Level up your business security with free, on-demand training and certification. Explore 1Password Academy today →
Feature Feedback: UI Overlap Issue & More Flexible Secret Sharing Controls
Dear 1Password Team, I would like to share several feedback points regarding usability and flexibility within the 1Password Windows desktop application and its secret sharing feature. First, I noticed a UI issue in the Windows desktop app where the "New Item" button appears overlapped by the window’s minimize control. This creates a confusing visual layout and may affect usability, particularly when navigating quickly. It would be helpful if this overlap could be reviewed and adjusted to ensure consistent spacing and clarity across window sizes or display scaling settings. Second, regarding the secret sharing feature, I would appreciate more flexibility in configuring expiration and viewing limitations: * Custom link expiration duration Currently, the available options for "Link expires after" are limited to fixed presets (1 hour, 1 day, 7 days, 14 days, 30 days). In practical scenarios, more granular control would be very useful — for example: - 30 minutes - 90 minutes - 21 days - any custom duration defined by the user While this may seem like a small enhancement, it would significantly improve usability in real-world workflows where precise timing matters. * Custom number of allowed views At present, the viewing limitation only allows either: - unlimited views - or exactly 1 view It would be very helpful if users could specify custom limits (e.g., 2 views, 3 views, 5 views, etc.), especially when sharing secrets with small teams or temporary collaborators. * Selective field sharing Another improvement that would greatly enhance security flexibility is the ability to choose which fields within an item are shared. For example, in my case, I may want to share GitLab credentials (username and password) but exclude attached files such as recovery codes. Currently, sharing an item also shares all attachments, which may expose sensitive backup data unintentionally. Overall, these enhancements would improve both usability and security control, especially for users who rely on 1Password for professional workflows and credential sharing. Thank you for continuously improving the product, and I hope these suggestions are helpful for future updates. Best regards,
Can we get 1st-party support for keyboard shortcuts?
Now that the interface to edit/set keyboard shortcuts has been removed from 1Password running under Wayland, It would be preferable if the installation package made the shortcuts available to configure by default, rather than https://support.1password.com/keyboard-shortcuts/?linux#wayland. I wrote about this before under a blog of post yours, but it was ignored. It's trivial to add Desktop Action sections to your existing launcher file, and reference them in an Actions= directive: [Desktop Entry] Name=1Password Exec=/opt/1Password/1password %U Terminal=false Type=Application Icon=1password StartupWMClass=1Password Comment=Password manager and secure wallet MimeType=x-scheme-handler/onepassword;x-scheme-handler/onepassword8; Categories=Office; Actions=Show;QuickAccess;Lock;Fill; [Desktop Action Show] Name=Show 1Password Icon=window-symbolic Exec=1password --show [Desktop Action QuickAccess] Name=Show Quick Access Icon=search-symbolic Exec=1password --quick-access [Desktop Action Lock] Name=Lock 1Password Icon=lock-symbolic Exec=1password --show [Desktop Action Fill] Name=Fill in Browser Icon=web-browser-symbolic Exec=1password --fill Putting a symlink to this expanded .desktop file under /usr/share/kglobalaccel/ makes those keyboard shortcuts appear in KDE Plasma's Settings app:
Service Accounts in the GUI?
Are service accounts supposed to be manageable in the GUI/desktop app? I'm running Linux, and I don't see them in my account, despite being on the subscription that has them and them being available on the website. And if not, is this a feature that is coming soon? Because it's fairly impractical to manage them through the website. I'd also add that it's annoying having to recreate the service account every time I want to change permissions on it (add a vault, remove a vault, adjust a vaults permissions, rename it, etc). I understand that you've made it this way for additional security, but I don't think it's actually buying much added security in most circumstances, and I think it should at least be opt-out.macOS AutoFill is now in public beta!
