not move it to their recently deleted

 

I have just moved from 1Password6 to 1Password8 and I am moving a lot of stuff around. I was quite shocked the first time I saw a lot of recently deleted items having not deleted anything! I restored a few and later discovered that I had duplicate items which led to more confusion. A couple of possible solutions to make this less confusing would be.

  1. A popup on move to state a copy was saved in Recently Deleted.
  2. Use a "Recently Moved" folder instead of "Recently Deleted" for moves.
1P_Dave
1P_DaveAnswer
1Password Employee
December 10, 2025

Thank you for the feedback, I've shared your suggestions with our team internally. 

-Dave

PB-52364687

    Terms & ConditionsAccessibility statement

    ©2026 1Password. All rights reserved.
    4711 Yonge St, 10th Floor, Toronto Ontario, M2N 6K8, Canada