A path to user verification in 1Password

At 1Password, we believe strong security should feel like part of the workflow, not an interruption. That is the goal behind our work on user verification (UV) for passkeys.

UV is a local identity check a website can require as part of a passkey action, to confirm the person approving the action is the person authorized to do so. This decision belongs to the website, not 1Password, as the site will validate UV occurred before accepting the operation. A useful analogy is paying with a bank card. For some transactions, tapping the card is enough. For higher-risk transactions, the terminal asks for a PIN. The card shows the credential is present, and the PIN adds confidence that the authorized cardholder is using it. Passkeys have a similar distinction; when stronger assurance is needed, UV asks for a fingerprint, face scan, device PIN, or password.

If someone can add or use a passkey without proving they are authorized, a hijacked browser interaction or temporary access to an unlocked session could become lasting account access. Imagine someone steals your bank card and tries to buy a new TV. In that moment, you want the terminal to ask for a PIN. UV plays the same role for passkeys, ensuring high-impact operations are approved by the right person, not whoever has the computer. 

Not every passkey flow needs UV, but when a website requests it, we want the experience to be as seamless as possible. The website has the context to decide when stronger assurance is needed, and 1Password’s role is to honor that request and ensure the local verification check is completed. Protecting the user is a shared responsibility between the website and client. 

User verification for passkeys is now available for mobile and desktop applications

Your feedback will help us improve the experience and deliver security that feels effortless.

What we're building next: a better extension-only experience

UV prompting in mobile and desktop apps is only the beginning. The next step is to improve the passkey experience within the 1Password browser extension.

Why extension-only flows need a better solution

When someone uses both the browser extension and the desktop app, 1Password can hand the passkey request to the native app. The desktop app can then call the operating system's native APIs and show the same biometric, PIN, or device-authentication prompt people already use elsewhere.

The challenge appears when the browser extension runs without the desktop app, creating an extension-only setup. Extensions do not have a standard, cross-browser way to call the required native APIs directly. If a website requires UV in an extension-only flow, we are of the opinion that the only viable fallback today is another 1Password account password prompt. If the user needs to type the password instead of using biometrics, the flow is slower, more disruptive, and inconsistent with the native experience available in our apps.

The browser community needs a new API that can provide a consistent experience across browser engines.

A standards-based path forward: Secure Cache

1Password has drafted a new WebExtensions proposal, browser.secureCache, to solve this problem. The proposed API would give browser extensions a standard way to use platform-backed credential storage and request native user verification where supported. In a UV flow, the operating system can show its familiar biometric, PIN, or device-authentication prompt before allowing access to the protected material.

While UV is our flagship use case, Secure Storage addresses a wider browser security gap. Credential managers, secure messaging apps, wallets, and other security-sensitive extensions all need safer ways to protect key material. Secure Cache will reduce dependence on volatile extension memory and native companion apps while giving developers stronger protections for critical data.

1Password will work with the open source community to help move Secure Storage from proposal to implementation targeting Chromium. A working Chromium implementation will create a path for Chrome and all other Chromium-based browsers like Edge. 

Our end goal is a broadly supported API rather than a browser-specific workaround. Once various browsers ship a suitable Secure Storage API, we will adopt it for extension-only UV in 1Password.

Try it today and help shape what comes next

Today's release is the first part of the story. 

The next part is closing the extension-only gap through Secure Cache and broader browser support. This is the kind of work we believe is worth investing in. Rather than implementing a workaround, we can help add a critical browser capability that improves user experience and raises the security bar for the wider community. It follows the same approach as our work with the FIDO Alliance and our support for secure passkey import and export: solve real product problems through open, interoperable standards.