iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Open Watchtower from the 1Password app’s sidebar, or sign in to 1Password.com, select a vault, and choose Watchtower. Review the categories with affected items, then fix each issue at the relevant website or account and update the saved item. An alert identifies something to check; it does not, by itself, mean that your account has been taken over.
Find Watchtower and focus on the items you manage
In a 1Password app, select Watchtower in the sidebar. On 1Password.com, sign in, choose a vault, and select Watchtower. The dashboard groups findings by category. Select a category or choose Show items to inspect the affected entries. You can filter the view by account, collection, or vault. The exact categories shown depend on your saved data and which checks are enabled. 1Password’s Watchtower guide describes the dashboard and its controls.
Understand what each Watchtower finding means
Compromised websites and vulnerable passwords
Compromised websites flags a saved login for a site where a breach has been reported when the password has not been changed since that breach. Vulnerable passwords identifies passwords that have appeared in a data breach. The latter finding concerns the password; it does not establish that an attacker knows which account used it. For either alert, change the password on the affected site and save the replacement in 1Password. Treat a weak or reused exposed password as a priority. 1Password explains these categories and recommended actions.
Reused and weak passwords
Reused passwords identifies saved items that share a password. Change these so one exposed credential cannot put multiple accounts at risk. Weak passwords are easier to guess; replace them with strong, unique values. Use 1Password’s password generator rather than making a small, predictable change to the old password.
#1 Best Overall
- ✅ PROTECT ONLINE ACCOUNTS – A password manager, two-factor security key, and secure communication token in one, OnlyKey can keep your accounts safe even if your computer or a website is compromised. OnlyKey is open source, verified, and trustworthy.
- ✅ UNIVERSALLY SUPPORTED – Works with all websites including Twitter, Facebook, GitHub, and Google. Onlykey supports multiple methods of two-factor authentication including FIDO2 / U2F, Yubico OTP, TOTP, Challenge-response.
- ✅ PORTABLE PROTECTION – Extremely durable, waterproof, and tamper resistant design allows you to take your OnlyKey with you everywhere.
- ✅ PIN PROTECTED – The PIN used to unlock OnlyKey is entered directly on it. This means that if this device is stolen, data remains secure, after 10 failed attempts to unlock all data is securely erased.
- ✅ EASY LOG IN –No need to remember multiple passwords because by plugging OnlyKey to your computer, it automatically inputs your username and password. It works with Windows, Mac OS, Linux, or Chromebook, just press a button to login securely!
Passkeys available and two-factor authentication
Passkeys available means a supported site offers passkeys but the saved item does not contain one. Use the item’s passkey action and follow that site’s enrollment process if you want to switch. Two-factor authentication identifies a site that supports 2FA when the saved item has no one-time password. Review the site’s options and follow its setup instructions; the alert is not a claim that every service implements 2FA the same way.
Unsecured websites
Unsecured websites flags a saved address beginning with http:// when 1Password knows the site supports HTTPS. If the item offers Use HTTPS, confirm the site supports HTTPS before updating the URL.
Rank #2
- ✅ PROTECT ONLINE ACCOUNTS – A password manager, two-factor security key, and secure communication token in one, OnlyKey can keep your accounts safe even if your computer or a website is compromised. OnlyKey is open source, verified, and trustworthy.
- ✅ UNIVERSALLY SUPPORTED – Works with all websites including Twitter, Facebook, GitHub, and Google. Onlykey supports multiple methods of two-factor authentication including FIDO2 / U2F, Yubico OTP, TOTP, Challenge-response.
- ✅ PORTABLE PROTECTION – Extremely durable, waterproof, and tamper resistant design allows you to take your OnlyKey with you everywhere.
- ✅ PIN PROTECTION – Locking your device means that if this device is stolen, data remains secure, after 10 failed attempts to unlock all data is securely erased.
- ✅ EASY LOG IN – No need to remember multiple passwords because by plugging OnlyKey to your computer, it automatically inputs your username and password. It works with Windows, Mac OS, Linux, or Chromebook, just press a button to login securely!
Items in another account
Items in another account means a login contains an email address associated with a different 1Password account than the one where the item is saved. If appropriate, move the login to the right account or vault.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Developer secrets on disk
Desktop users who have configured Developer Watchtower can find plaintext secrets such as SSH private keys and .env files. Review these from the Developer area and import or otherwise address them there.
Rank #3
- FIDO2 + FIDO U2F certified and supported USB security key
- Supports Computers, Laptops, Tablets, and Mobile Devices with a USB-C port
- Works without downloading any drivers. Supported OS: Android, Chrome OS, Windows, MacOS, Linux
- Durable design made to last for a long time with everyday use. Water-resistant (IP67)
- Helps protect your accounts from phishing and other cyber-attacks. Prevents your devices from unauthorized use.
Fix the highest-risk findings first
- Start with compromised sites, exposed passwords, and reused credentials. Change the password at each affected site, then update the saved login in 1Password. Changing it only in the vault does not change the password on the site.
- Make each account’s password unique. Replace weak values with strong generated passwords, and save them with the correct login.
- Turn on a second factor where it makes sense. Use the site’s own setup instructions for 2FA; Watchtower’s alert means the saved item has no one-time password recorded, not that OTP is the only possible second factor.
- Consider passkeys and HTTPS corrections. Enroll in a passkey through the supported site if desired. Update an HTTP URL only after verifying that the site supports HTTPS.
- Review the dashboard again. Use account, collection, or vault filters to focus on the items you are responsible for and check whether the relevant findings have cleared.
Manage checks and alerts
In the apps, select the account or collection and open Settings > Privacy to manage Watchtower checks; the precise control location can vary by client. On 1Password.com, choose the account or vault context, open Settings, then the Watchtower section. To receive an alert when a website is added to Watchtower, the browser guide gives this path: open the account menu, select Settings > Security & privacy, then enable Check for vulnerable passwords. Items needing attention can also show an alert banner. See the Watchtower guide and the browser guide for current client-specific details.
What happens to password data during checks?
According to 1Password’s Watchtower privacy documentation, checks for reused passwords, weak passwords, unsecured websites, and expiring items run locally on the device. For compromised websites, the app downloads Watchtower data and compares saved website information locally.
For vulnerable-password checks, 1Password says it creates a 40-character hash for each password and sends only the first five characters of each hash to Have I Been Pwned. That service returns matching hash prefixes for comparison on the device; 1Password says the password itself is not sent. The documentation also cautions that similar weak passwords could create a privacy risk if the breach-check service acted maliciously. Its practical advice is to change identified passwords and use strong, unique generated values. These are 1Password’s documented implementation details; consult its privacy page for the current description.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallHow Watchtower differs for 1Password Business
The personal Watchtower dashboard is distinct from organization reporting. 1Password Business Insights can provide organization-wide views of breach findings and password health, including compromised, weak, and reused credentials and items without 2FA. Administrators can inspect details and use Watchtower to help remediate items; Business Watchtower reports can also track issues across shared vaults. See 1Password Business Insights documentation for that organization-level workflow.
Quick Recap
Best Value
- NIST Certification: FIPS 140-3 validated for government and regulated organizations (Overall Level 2, Physical Security Level 3).
- Works with 1000+ Accounts: Supported by Google and Microsoft accounts, Identity Access Managers, password managers and 1000+ popular services. It works with operating systems and browsers including Windows, macOS, Chrome OS, Linux, Chrome, and Edge.
- Fast & Convenient Login: Plug in your YubiKey via USB-C and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required.
- Most Secure Passkey: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- Built to Last: Made from tough, waterproof, and crush-resistant materials. Made in Sweden with the highest security standards.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
