1Password Chrome Extension: How It Works and How to Set It Up in New Zealand

Your web browser is where most account logins happen, which also makes it where most credential theft happens — through phishing pages, reused passwords and malware that reads whatever the browser has saved. A dedicated password manager that plugs into the browser is one practical way to reduce that risk without slowing down everyday sign-ins.

The 1Password Chrome extension is the browser component of the 1Password service. It stores your logins, credit cards, passkeys and secure notes in an encrypted vault, then fills them into websites when you need them. This guide explains what the extension actually does, how its security model works, what it costs, how to install it, and a few things New Zealand users should know — without treating it as the only option. If you are still deciding between products, start with our wider password manager guide for New Zealand.

What the 1Password Chrome extension is

1Password is a subscription password manager made by AgileBits Inc. The Chrome extension is not a standalone product; it is a front end for your 1Password account. Everything you save is encrypted on your own device before it is synced, using AES-256 encryption. 1Password describes this as a "zero-knowledge" design, meaning the company stores your vault but cannot read its contents.

The extension works in Google Chrome and in other Chromium-based browsers such as Microsoft Edge, Brave and Arc, as well as in Firefox and Safari. On desktop it is designed to pair with the 1Password desktop app, which handles biometric unlocking and keeps the extension unlocked in the background. You can run the extension on its own, but you then unlock it with your account password each time rather than with a fingerprint or face scan.

How the security model works

Most browser-based password stores protect your data with a single secret — usually the password to your Google or browser account. 1Password uses two factors that are combined to encrypt your vault: your account password (which the company used to call the master password) and a Secret Key.

The Secret Key explained

The Secret Key is a 34-character string of letters and numbers that is generated on your own device when you first set up your account. According to 1Password’s documentation it adds 128 bits of entropy, is never sent to the company in full (only the first eight characters are used to identify your account), and cannot be recovered by 1Password if you lose it.

In plain terms: an account password that a person can memorise can only be so strong, so the Secret Key does the heavy lifting against brute-force attacks. Even if 1Password’s servers were breached, an attacker would still need your Secret Key — which only exists on your devices — to decrypt anything. The trade-off is that you are responsible for that key. 1Password provides an Emergency Kit (a PDF containing your Secret Key and sign-in address) that you should save or print and store somewhere safe, because a lost Secret Key with no other signed-in device can mean permanent loss of access.

What the extension does day to day

Once installed and unlocked, the extension adds a small icon inside login fields and a button in the Chrome toolbar. Its main jobs are saving new logins, filling existing ones, generating strong passwords, and handling two-factor codes and passkeys.

Autofill and saving logins

When you sign in to a site for the first time, the extension offers to save the username and password. On return visits it detects the matching entry and fills it with a click or a keyboard shortcut. It reads a page’s form fields to work out where credentials, addresses and card details should go, which usually handles multi-step and less conventional login pages. When a site’s layout confuses the automatic detection, you can right-click a field and choose the entry manually. Its built-in password generator can create long random passwords at the moment you sign up, so you never have to invent or reuse one.

Built-in two-factor codes

1Password can store two-factor authentication (2FA) secrets and generate the rotating six-digit, time-based one-time passwords (TOTP) itself, so a separate authenticator app is optional. When it fills a login, it can copy the current code to your clipboard ready to paste. For added safety you can set 1Password to clear the clipboard automatically after a short delay so codes do not linger there. Keeping your login and its 2FA code in the same tool is convenient, though some people prefer to keep the second factor in a separate app or hardware key so that one compromise does not expose both.

Passkeys in the browser

The extension supports passkeys, the newer passwordless sign-in standard that replaces a password with a cryptographic key pair tied to a specific website. When a supported site offers to create a passkey, 1Password can save it in your vault and later sign you in with it after a biometric or account-password check. Because a passkey is bound to the real domain, it cannot be handed to a fake look-alike site, which makes it resistant to phishing by design. 1Password supports saving and using passkeys across its major browser extensions.

Phishing protection and Watchtower

The extension only offers to fill credentials on a domain that matches the one saved with the entry. If you click a link in a scam email that leads to a convincing copy of your bank at a slightly different address, the saved login will not appear — a useful signal that the page is not what it claims to be. This does not block the page or replace safe browsing habits, but it removes the one-click autofill that phishing relies on.

1Password also includes Watchtower, a built-in monitor that flags weak, reused or old passwords, accounts that appear in known data breaches, and logins that support but do not yet use two-factor authentication. You can act on those alerts from the extension without opening the desktop app. Treating password hygiene as part of your wider cyber security routine — rather than a one-off setup — is where a tool like this earns its keep.

How it compares with Chrome’s built-in password manager

Chrome already offers to save and fill passwords for free, so it is fair to ask what a paid tool adds. The main differences are how the data is protected, where it works, and what extra security checks come with it.

