How safe is the safari extension?

Hey Beloany,

Since 1Password for Safari is a "web extension", it need user permissions to be able to function within the browser. Our requirement to "allow access to all sites" achieves two things:

• The ability to scan (read) the page HTML to determine if it's fillable. This also tells us where/when to inject the inline menu.

• The ability to autofill (write) to the site. While performing an autofill, it effectively changes the HTML. When you submit the autofill, it will allow you to authenticate it properly.

Providing permission for 1Password to do these things is not bad at all. In fact, without these permissions, the 1Password for Safari would not work.

The new 1Password for Safari extension is built to be a standalone tool, making it quite different from the old companion extension in Safari which was dependent on the app. That said, the old built in extension in Safari also required the same exact permissions to save and fill. It just had a different way of displaying and asking for those permissions: https://share.cleanshot.com/XLBgsc.

As far as security goes, I do want to emphasize that we are unable to access your passwords or anything else you have saved in 1Password. All your data is encrypted and we do not have the keys to decrypt it. I'll link some important articles about our security model and browser permissions below:

About 1Password's Security Model: https://support.1password.com/1password-security/

About 1Password Browser Permissions: https://support.1password.com/browser-permissions/

I strongly recommend giving 1Password for Safari the necessary permissions to save and fill on your sites. Let us know if you have any other questions.