1Password switches its default encryption format from AgileKeychain to OPVault
Jessy / AgileBits Blog :
Context & Ripple Effects
In October 2015, AgileBits quietly changed the plumbing under 1Password: new vaults now default to the OPVault format instead of AgileKeychain. The timing matters — weeks later the company opened a public beta of 1Password for Teams, and within a year it extended $2.99/month hosted sync subscriptions beyond teams to individual customers.
Read against that arc, the format swap looks like groundwork for a shift from locally-stored vault files toward AgileBits-controlled sync infrastructure — the model that carried the company to $400M in annual recurring revenue per CEO David Faugno, and eventually to passkey support across mobile apps and browser extensions.
First-order effects
- New 1Password vaults are created in OPVault by default, while existing AgileKeychain users keep their format until they opt to migrate.
- The change lands just before the teams beta ships, making OPVault the default substrate for the multi-user, synced vaults AgileBits is about to sell.
Second-order effects
- A native format under AgileBits' control strengthens the case for its hosted sync service — the same $2.99/month subscription it rolled out to individuals in 2016 after launching it for teams and families.
Third-order effects
- If the pattern holds, the password manager's center of gravity keeps moving from an on-disk encrypted file to a hosted credential platform — the trajectory that leads to 1Password managing passkeys and eventually replacing the master password outright.
The trend: Password managers are evolving from local encrypted-file formats into hosted identity platforms whose vendor controls the vault infrastructure end to end.