Chrome Web Store
126Versions
2Code reviewed

No malware found

In code review (v8.12.22.17)

Our reviewer read version 8.12.22.17 — the most recent version we have reviewed — and found no malicious behaviour. The version shown here has not been individually reviewed yet.

What our analysis found

1Password – Password Manager, used by 7,000,000 people, showed no malicious code in Extension Auditor's review. Its permissions mean it can read and change data on all websites, can inject scripts into pages and can observe network requests. It comes from a trusted publisher and was last updated in October 2026.

Analyst notes

1Password is a legitimate, widely-used password manager. All permissions are required for its core functionality (autofill, webRequest for SSO, native messaging for desktop integration, etc.). Network destinations are all first-party ([domain withheld],.ca,.eu) or disclosed integration partners ([domain withheld], [domain withheld], [domain withheld]). Data collection categories (PII, financial, location) are disclosed in the CWS listing. No evidence of unauthorized data exfiltration, obfuscation beyond minification, or malicious code injection. The publisher has a strong reputation, a valid privacy policy, and no other malicious extensions. The ML score of 0.00 is correct; the risk-engine's critical rating is based solely on permission analysis without context.

1Password – Password Manager

1Password – Password Manager Chrome extension security report

ID: aeblfdkhhhdcdjpifhhbdiojplfjncoa

Supported Languages

🇨🇳Chinese (Simplified)
🇹🇼Chinese (Traditional)
🇳🇱Dutch
🇺🇸English
🇫🇷French
🇩🇪German
🇮🇹Italian
🇯🇵Japanese
🇰🇷Korean
🇷🇺Russian
🇪🇸Spanish

Extension Info & Metadata

Status
Active
Version
8.12.41.1
Size
17.14 MB
Rating
3.1/5
Reviews
3,600
Users
7,000,000
Type
Extension
Updated
Oct 8, 2026
Category
Workflow & planning
Price
Paid
Featured
Yes
Visibility
Listed
Mature
No
By Google
No
Trusted
Yes
This publisherTrack record
1extension
All still listed
Scanned by Extension Auditor — Low RiskDevelopers: embed this badge to link to this report.

Publisher Contextual Analysis

Trusted
Author
AgileBits Inc
MX records exist
Yes
Domain exists
Yes
Is disposable
No
Is role-based
No
Mailbox exists
Yes
Website
Visit
Extensions
1
Active
1
Obsolete
0
Listed
1
Unlisted
0
Users
7,000,000

Screenshots & videos

Screenshot 2
Screenshot 3
Screenshot 4
Screenshot 5
Screenshot 6

Install growth

Item
Type
Severity
Description
privacy
Permission
Critical
This permission allows modification of Chrome's privacy settings. Rated Critical because it can disable security features, modify network configurations, and compromise browser security settings.
scripting
Permission
Critical
This permission allows injection and execution of JavaScript on any webpage. Rated Critical because it can modify page content, steal sensitive data, and inject malicious code into any site the extension has access to.
webRequest
Permission
Critical
This permission enables the extension to monitor and analyze all web requests made by the browser. Rated Critical because it can observe all network traffic including sensitive data, track browsing behavior, and gather authentication tokens.
webRequestAuthProvider
Permission
Critical
This permission allows the extension to handle authentication requests and modify authentication headers. Rated Critical because it can intercept login credentials, session tokens, and modify authentication flows to compromise accounts.
declarativeNetRequestWithHostAccess
Permission
Critical
This permission combines network request modification with host permissions. Rated Critical because it can modify requests for specific domains, potentially targeting sensitive websites with precise attack rules.
<all_urls>
Host
Critical
Broad host access — the extension can read/modify content on every website.
downloads
Permission
High
This permission controls file downloads and accesses download history. Rated High because it can download malicious files, access sensitive downloaded documents, and track user download patterns.
nativeMessaging
Permission
High
This permission enables communication with applications installed on your computer. Rated High because it can exchange data with native programs, potentially exposing system-level information and local files.
webNavigation
Permission
High
This permission enables monitoring of all browser navigation events and transitions. Rated High because it can track every page visit, navigation method, and browsing pattern, potentially exposing sensitive browsing behavior and user activities.
Contextual Risk Factors
Risk Factor
High
The following context increases the overall risk: • 10% increase: Early script execution enables pre-emptive content manipulation • 25% increase: Unsafe code evaluation capabilities increase attack surface
Broad Host Permissions
Risk Factor
High
This extension has broad host permissions allowing it to access many or all websites.
Broad Content Script Access
Risk Factor
High
This extension can inject scripts into any website.
Unsafe WebAssembly Execution
Risk Factor
High
This extension's CSP allows "wasm-unsafe-eval".
management
Permission
Medium
This permission manages other installed extensions. Rated Medium because it can enable/disable other extensions and modify their settings, with changes being visible to users.
storage
Permission
Medium
This permission allows storing data locally in the browser. Rated Medium because it can persist sensitive user data, track user activities over time, and potentially store malicious payloads.
tabs
Permission
Medium
This permission enables tab management and monitoring. Rated Medium because it can track open tabs, access tab metadata, and monitor user browsing patterns.
Early Content Script Execution
Risk Factor
Medium
This extension runs content scripts at document_start.
alarms
Permission
Low
This permission schedules periodic tasks. Rated Low because it can only trigger events at specified times without access to sensitive data.
contextMenus
Permission
Low
This permission adds items to browser context menus. Rated Medium because it only modifies right-click menus without access to page content.
idle
Permission
Low
This permission detects system idle state. Rated Low because it only observes user activity state without access to activity details.
notifications
Permission
Low
This permission displays system notifications. Rated Low because it can only show user-visible notifications without accessing system data.

