My Emergency Kit PDF was left (readable) in the Downloads folder after my 1Password installation

Forum|Forum|22 days ago
September 8, 2026
9 replies
6 views

My Emergency Kit PDF was left (readable) in the Downloads folder after my 1Password installation. One of your old support incidents suggests editing the Password (in with the Secret Key) into the PDF and then printing the PDF out for safekeeping. That leaves both the Secret Key and the Password in the same file, on my Windows machine, where a virus could export it to an external destination.

Could you address the logic of the situation?

Thanks,
Tom

Best Practices

Pinned Reply By 1P_Dave

@ThomasAlborough

Thanks for the reply! This behavior is intentional, giving customers immediate offline access to their Emergency Kit and Secret Key when they need to sign in to their 1Password account, such as on another device.

The Emergency Kit is not encrypted because doing so would require customers to remember or store an additional password, undermining its purpose as an emergency recovery document. The Secret Key alone cannot be used to sign in or unlock an account. The account password is also required, is not included in the downloaded PDF, and cannot be entered into it by default. This helps prevent customers from storing both credentials together in the same digital file.

1Password follows your browser’s download settings. If you prefer not to save the Emergency Kit in your Downloads folder, you can choose a different location (such as an encrypted folder on your device).

-Dave

1P_Dave

1Password Employee

Hello @ThomasAlborough! 👋

Welcome to the 1Password community! When you sign up for 1Password in the browser, your browser will download your Emergency Kit to your browser’s default download location on your device so that you can then move it to a secure and safe location.

By default, the password field on the Emergency Kit isn’t editable. Instead, we recommend printing the Emergency Kit and then, if you wish, writing your account password using a pen and storing the printed copy of your Emergency Kit somewhere that only you have access to like a personal safe.

Let me know if you have any questions!

-Dave

T

ThomasAlboroughAuthor

I'm very concerned the Secret Key is found in cleartext on my system at all. It's readable/can be stolen by anyone. If that's true why is it so complex? What does the complexity provide if it's easily viewed? At least encrypt the Kit PDF.

Tom

1P_Dave

1Password Employee

@ThomasAlborough

Thank you for the reply. Your 1Password account is encrypted using two different secrets: your account password and your Secret Key. Your Secret Key protects your data off of your device, your account password protects your data on device. The Secret Key by itself is not enough to unlock 1Password and access your items. You can read more here:

About your Secret Key

If your thread model is such that you’d like to avoid keeping your Emergency Kit on your device then you can definitely print or move it to a save place and delete the copy from your device.

-Dave

T

ThomasAlboroughAuthor

Good advice to be sure. How many of your customers might this apply to? They may not even be aware the PDF is on their computer. At least encrypt it.

T

ThomasAlboroughAuthor

Encrypt it with the account Password. The account Password has to be “available” to the users all the time anyway and doing that makes the account Password no less secure or expose it in any way.

1P_DavePinned

1Password Employee

@ThomasAlborough

Thanks for the reply! This behavior is intentional, giving customers immediate offline access to their Emergency Kit and Secret Key when they need to sign in to their 1Password account, such as on another device.

The Emergency Kit is not encrypted because doing so would require customers to remember or store an additional password, undermining its purpose as an emergency recovery document. The Secret Key alone cannot be used to sign in or unlock an account. The account password is also required, is not included in the downloaded PDF, and cannot be entered into it by default. This helps prevent customers from storing both credentials together in the same digital file.

1Password follows your browser’s download settings. If you prefer not to save the Emergency Kit in your Downloads folder, you can choose a different location (such as an encrypted folder on your device).

-Dave

Sign up

1Password employees: Sign in with SSO

Login to the community

1Password employees: Sign in with SSO