1Password passes $500 million ARR as the password vault becomes an agent-access gate

A revenue milestone meets a new kind of user

A password manager normally helps a person reach an account. An autonomous assistant changes that relationship: the person may want to delegate a task without handing the assistant a reusable secret. 1Password’s latest announcements put those two businesses—protecting credentials and mediating delegated access—on the same commercial map.

In its October 22 company announcement, Toronto-based 1Password said it had surpassed $500 million in annual recurring revenue and now served more than 200,000 business customers. On the same day, its separate 1Password for Agents release described a way for personal AI assistants to sign in after a user’s approval without receiving the underlying password. The revenue milestone is reported by the company and corroborated in BetaKit’s October 22 reporting; it is not a new funding round.

The distinction matters because annual recurring revenue is not money newly invested in the company, cash collected that day, or a statement of net profit. It describes recurring revenue at an annualized scale. The figure offers a view of the business’s size, not a complete set of accounts or a valuation. No inference about a future flotation follows from it.

What the growth figures actually measure

The company reports approximately 60 percent growth in net new ARR through the first three quarters of its 2026 financial year, with approximately 90 percent year-over-year growth in that measure during the third quarter. These are growth figures for net new ARR, not a claim that the entire recurring-revenue base rose 90 percent. That difference is easy to lose in a headline and important when judging the pace of a larger subscription business.

Its release also says business customers account for more than 75 percent of ARR. Developer and AI security tools are used in 16 percent of business accounts, according to the company. Those figures describe a business with a substantial enterprise base and a smaller, identified subset using these tools; they do not establish that every customer is running autonomous agents.

1Password attributes its acceleration to developers and AI builders. That is management’s explanation, not an independently established causal result. A sensible reading is narrower: the company reports commercial growth alongside adoption of tools designed for developer and machine access. The announcement does not isolate how much revenue comes from each new agent feature, nor does it demonstrate that an agent integration caused a particular customer to spend more.

For founders, the analytical question is whether a new workflow expands an existing product’s role or simply adds a feature customers expect to receive with their subscription. The supplied figures do not settle that question. They do show why an established credential service would try to remain involved when the actor signing into an account is no longer always a person.

The sign-in handoff, examined

The personal-agent mechanism is specific. In the company’s description, an agent reaching a sign-in form uses a unique digital key to verify its identity to 1Password. The person sees the requested credential and the reason for the request, and decides whether to approve it on their own device. 1Password then fills the credential into the form rather than sending it to the agent. The assistant proceeds with its task after signing in.

That design attempts to separate the ability to use an account from possession of its password. As an explanatory example, an assistant asked to prepare an expense report might need to enter a service, while its user would not want a permanent copy of the login secret in the assistant’s context. This is an illustration of the delegation problem, not a claim that a particular expense workflow was tested by Foundra.

There is also an important boundary after authentication. Keeping the secret away from the assistant does not, by itself, tell us what the signed-in assistant can read, change, or submit. A system can protect a password while still exposing powerful account actions through the resulting session. Evaluating those actions requires attention to the destination service’s permissions and the assistant’s task controls, not just the sign-in screen.

The next evidence should be operational

1Password’s announcements discuss both personal-agent integrations and its broader Unified Access platform for people, agents, and machine workloads. These should not be flattened into one universal security guarantee. The personal sign-in flow described above is not evidence that every integration automatically applies every enterprise access control, or that every authenticated session expires when a task ends.

A useful product evaluation would therefore ask what happens when a request is refused, when an assistant needs a different account, or when a task changes after approval. It would also examine what users can see about completed actions and what control they retain over a signed-in session. Those are proposed checks, not reported failures. Foundra has not tested the integration or independently assessed its security.

The commercial story is substantial without treating the product announcement as proof of effectiveness. 1Password reports a half-billion-dollar recurring-revenue business and is trying to extend its place in the access workflow. The product’s practical value will depend on whether delegation remains understandable to users after the password itself disappears from view.