1Password for Claude: Zero-Exposure Login for AI Agents¶
For / Key Points
For: Intermediate infrastructure and security practitioners evaluating browser-using AI at work
Key Points:
- Passwords and one-time codes do not enter the model or Anthropic's systems
- Each release requires human approval, and credentials are protected with session-specific keys
- The boundary ends at login; post-login actions and compromised devices require separate controls
On July 16, 2026, 1Password launched 1Password for Claude through a partnership with Anthropic. 1 When Claude reaches a login page, 1Password fills the credential directly into the site. The password and one-time code never enter the model's context, memory, or Anthropic's systems.
This article asks one question: how much of browser-agent security does "never show it the password" actually solve? The published design creates a specific and technically detailed boundary around secret delivery. It does not make the agent's behavior after login safe by itself.
Breaking the Choice Between Sharing a Password and Taking Over¶
1Password for Claude gives the agent permission to use a credential without giving it the credential value.
Previously, a user who reached a login step had to paste a secret into the conversation or take over the task. The first option makes the value readable by the model; the second interrupts the automation. 1Password adds a third path: let the agent use the login without seeing it. 1
1Password CTO Nancy Wang explains that Claude only needs to know it used a login; it does not need the password or one-time code itself. 1 This is more than password storage. It is a separation between possessing a secret and exercising the permission it grants.
The critical moment is when the secret briefly exists in the web page.
The Flow: Claude Stops While the Secret Is in the Page¶
The central control is that Claude cannot read the page while 1Password is filling and submitting the credential.
Claude requests a login item
→ The user reviews the item and reason, then approves or denies
→ 1Password sends the approved item to its extension over an encrypted channel
→ Claude pauses while 1Password fills, submits, and checks the result
→ Claude resumes after success, or after all filled values are cleared on failure
The approval prompt lets the user replace the suggested item with another login or deny the request. Initial connection authorization uses Touch ID or the 1Password account password. 2 There are no standing approvals; a new agent session produces a new prompt. 3
Claude stops reading and tracking the page during the fill. After a successful submission, control returns only after the secret has left the page. If submission fails, 1Password clears every value it filled before reporting the failure. 3
Claude receives only the approved item's title, username or email, saved websites, and a success or failure status. The integration exposes no API that returns secret values to the agent. 3
Four Principles Implemented with Code Signing and Session Keys¶
1Password's published security model turns four isolation principles into concrete controls. 3
- The agent never handles secrets: Only 1Password software decrypts and fills credential values
- A human approves each release: Every request opens an approval prompt; there is no standing grant
- Access is scoped and short-lived: Released items are bound to one agent session
- Sensitive paths use end-to-end encryption: The desktop app and extension mutually authenticate
The first barrier prevents application impersonation. When pairing begins, 1Password verifies Claude Desktop through the operating system's code-signing facilities. The process must have a valid signature, appear on 1Password's trusted partner allowlist, and come from Anthropic's verified Apple Developer team. 3
Claude then enrolls every agent session separately, and 1Password mints cryptographic session credentials for it. 1Password describes this as a local federation model similar in spirit to OpenID Connect (OIDC). An item released to one session is invisible to every other session. 3
The extension encrypts approved credentials with AES-256-GCM and keeps them in memory only. It never writes them to disk and destroys them when the task completes or the browser closes. A nine-hour hard cap applies if neither event occurs, and each grant is recorded in item usage history. 3
Credential-bearing communication also stays on the Mac. The 1Password app and extension use a mutually authenticated, Noise-based end-to-end encrypted channel. The loopback relay cannot read the payload, while local IPC with Claude uses an open-source client library. 37
That secures the secret-delivery path. A separate control blocks alternate paths through the extension UI.
Agentic Mode Hides the Extension Even Without the Integration¶
Agentic Mode removes the 1Password extension's page UI while a supported agent controls a tab.
Inline suggestions, save prompts, and notifications disappear, so the agent cannot click the normal autofill surfaces. The only usable path is the human-approved flow. The protection is scoped to the controlled tab and ends when the agent session ends or the tab closes. 3
Agentic Mode activates automatically even when 1Password for Claude is not connected, and it is designed to support agents beyond Claude. 12 Automatic Agentic Mode is separate from permission to let Claude use credentials. On 1Password Business, an administrator must enable the Agentic Autofill policy. 2
Setup Requirements and Current Limits¶
The current integration requires a Mac and a paid Claude plan. 24
| Item | Requirement |
|---|---|
| OS | Mac |
| 1Password | Mac app and browser extension, both version 8.12.28 or later |
| Claude | Desktop app and Claude in Chrome extension |
| Claude plan | Pro, Max, Team, or Enterprise |
| 1Password Business | Admin enables "Allow AI agents to autofill for users" |
| Claude organization | The 1Password integration is off by default; an Owner or Primary Owner enables it |
To connect, open "Customize > Connectors" in Claude Desktop, select 1Password, and authorize with Touch ID or the account password. 2 Claude in Chrome itself is enabled by default on Team and disabled by default on Enterprise; that is a separate setting from the 1Password integration. 5
The integration currently fills usernames, passwords, and one-time codes from Login items. Passkeys are unsupported, and social login may not work as intended. 2
Accepted Risks: Secret Protection Is Not Agent Safety¶
The zero-exposure boundary covers credential storage, approval, delivery, and filling—not actions after login. 3
1Password explicitly lists four accepted risks in its design document.
- A compromised Mac: Attackers with administrator or same-user execution are outside the boundary
- Claude after pairing: 1Password trusts the app's session claims, though every release still needs approval
- The destination site: Submitted values belong to the site and scripts running on the page
- Post-login behavior: Data access, changes, and transmission depend on Claude's safeguards
Anthropic separately identifies prompt injection as the largest risk for browser-using AI. Malicious page content can trigger unintended actions, so Anthropic recommends avoiding financial, medical, legal, and sensitive work accounts and using a separate browser profile or restrictive allowlists. 6
The boundary matters: 1Password can hide a password from the model, but it does not reduce the authority of the authenticated session. An adoption review should therefore evaluate secret exposure and post-login capabilities as two different risks.
Summary¶
1Password for Claude lets a browser agent use a credential without seeing it. Code signing, session keys, a nine-hour cap, and agent pausing are publicly documented, making the secret path unusually concrete and reviewable.
- Passwords and one-time codes stay outside the model and Anthropic's systems
- Agentic Mode hides ordinary extension UI and blocks an alternate route to unapproved items
- Compromised devices, destination sites, prompt injection, and post-login behavior remain outside the boundary
The new implication is that a password manager is becoming a local authorization broker for agents, not merely a vault. The same four principles apply to internal agent platforms: keep secrets out of the agent, require request-level approval, issue short-lived scoped grants, and encrypt every sensitive hop. The full boundary closes only when those controls are paired with least-privilege accounts and post-login action controls.