Claude can now sign in to websites — passwords enter the page, never the AI context
TL;DR
1Password lets Claude sign in through a local encrypted channel without exposing passwords or TOTP to the model.
On July 16, 1Password began letting Claude use vault credentials to sign in to websites without giving passwords or one-time codes to the AI model. Claude knows which login was used, but secret values do not enter the model context, memory, or Anthropic's systems.
When Claude reaches a login page, it requests a specific item from 1Password. The user can switch accounts, deny the request, or approve it with Touch ID or another biometric check. The desktop app then sends the credential over a local secure channel to the browser extension, which fills it directly into the matching website. Every new agent session requires authorization; Claude receives no standing vault access.
1Password's technical design uses native IPC to identify Claude on Mac and verifies Anthropic's Apple Developer signature. The desktop app and extension communicate through a mutually authenticated Noise-based encrypted channel. Approved items are protected with AES-256-GCM and held only in memory. The cache is destroyed when the task ends, the browser closes, or a nine-hour hard limit is reached.
Agentic Mode hides the 1Password interface while Claude controls a tab, leaving only logins approved for the current task available. Claude stops reading the page during autofill and resumes after submission; if submission fails, 1Password first clears every filled value. The beta currently supports usernames, passwords, and TOTP from Login items. Passkeys, payment cards, and identity records are not supported.
The beta is available on Claude Pro, Max, Team, and Enterprise plans for 1Password individual, family, and business accounts. It is limited to macOS and requires both desktop apps plus Chrome extensions. 1Password lists two boundaries: a fully compromised Mac can defeat local protections, and its guarantees do not govern what Claude does inside a website after login.
via 1Password / 1Password Security / 9to5Mac / SiliconANGLE
When Claude reaches a login page, it requests a specific item from 1Password. The user can switch accounts, deny the request, or approve it with Touch ID or another biometric check. The desktop app then sends the credential over a local secure channel to the browser extension, which fills it directly into the matching website. Every new agent session requires authorization; Claude receives no standing vault access.
1Password's technical design uses native IPC to identify Claude on Mac and verifies Anthropic's Apple Developer signature. The desktop app and extension communicate through a mutually authenticated Noise-based encrypted channel. Approved items are protected with AES-256-GCM and held only in memory. The cache is destroyed when the task ends, the browser closes, or a nine-hour hard limit is reached.
Agentic Mode hides the 1Password interface while Claude controls a tab, leaving only logins approved for the current task available. Claude stops reading the page during autofill and resumes after submission; if submission fails, 1Password first clears every filled value. The beta currently supports usernames, passwords, and TOTP from Login items. Passkeys, payment cards, and identity records are not supported.
The beta is available on Claude Pro, Max, Team, and Enterprise plans for 1Password individual, family, and business accounts. It is limited to macOS and requires both desktop apps plus Chrome extensions. 1Password lists two boundaries: a fully compromised Mac can defeat local protections, and its guarantees do not govern what Claude does inside a website after login.
via 1Password / 1Password Security / 9to5Mac / SiliconANGLE
