1Password vs Apple Keychain

[NYCaviator]

Is there any reason to use 1Password over Apple's integrated Keychain if you are in a mostly-Apple household? Apple finally built a 2-factor authentication feature in, so the only difference I can see is cross-platform support for 1Password that you don't have with Keychain?

[MrTom]

There's still some benefits to 1Password, but I agree the gap keeps closing.

- You can organize passwords using categories, vaults, tags. There are many ways I use these, but one example is I do manage accounts for other family members for one reason or another, and I like being able to separate them out into separate vaults. Then when I go to log into a website, I have my browser defaulted to my primary vault which is only my passwords, but if I need to log in as someone else I can easily locate them.

- Secure password sharing functionality

- Ability to store more than just passwords. Reward programs and membership ids, secure notes, software licenses, etc.

- Ability to attach files. For example I have my health insurance stored, and also attach photos of the front and back of the ID card for those times when my provider or pharmacy are insistent they see the card..

- Ability to archive legacy accounts so I still have a record of them (why? I have no idea)

- Cross-platform as you mentioned. This has become less important as I no longer need to use a PC for work, but that could always change again in the future.

- Apple Watch app. You can choose to store a small list of passwords on your watch, including one time password support.

- Having quick access from the menu bar on Mac, or using a key stroke command, to look up information in 1P.

[PersonalFinanceJam]

I’ve been using the iCloud Keychain for quite some time as my password manager. The addition of TOTP a while back was very helpful for 2 factor authentication codes. The more recent addition of passkey support which is essentially yubikey for anything which supports webauthn is fantastic. Everything gets synchronized to my devices. If I need to share a password with my wife I just airdrop it to her. For any other secure items there is always the secure notes feature of iCloud Keychain. In short I find it a very capable password and security manager for anyone using the apple ecosystem. One of the main things which keeps me using it is I trust Apple to secure and protect the information more than most other companies.

[Gryphon]

One of the things that keeps me from using Keychain, aside from cross-platform concerns, is that if you have multiple passwords for a given website there's no way to differentiate them. You can't add a title or a comment to the keychain entry explaining which one is which. This is particularly an issue with banking, as many banks outsource their web site (or at least their web site authentication) to third parties like ibanking-services.com or netteller.com. At times I've had multiple logins associated with those URLs for different banks, and with Keychain I wouldn't know which one went with which bank.

[billthecat]

Keychain doesn’t really have a good way to store secure question & answer pairs. You can put it in a login’s notes but it’s unstructured. I guess I can explore entering as key: value pairs.

Keychain doesn’t store images. Like scans, and those treasurydirect.gov login images (and associated phrase).

Keychain notes don’t sync to iOS devices. Notes in the Notes app do, though. But while you can encrypt individual notes, you can’t encrypt a folder, so it would be tedious.

Keychain doesn’t support categories, tags, etc. The keychain access app on macOS is rather barebones.

I’ve tried supplementing keychain with a password protected Numbers file but it’s kind of clumsy. So I use keychain for logins plus 1Password for the additional features. So I guess I’m actually using 1Password to supplement keychain, so I haven’t really given up on keychain + Numbers file.

You can't add a title or a comment to the keychain entry explaining which one is which. This is particularly an issue with banking, as many banks outsource their web site (or at least their web site authentication) to third parties like ibanking-services.com or netteller.com. At times I've had multiple logins associated with those URLs for different banks, and with Keychain I wouldn't know which one went with which bank.

You could put info in the notes field. Then when logging in tap or click the button to access all the logins, and you can see the notes field (for the ones that have notes). Would that work?

[Gryphon]

You can't add a title or a comment to the keychain entry explaining which one is which. This is particularly an issue with banking, as many banks outsource their web site (or at least their web site authentication) to third parties like ibanking-services.com or netteller.com. At times I've had multiple logins associated with those URLs for different banks, and with Keychain I wouldn't know which one went with which bank.

You could put info in the notes field. Then when logging in tap or click the button to access all the logins, and you can see the notes field (for the ones that have notes). Would that work?

No, because it doesn't show me the notes.

[ScubaHogg]

With a keyboard shortcut I can open the 1Password extension in my browser, type the first couple letters of the website I want to go to and hit enter. 1Password opens the page and logs in. It takes bare moments to do all that. It’s a real time saver. Keychain can’t do that.

[JenniferW]

I don't like the fact that someone could knock you out -- or catch you when you are asleep -- and put your finger or face up to the iphone and get every single username and password for all your accoutns in clear text. Seems risky. Because of this security risk, I setup my iphone to be unlocked via pin only and to delete all data on phone after 10 failed pin attempts. I do use face id logging in acounts and accessing passwords but only after phone is unlocked by pincode only.

[JamesSFO]

A friend who uses Apple Keychain lost his 2FA / one time password when he updated his password it wiped out the code for the authenticator. Sigh.

[Tex]

There are some accounts that I share with my wife and/or kids. That feature doesn’t exist with Keychain. Once it does, I’d consider jumping over from 1Password Family.

[Gryphon]

I don't like the fact that someone could knock you out -- or catch you when you are asleep -- and put your finger or face up to the iphone and get every single username and password for all your accoutns in clear text.

Using your face to unlock your iPhone when your eyes are closed isn't supposed to work (though there is an accessibility setting to enable it); when I tried it just now it asked for my PIN. But yes, Touch ID is inherently less secure, you're trading security for convenience.

[billthecat]

You can't add a title or a comment to the keychain entry explaining which one is which. This is particularly an issue with banking, as many banks outsource their web site (or at least their web site authentication) to third parties like ibanking-services.com or netteller.com. At times I've had multiple logins associated with those URLs for different banks, and with Keychain I wouldn't know which one went with which bank.

You could put info in the notes field. Then when logging in tap or click the button to access all the logins, and you can see the notes field (for the ones that have notes). Would that work?

No, because it doesn't show me the notes.

Ah, it does in iOS and iPadOS, but not macOS. With iOS and iPadOS, you can tap on a (i) to see the details, including notes, but for whatever reason on macOS when you pull up the list of "other passwords" to choose one, you don't have that option.

[mnsportsgeek]

Until Apple makes the passwords accessible through icloud.com, I will be forced to stick with 1Password.

This should be possible by the way as the new advanced data protection feature has enabled end to end encryption on most of your data stored in iCloud. Add passwords and I'll drop 1Password the next day.

[ScubaHogg]

I don't like the fact that someone could knock you out

If someone is willing and able to commit violence against your person, then having a pin on your phone isn’t going to help. You should and will give them all the info they need.

Unless you are walking around with nuclear launch codes on your phone, there’s nothing in there worth getting hurt over