Master Password

To change the master password that protects all the 1Password data in your current local vault on a Mac (not applicable to Windows, or to 1Password accounts on any device), click Change Master Password. Enter your current password, enter and verify a new password, and (on a Mac only) enter a hint. Then click Change Password.

Changing your master password for a standalone vault on one device changes it on any other devices that sync with it (once the next sync has occurred).

Display

The Display category has a single option: “Conceal passwords” (selected by default). With this checkbox selected, your passwords will be represented by bullets (•) in both the main 1Password app and in 1Password mini. You can show the passwords on a Mac by holding down the Option key.

To display passwords all the time in both environments—an unwise idea if someone might be able to look over your shoulder while you’re using 1Password—disable this feature.

Auto-lock

I introduced the Auto-lock preferences earlier, in Lock Automatically, and you may have selected some default options when you first ran 1Password. Here are the things you can change now (the order and wording differ by platform):

• Lock on sleep (Mac)/Lock when computer is locked (Windows): This self-explanatory option should remain selected for most people.

• Allow Windows Hello to unlock 1Password (Windows): If your PC is compatible with Windows Hello and you have it set up to log you in to your computer using a camera or fingerprint sensor, it makes sense to let the same mechanism unlock 1Password. Note, however, that you must still enter your 1Password master password the first time you unlock it after turning on or restarting your PC.

• Lock when the screen saver is activated (Mac): Wait, there are people who still use screen savers? You know that LCD screens don’t need saving, right? Well, if you use a screen saver as a security measure (so other people don’t see what’s on your screen when you’re not there), it may be wise to select this option. If you don’t use a screen saver, then it doesn’t matter one way or the other!

• Lock when main window is closed (Mac): Although you can manually lock 1Password at any time, even with the window open (see Lock and Unlock 1Password), some people don’t want to expend any extra effort and feel safer knowing that if the app window is closed, the data is protected immediately. If you’re such a person, select this option.

• Lock when fast user switching (Mac): This option, enabled by default, ensures that 1Password locks when you switch to a different user account without logging out first. Deselect this to leave 1Password unlocked when you use Fast User Switching.

• Lock after computer is idle for __ minutes (Mac)/Lock after computer is idle for __ (Windows): The default setting is 5 minutes, but you can enter a longer or shorter time, or deselect this option. In general, I think it’s wise to leave this turned on if there’s any chance someone else might use your computer (including thieves), although locking after only 5 minutes may force you to type your master password more often than you like. (“Inactivity” or “idle” refers to a period of time during which you don’t use the keyboard or mouse at all—such as when you’re watching a movie—not merely “time since I last did something in 1Password.”)

Clipboard

When you copy a password to your clipboard from 1Password (whether from the main app or 1Password mini), you run the (usually minuscule) risk that later, before you’ve copied something else to your clipboard, someone could come along and see your most recent password by pasting. The risk is greater if you use a clipboard utility (see Clipboard Managers) that archives everything you copy, because merely overwriting your clipboard’s contents won’t cover your tracks.

You can manage 1Password’s interaction with your clipboard using the “Clear clipboard contents after __ seconds” (Mac) or “Clear clipboard contents” (Windows) control. By default, 1Password clears whatever you copy to the clipboard from within 1Password 90 seconds later—enough time to paste it somewhere, but probably too little time for someone else to snag it. To change this delay, fill in a different number here; to prevent 1Password from clearing your clipboard at all, deselect this checkbox on a Mac, or choose “never” from the “Clear clipboard contents” pop-up menu in Windows). For most people, the default 90-second delay is more than adequate.

General:

• Show 1Password in the menu bar: If you prefer clicking an icon to pressing ⌘-Option- (or you think you might forget that keyboard shortcut) leave this selected. If you’re content with the keyboard shortcut and you want a little less menu bar clutter, deselect it.

• Keyboard shortcuts: To change the keyboard shortcuts for “Lock 1Password,” “Show 1Password,” or “Fill Login or Show 1Password,” click in the corresponding field and press the key combination you want to use.

• Show item count in sidebar: To display a number next to each sidebar entry (such as Logins, Smart Folders, and Tags) indicating how many items are in that category, select this checkbox.

• Format secure notes using Markdown: This checkbox appears in versions 7.2.2 and later. Leaving it selected gives you the option to use Markdown formatting to apply styles to your notes (see Secure Notes); if for some reason you want to ensure that they’re always plain text, you can deselect this.

Vaults:

• Always open to: To determine which vault(s) 1Password opens when you initially unlock the app, choose one of the following from the “Always open to” pop-up menu:

  • All Vaults (the default): Opens the All Vaults view, which means that searches can match items in any vault

  • Vault Name: Opens only the selected vault, which means that searches match only items in that vault

  • Last used vault: Opens whichever vault you most recently selected

• Show in All Vaults: If you want to exclude the contents of one or more vaults from All Vaults lists, deselect them here.

• Vault for Saving: As I mentioned in Save New Logins, if you have multiple vaults, you can use this pop-up menu to determine which one is used, by default, for newly saved logins and passwords.

