Level up your business security with free, on-demand training and certification. Explore 1Password Academy today →
Watchtower Not Finding All Duplicates
I've been cleaning up my 1Password on my MacBook Pro.... I have an old vault with about 40 entries I wanted to remove, as long as I was sure I have them in my main vault. I moved those entries to my main vault and used Watchtower to identify duplicates so I could remove them. It found those I'd moved and I removed them. But then I stumbled on the fact that there are a lot of duplicates in my main vault that Watchtower does not identify as duplicates. They appear to be true duplicates - all entry info is the same and the "Last edited" time stamp is exactly the same. And yet Watchtower did not identify them as duplicates. Any idea why Watchtower isn't finding all duplicates and if there is anything I can do? Thanks very much!!
Watchtower missing categories - ex. Passkeys available
Intended to check Watchtower today to see how recent compromised account data dumps were appearing. I found Watchtower was missing categories. I keep a note of stuff so I can easily see newly appearing items, so I have a record of counts as of Jan 19 2026 to compare against what I'm seeing currently. I'm only seeing Vulnerable Passwords (only after tweaking something in settings), reused passwords, weak passwords, expiring items, and developer credentials on disk. Something with passkey and 2fa is affecting results. I should see something like this based on my Jan 19 note. 19 vulnerable passwords 21 passkeys available 2 reused passwords 22 weak passwords 2 two-factor authentication 7 expiring items 6 ignored alertsFeature Request: Proactive Expiry Events for Service Account Tokens in Events API
Hi 1Password Team, I am managing 1Password integrations in a Kubernetes environment. We currently use the Events API to stream logs into our centralized observability platform (VictoriaLogs). The Problem: The current Events API is action-based. For Service Account Tokens, there is no proactive event (like "Token Expiring Soon") via the API. We only discover a token has expired when our controllers log a 401 error: "status 401: Authentication: (Invalid bearer token), go-jose/go-jose/jwt: validation failed, token is expired (exp)" Feature Requests: Status-based Events: Does 1Password plan to support proactive events such as "service_account.token.expiring_soon"? Webhook Support: Are there plans for Webhooks to alert on critical auth failures or lifecycle changes? Audit Log Coverage: Can "System-triggered Expiry" be added as an action in the Audit Log? Our goal is to prevent production incidents caused by expired credentials. Looking forward to your insights.New/confirmed passwords don't match
I'm a new user and in the process of updating passwords for my existing accounts. However I'm struggling with getting the newly generated password to match the Confirmed password. I saw a previous discussion from 2 years ago on this, but no resolution was indicated. I've tried to copy/paste, however the Copy function isn't permitted. How do we fix / get around this?
Watchtower and Two-factor authentication
My Watchtower has flagged nine "sites that have two-factor authentication but you haven't set it up yet". However, six of these sites are set up with passkeys. The other three sites are two-factor enabled. Why is the Watchtower flagging the three two-factor enabled sites? Why is the Watchtower flagging passkey sites? Are not passkeys a two-factor method?
Feature Request: Autofill Activity Log to Track
I have two important security feature requests that would significantly help protect users from unauthorized charges and fraudulent activities: Request 1: Autofill Activity Log In our non-secure internet environment with millions of phishing sites, credit cards are at constant risk. I would like to request a simple but necessary feature to log all autofill activities. This log should track: - Which account/website received autofilled data - What type of data was filled (credit card, personal info, etc.) - When the autofill occurred When users wake up with unauthorized credit card charges, they could check this log to identify exactly where their card information was entered. This would be invaluable for investigating fraudulent transactions and understanding how their data was compromised. Request 2: Enhanced Security Safeguards (1Pass) I also request that 1Password implement stronger security guards that can: - Detect and warn users if a site appears to be phishing - Verify that card forms are contained within authorized iframes and not in suspicious containers - Alert users when data collection might be happening on unverified forms - Prevent autofill on suspicious or unverified payment forms These two features would provide users with both accountability (knowing where their data went) and protection (preventing accidental submission of data to malicious sites). This would be a significant step forward in browser security and payment protection.Finding Almost Duplicates
Hello All, I support 1Password in our company of mostly Mac computers. (new to it myself, though) We have a user on a Macbook Air who imported passwords three times over the last year. (I'll give him credit. He's trying!) Each import does have a tag with the import date. I want to remove the old duplicated items from his vault. Watchtower does not show any duplicates. My guess, I haven't confirmed yet, that the items are not exact duplicates. Certainly the tags are different. (Hmm, maybe if I delete the tags they would become duplicates?) I don't want to just delete all items with an old tag because I I can't confirm that all the old ones (> 300 items) have new versions. Maybe there's a way to do that? Maybe we export all of them, delete duplicates in Excel, delete all in 1Password, and then import them again? I'm liking this option. When he did the imports, it didn't keep the Titles. It made new Titles with the website+username (I think). Yuck! Screwed up his logins for apps. This brings up a missing feature. When 1Password imports items, it would be good if it recognized the duplicates at that time and then give options on what to do with them, e.g. not import, keep newest, keep oldest, keep both, merge (?). I'm sure there's a feature request site somewhere. Thank you for any advice.
