Browser extension does not prompt for unlock when using multiple accounts

gerhard498

It's true that you should never reuse passwords across other services and you definitely shouldn't use a password that you use for something else as your account password for 1Password.

The reason why you can use the same account password for all of your 1Password accounts is because 1Password isn't vulnerable to the sorts of login attacks that other services are. Unlike most other services, we don't store your account password on our server and it is not transmitted to us. Rather your account password is combined with your Secret Key, and each account has a unique Secret Key, and then processed using a derivation function to create the keys that authenticate your account and decrypt your data.

Beyond technologies such as Secure Remote Password, each 1Password account continues to be protected by its own unique Secret Key even when you use the same account password for all of your accounts. An attacker would need both your account password and the unique Secret Key for a given account in order to access that account:

Other services just use a single user generated password for authentication/encryption, 1Password uses a dual-key system that includes a unique 34-character and 128-bit Secret Key to protect each of your accounts.

-Dave