About this extension

The best way to experience 1Password in your browser. Easily sign in to sites, generate passwords, and store secure information.

Read the publisher’s full description

This extension requires a 1Password membership. If you don’t have one yet, you can sign up when you install the extension and try one free. Passkey support is now available for 1Password for Chrome! Go passwordless today and start using passkeys. 1Password is a password manager that keeps you safe online. You want to use different passwords for every website, but it can be hard to keep track of them all. With 1Password you only ever need to memorize…one password. All your other passwords and important information are protected behind the one password only you know. 1Password manages everything for you: generating, saving, and filling your passwords. Get to know 1Password in your browser: https://support.1password.com/getting-started-browser/ About your privacy: 1Password was designed with a deep respect for your privacy. The data you save is encrypted and inaccessible to us. Anything else is only ever used to provide you with service and support. We believe strongly that your data is yours, and we don’t want to know anything about it. This is one of the fundamental beliefs 1Password was built upon. That’s why our privacy policy is simple: your data is your data. We don’t use it, we don’t share it, and we don’t sell it. You’re our customer, not our product. Privacy Policy: https://1password.com/legal/privacy/

User reviews

Extension files

Browse and explore files within this extension package

Gain full insight into all external connections.

Upgrade for full visibility.

No network indicators were extracted from this version.

Version
Size
Verdict
Findings
Permhash
8.12.41.1
Latest
17.14 MBNot scanned—
d79c665287bf0e5752474be580e176a2b078294c856ff4c403e107aa4eb377de
8.12.40.31
17.14 MBNot scanned—
d79c665287bf0e5752474be580e176a2b078294c856ff4c403e107aa4eb377de
8.12.38.34
17.88 MBNot scanned—
d79c665287bf0e5752474be580e176a2b078294c856ff4c403e107aa4eb377de
8.12.37.1
17.32 MBNot scanned—
d79c665287bf0e5752474be580e176a2b078294c856ff4c403e107aa4eb377de
8.12.36.40
17.32 MBNot scanned—
d79c665287bf0e5752474be580e176a2b078294c856ff4c403e107aa4eb377de
8.12.34.34
17.15 MBNot scanned—
30b8652d75c5bacd657d085050738bf41b73970a25e84d3aa85894252671801e
8.12.2.37
19.62 MBNot scanned—
0fca94e42a0126fd45e0d9c88eb16948ece841e8b7a224f318804202bfc26801
8.12.32.33
17.04 MBNot scanned—
30b8652d75c5bacd657d085050738bf41b73970a25e84d3aa85894252671801e
8.12.30.21
16.96 MBNot scanned—
30b8652d75c5bacd657d085050738bf41b73970a25e84d3aa85894252671801e
8.12.28.25
16.95 MBNot scanned—
30b8652d75c5bacd657d085050738bf41b73970a25e84d3aa85894252671801e
Showing 1 to 10 of 130 rows
Rows per page:

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

Gain full insight into all external connections.

Upgrade for full visibility.

Popular in Workflow & Planning