For someone who only ever uses Chrome on one platform and wants something free, the built-in manager is a reasonable baseline. A dedicated tool earns its place when you use more than one browser or operating system, want breach monitoring and integrated two-factor codes, or prefer that your vault is not tied to the same account you use for email and everything else Google.

How to install it in Chrome

Setting up the extension takes a few minutes. Before you start, make sure you are running an up-to-date version of Google Chrome; you can read more about the browser on Wikipedia.

1. Create or sign in to a 1Password account. A subscription (or an active free trial) is required; there is no permanently free tier.
2. Install the desktop app (recommended). On Windows or macOS, install the 1Password app first so the extension can use biometric unlock and stay signed in securely in the background.
3. Add the extension from the official source. Open the Chrome Web Store, search for "1Password" and confirm the publisher is AgileBits Inc. before adding it, or use the download link in the Quick Facts box above.
4. Connect and unlock. Sign in with your account, then unlock using your fingerprint or face if the desktop app is installed, or with your account password otherwise.
5. Pin the icon. Pin the 1Password button to the Chrome toolbar so it is always one click away.

Settings worth adjusting

The defaults are reasonable, but a few changes in the extension’s settings (click the toolbar icon, then the settings cog) tighten things up:

• Auto-lock timer: set the vault to lock after a short period of inactivity so it is not left open on a shared or unattended machine.
• Lock on sleep: enable locking when the computer sleeps, so the vault closes when you shut the laptop lid.
• Turn off Chrome’s own password prompts: disable Chrome’s built-in password saving so you are not keeping duplicate, separately secured copies of the same logins.
• Set clipboard clearing: confirm that copied passwords and one-time codes are cleared from the clipboard after a set time.

Using 1Password with New Zealand services

The extension is not region-locked and works the same on any New Zealand broadband connection — Spark, One NZ, 2degrees or a Chorus fibre plan — because syncing only needs an ordinary internet connection. In practice it fills logins on the sites Kiwis use most, including online banking with ANZ, ASB, BNZ, Westpac and Kiwibank, government services such as RealMe, IRD’s myIR and ACC, investment platforms like Sharesies and Hatch, and everyday sites such as Trade Me and power-company portals.

A password manager is particularly worth having for accounts tied to money and identity. Giving each bank, tax and utility login its own long, random password means a leak at one site cannot be used to walk into the others. If you are weighing 1Password against a free alternative, our comparison of 1Password and Bitwarden looks at the trade-offs in detail, and our full 1Password review covers the wider service beyond the browser.

Pricing and plans

1Password is subscription-only, with a 14-day free trial and no permanent free plan. Prices are set in US dollars and are the same features whether you use the extension or the apps. The rates below are 1Password’s advertised personal pricing at the time of writing; the headline Individual rate is an introductory first-year price for new customers, so always check the official page for the current figure and any local (GST-inclusive) pricing.

Buying directly through 1Password’s website rather than through an app-store in-app purchase generally keeps billing simpler and avoids store surcharges.

Limitations to know

No password manager is perfect, and it is worth going in with clear expectations:

• No free tier. Once the 14-day trial ends, continued use requires a paid subscription. Free alternatives exist if cost is the deciding factor.
• Reliance on the desktop app for biometrics. If the desktop app is closed or crashes on a low-memory machine, the extension may drop its biometric link and ask for your account password again.
• You own the recovery. Because 1Password cannot recover your Secret Key, losing it along with access to every signed-in device can lock you out for good. Keep your Emergency Kit safe.
• Occasional form quirks. A small number of unusual or dated website layouts can confuse autofill; the manual right-click fill is the workaround.

For most people, the value is in removing reused and weak passwords across dozens of accounts and making strong ones effortless to use. Whether 1Password specifically is the right choice depends on your budget and whether you prefer an all-in-one paid tool or a free open-source one.

Frequently Asked Questions

Is the 1Password Chrome extension free?

No. The extension itself is free to install, but it only works with a 1Password account, which is a paid subscription. There is a 14-day free trial and no permanent free tier, so after the trial you need an active plan to keep using it.

What happens to my data if 1Password’s servers are breached?

Your vault is encrypted on your own device before it syncs, using both your account password and your 34-character Secret Key. The Secret Key never leaves your devices in full, so a breach of the company’s servers would expose only unreadable encrypted data.

Can I unlock the extension with my fingerprint or face?

Yes, if you also install the 1Password desktop app. The extension connects to the app, which lets you unlock with Windows Hello or Touch ID. Without the desktop app you unlock the extension with your account password instead.

Can I save and use passkeys in Chrome with 1Password?

Yes. The extension can create, store and sign in with passkeys on supported websites, and it authorises them with a biometric or account-password check. Because passkeys are tied to the real domain, they resist phishing.

Does the extension work with New Zealand banks and government sites?

Yes. It is not region-locked and fills logins on sites such as ANZ, ASB, BNZ, Westpac, Kiwibank, RealMe, myIR and Trade Me. If a page’s layout stops autofill working, right-click the field and choose the saved login manually.