Browsers:

• Always keep 1Password Extension Helper running: Keep this selected if you want to use 1Password browser extensions; without it, 1Password can’t communicate with them.

• Detect new usernames and passwords and offer to save them: Also covered in Save New Logins, leave this selected to enable 1Password to store logins and passwords as you browse the web. If you want to be sure 1Password never prompts you to save credentials for certain domains, enter them in the field below.

Advanced:

• Enable Spotlight and 3rd party app integrations: This option, when selected, allows Spotlight and certain third-party apps to read the names of your 1Password items. See Use 1Password with Other Utilities, next.

• Show numbers and symbols first: 1Password normally sorts items from A–Z, and any items starting with a number (such as 1Password!) or a symbol come later. Nearly everywhere else in macOS, numbers and symbols sort first in lists (a notable exception being the Contacts app). Apparently 1Password for Mac defaults to A–Z before numbers and symbols because the iOS version of 1Password does, which in turn is because the iOS Contacts app does.

  But I say two wrongs don’t make a right (although 2Wrongs should definitely be sorted before aRight). Restore order in the universe (and in 1Password’s lists) by selecting this checkbox.

• Allow creation of vaults outside of 1Password accounts: If you want to be able to create local vaults, make sure this box is checked; to force all new vaults to go in your 1Password account, make sure it is unchecked. Because you always have the option to choose where a vault goes when you create it, I can’t think of a compelling reason for this not to be checked.

Launcher Utilities

Spotlight and third-party launcher utilities such as LaunchBar, Alfred, and Quicksilver let you open files, apps, contact records, iTunes tracks, and other items on a Mac by pressing a keyboard shortcut (such as ⌘-Space) and then typing a few letters of the item’s name. All these tools can also open 1Password items—for example, if you’ve stored a login item for iCloud, you might press ⌘-Space to activate LaunchBar, type icl, and your 1Password login for iCloud should appear in the list. Select that list item and press Return to open the iCloud site and log in.

The details of how launchers work with 1Password depend on the app and on your preferences. However, they all require 1Password to export item names (but not contents) in an unencrypted form that the utilities can search. To enable this, go to 1Password > Preferences > Advanced, and select the “Enable Spotlight and 3rd party app integrations” checkbox.

Text-Expansion Utilities

Apps like TextExpander, TypeIt4Me, and Typinator automatically expand short abbreviations as you type, replacing them with longer words or phrases—or even graphics or variables. These apps can’t directly access your 1Password data, which would be handy in some situations—for example, I’d love to be able to type a TextExpander shortcut in Terminal that would automagically enter a 1Password password in order to log in to an SSH server. But for security reasons, that isn’t currently possible. (I could put my password directly in TextExpander, but then it wouldn’t be encrypted—anyone with access to my Mac could see it.)

The macOS secure input feature also means that when you’re in a password field or at a password prompt in Terminal, other apps are not allowed to monitor the keyboard. In other words, you couldn’t use a text-expansion utility to trigger a password in an actual password field, whether or not 1Password is even installed. All that to say: text expanders and passwords don’t generally have anything to do with each other in macOS.

Clipboard Managers

Numerous Mac utilities manipulate your clipboard in various ways—for example, keeping a history of everything you’ve copied, allowing you to filter clipboard contents as you paste, and providing multiple concurrent clipboards. In addition to standalone utilities of this sort, such as CopyPaste Pro, LaunchBar (mentioned earlier in this chapter) and the macro utility Keyboard Maestro support clipboard histories.

The problem is that if you’re copying and pasting passwords, you may not want them to stay in clipboard histories so that anyone with access to your computer could see your passwords in unencrypted form. 1Password attempts to address this concern by clearing the clipboard contents a given number of seconds (90 by default) after copying something—see Set Security Preferences for details.

In addition, 1Password marks values copied to the clipboard with the org.nspasteboard.ConcealedType identifier (which is explained at nspasteboard.org). This identifier signals to third-party utilities (including most clipboard managers, text-expansion utilities, and macro utilities) that the information should be treated as confidential—it’s up to the utilities to decide how they want to interpret that information.

If that capability still doesn’t produce the desired results, most clipboard managers let you specify applications from which clipboard contents should never be saved; however, excluding 1Password (for better security) may prevent useful sorts of copying and pasting.

Macro Utilities

Macro utilities—in particular Keyboard Maestro—let you automate complex sequences of tasks. Although these utilities can’t see into your 1Password data directly, you can program keystrokes into your macros to manipulate 1Password—for example, ⌘-Option- to bring up 1Password mini, a portion of a login name to search, and then Right arrow–Down arrow–Return to copy its password. (I’ll let you work out the specifics based on what you’re trying to do.)

One tricky bit is figuring out whether or not 1Password is locked, because if it is and your macro expects it to be unlocked, it won’t work. (And, you don’t want to put your master password in your macro—that would be insecure.) It may be possible to use Keyboard Maestro’s image-matching feature to determine if 1Password is locked, but I haven’t tried it myself.