Unclassified // For public releaseWordle · Official security dossier
Automatic security check · Public OSINT only
Company website
1password.com security check
Public OSINT valuation for 1password.com: grade B (73/100). Title signal “Password Manager, Secrets, and Access Management | 1Password”. 4 security headers present, 4 commonly expected headers missing. This is a defensive surface review — not a penetration test.
73
/100
Grade B
73%
Trusted — verify
No major public red flags in this pass, but confirm reviews, ownership, and TLS details yourself. Passive OSINT only · inventKeys=false.
- High concern
- Elevated risk
- Caution advised
- Trusted — verify
- Strong protections
Company website · Services · Social
Company website
Services & products
- View plans
- Explore Unified Access
- Try Enterprise Password Manager
- Explore Credential Broker
- Discover Privileged Access
- Learn about SaaS Manager
- Device Trust
- Personal Password Manager
- Pricing
- Autofill
- Access reviews
- Access requests
- Credential governance
- Developer watchtower
- Posture checks
- Extended Device Compliance
- SaaS Manager integrations
- SaaS discovery
- SaaS workflows
- IT Asset Management
- License management
- Watchtower insights
- Secrets Management
- Password sharing
Links are extracted from public crawl HTML only. We never invent profiles or product pages.
Research engines · Complete scan
This complete report delivers web-check-class passive modules to customers — DNS, TLS, headers, mail auth, archives, CT logs and more — researched in the spirit of Lissy93/web-check. Port scan, traceroute and Shodan stay off by policy. Run a live check on the security-check tool for the full interactive dashboard.
Connect this report to your website
Add a free badge that links visitors to this official Wordle security report. You get referral traffic and a backlink; customers can verify the dossier.
Trustpilot · Glassdoor
How we scored 1password.com
Positive signals
- TLS handshake OK (TLSv1.3).
- HTTP Strict Transport Security is present.
- Content-Security-Policy observed.
- DNS resolves publicly (A/AAAA).
- security.txt found (coordinated disclosure signal).
- robots.txt is publicly available.
- RDAP domain record available (1password.com).
Risk signals
- Set-Cookie present but Secure/HttpOnly incomplete on sampled header.
- X-Powered-By disclosed: Next.js.
Findings
- TLS handshake OK (TLSv1.3).
- HTTP Strict Transport Security is present.
- Content-Security-Policy observed.
- Set-Cookie present but Secure/HttpOnly incomplete on sampled header.
- X-Powered-By disclosed: Next.js.
- DNS resolves publicly (A/AAAA).
- security.txt found (coordinated disclosure signal).
- robots.txt is publicly available.
- RDAP domain record available (1password.com).
- Final HTTP status 200 at https://1password.com/.
Technical details
DNS
resolved- A
- 162.159.141.147, 172.66.1.143
- AAAA
- 2a06:98c1:58::18b, 2606:4700:7::18b
- PTR
- —
- error
- —
TLS / certificate
ok- version
- TLSv1.3
- cipher
- TLS_AES_256_GCM_SHA384
- issuer
- Let's Encrypt
- notAfter
- Jan 22 12:59:14 2027 GMT
- SAN sample
- 1password.com, www.1password.com
- error
- —
HTTP & security headers
4 present- finalUrl
- https://1password.com/
- status
- 200
- server
- cloudflare
- x-powered-by
- Next.js
- present
- content-security-policy, referrer-policy, strict-transport-security, x-content-type-options
- missing
- x-frame-options, permissions-policy, cross-origin-opener-policy, cross-origin-resource-policy
- cookie Secure
- False
- cookie HttpOnly
- False
Tech fingerprint (public)
passive- title
- Password Manager, Secrets, and Access Management | 1Password
- generator
- —
- tech
- Next.js, Cloudflare
- script hosts
- x
- description
- Protect passwords and secrets, manage app access, and secure AI tools with 1Password. Easy to adopt from growing teams to enterprise.
Company presence (crawl links)
extracted- companyWebsite
- https://1password.com/
- serviceLinks
- View plans: https://1password.com/pricing/enterprise, Explore Unified Access: https://1password.com/platform, Try Enterprise Password Manager: https://1password.com/product/enterprise-password-manager, Explore Credential Broker: https://1password.com/product/credential-broker, Discover Privileged Access: https://1password.com/product/privileged-access, Learn about SaaS Manager: https://1password.com/product/saas-manager, Device Trust: https://1password.com/product/device-trust, Personal Password Manager: https://1password.com/product/password-manager, Pricing: https://1password.com/pricing, Autofill: https://1password.com/features/autofill, Access reviews: https://1password.com/features/access-reviews, Access requests: https://1password.com/features/access-requests
- socialLinks
- LinkedIn: https://www.linkedin.com/company/1password/, GitHub: https://github.com/1Password, Instagram: https://www.instagram.com/1password/, Reddit: https://www.reddit.com/r/1Password, X (Twitter): https://twitter.com/1Password, YouTube: https://www.youtube.com/1PasswordVideos
RDAP / registration
rdap- domain
- 1password.com
- registrar
- Tucows Domains Inc.
- created
- 2003-11-30T04:56:20Z
- expires
- 2027-03-28T20:55:37Z
- nameservers
- ns-109.awsdns-13.com, ns-1527.awsdns-62.org, ns-1850.awsdns-39.co.uk, ns-671.awsdns-19.net
- status
- client transfer prohibited, client update prohibited
- error
- —
Public well-known
passive- /.well-known/security.txt
- HTTP 200 · found
- /robots.txt
- HTTP 200 · found
- /security.txt
- HTTP 200 · found