my passwords are not hidden when vault is shared

crs123
crs123
Community Member
in Business and Teams

I created a vault on my business account with login and password information in it, then shared it with my assistant (with the goal of keeping the password hidden and confidential from them) but the assistant can still reveal the password on their end, using the reveal function from the browser. My assistant is a “guest” on my 1Password account. I made sure “edit” was disabled from my assistants profile. Am I missing something? Is it not possible to hide passwords from guests on 1Password?

Comments

  • ag_max
    ag_max

    Hi @crs123,

    If using 1Password Business, you can restrict team members and guests from viewing the password field of items, leaving it concealed within the 1Password ecosystem. To enforce this, the user and group permissions (if the user is part of a group with access to that vault) must not include View and Copy Passwords.

    That said, after your password has been autofilled on a webpage, it leaves the 1Password ecosystem and permissions controls. At that point, a person could take steps to try and view that password from their browser by doing the following:

    • If a website supports it (Gmail for example), a user could click the "Show password' box under the password field to reveal it.
    • Alternatively, they could use a 3rd-party browser extension or browser developer tools to view the page elements and potentially find the filled password there.

    There isn't a way for 1Password to prevent the above actions on a webpage. We can only control what happens in 1Password itself. What this mainly means is, should any employee leave your company, it's recommended to take the time to change any passwords they may have had access to, as a precaution.

    Just to check, can you confirm where your assistant is able to reveal the password, in 1Password or after filling the password on the webpage?

This discussion has been closed.