Hey everyone! We're excited to share that native macOS AutoFill is now available in public beta for 1Password. This has been one of the most requested features for years, and we're now at a point where you can test it out and give us feedback! What's new in beta: By adopting Apple's Passwords API, 1Password functions as a native Credential Provider on macOS for logins. You can view autofill suggestions directly within Safari and other supported desktop apps. Passkey support is included in this beta as well. Fill, create and update passkeys easily through macOS autofill. The 1Password Safari extension can be used alongside macOS AutoFill to access additional features not currently supported by the Passwords API. Coming later in Beta, you can set up one time codes using the same integration. How to try it: Update to 1Password for macOS 8.12.22 or later from the beta channel. Make sure you’re on macOS 14 (Sonoma) or later on Apple silicon. Go to 1Password for Mac Settings > Autofill > Set up macOS AutoFill, then select "Turn On" from the macOS permission prompt. You'll see "Active" status once it's enabled. Try filling logins and passkeys and let us know how it goes! We're happy to be one of the first credential managers to adopt these APIs and we want to get it right for you. Drop your feedback in the comments below!
Merging Duplicates
I know that the general response is to manually do this, but doing this with 1000+ objects is impractical to say the least. Some were created because when I migrated to 1Password, some duplicate/corrupt entries already existed in my profiles on Avast, Google, etc, which I did not notice at the time. Unfortunately, some have been created since then by either less tech-savvy family members on their own accounts or how 1Password is asking more often regarding site/app trust & permissions ("Allow fill once") and is thus creating duplicates of its own accord. The fact that merging wasn't already added a while back, considering how many people have asked about it over the years, is interesting to say the least. And yes, I have been attempting to create my own tool for quite some time, but it is difficult to find time to work on it lately, on top of not being successful in general.
Feature request - Force 1password to sync
I would like, like many requests before, an option to force the sync. I know I can lock/unlock and everything should sync but that is not efficient. I have seen this asked before and everyone answers that it should just happen and/or lock/unlock the Mac desktop app. Please just add a sync now button! The automatic syncing is great but does not always work. It is probably related to the app going to sleep in the background such as due to time, Mac sleeping, etc.... Just add the button!Feature Request: Conditional Access & Step-Up Authentication for Integrated TOTP/MFA Codes
Currently, storing both a password and its corresponding Multi-Factor Authentication (MFA/TOTP) seed within the same 1Password item creates a "single point of failure." If a device or 1Password session is left unlocked, an unauthorized user gains immediate access to both factors. I am requesting a feature that allows administrators (or individual users) to require a secondary validation (such as re-entering the Master Password, using Biometrics, or confirming a 1Password-level MFA prompt) before 1Password will reveal or autofill specific TOTP codes. The Problem While storing MFA codes in 1Password is incredibly convenient, it inherently violates the core principle of MFA (combining something you know with something you have). If an attacker gains access to the 1Password vault, the security benefit of MFA is effectively neutralized for that account. Proposed Solution Introduce a Step-Up Authentication / Conditional Access policy specifically for MFA fields. MFA Vault Lock: When a user attempts to copy, view, or autofill a TOTP code, 1Password should challenge the user for authentication. Customizable TTL (Time-to-Live): Users or admins should be able to configure how often this challenge occurs. Options could include: Every time the MFA code is accessed. Once per session / Once a day. After X minutes of inactivity. Administrative Control (1Password Business): Enforce this via Policies in the Admin Console, allowing organizations to mandate that all stored MFA codes require a secondary check, mitigating the risk of compromised employee endpoints. Use Case Example An employee opens a shared vault to log into a critical infrastructure tool. 1Password autofills the username and password normally. When the employee clicks the MFA field to copy the token, a biometrics prompt (Touch ID/Face ID) or a 1Password MFA prompt appears. Once validated, the token is revealed/filled, and the validation remains active for the next 8 hours (or whatever limit the admin set). Benefits Enhanced Security: Preserves the integrity of two-factor authentication even when stored in a single password manager. Enterprise Compliance: Helps businesses meet strict compliance frameworks (like SOC2 or ISO 27001) that frown upon storing passwords and MFA tokens together without isolating controls. User Flexibility: Maintains the convenience of 1Password's autofill while adding a vital speedbump for sensitive data.
