Playbook

1Password — Emergency Kit and Family Recovery

Platform claims verified July 6, 2026

What this mechanism is

1Password has no built-in “after I die” feature (as of this writing — check https://support.1password.com for changes). What it has instead is the Emergency Kit: a one-page PDF containing your sign-in address, account email, and Secret Key, with a blank for your account password. Anyone holding a completed Emergency Kit can sign in to your vault from anywhere. Your estate plan for 1Password is therefore simple and blunt: complete an Emergency Kit and escrow it in AmberKey Layer 2. Family plans add a second safety net — Family Organizers can recover each other’s accounts — but that net has holes you need to know about.

Set it up now

Download a fresh copy of your Emergency Kit: sign in at 1Password.com, click your name (top right) > Manage Account > Save Emergency Kit. (You were also given one at account creation; a newly downloaded one is guaranteed current.)
Write your account password on it. An Emergency Kit without the password is only half a key — 1Password requires both the password and the Secret Key, and the company can recover neither for an individual account. Fill in the blank; digitally edit the PDF or scan the completed page.
Escrow the completed kit into AmberKey Layer 2: attach the PDF (or transcribe sign-in address, account email, Secret Key, and account password) as a secret item linked to your 1Password card.
If you use two-factor authentication on 1Password, also escrow your 2FA recovery code or note the method — kit + password can still be blocked by a second factor on a new device.
Generate a recovery code (available for individual and family accounts: account settings > recovery code, or see https://support.1password.com/recovery-codes/) and escrow it in Layer 2 alongside the kit. A recovery code plus access to your account email can restore the account even if the kit’s password is stale — it’s the second string on the bow.
If you’re on 1Password Families: make at least two people Family Organizers (Manage Account > People > invite/promote). 1Password’s own recovery docs say to “make sure at least two family or team members can recover accounts” — you can’t run standard recovery on yourself, so a family with one organizer has a single point of failure (https://support.1password.com/recovery/). Record in AmberKey who the organizers are.
Consider moving family-relevant credentials into a Shared vault so your spouse has day-to-day access without any recovery event at all.
On the AmberKey card (Layer 1), record: account type (individual/Families/Business), account email, sign-in address (e.g., my.1password.com or yourfamily.1password.com), who the organizers are, and the date you escrowed the kit.
Set a reminder: whenever you change your 1Password account password, re-escrow the kit (see Gotchas). Also regenerate/re-escrow if you ever rotate your Secret Key.

What AmberKey stores

Layer 1 (metadata): account type, account email, sign-in address, names of Family Organizers, date the kit was escrowed.
Layer 2 (bearer secret): the completed Emergency Kit — sign-in address, account email, Secret Key, and the account password written in — plus the recovery code and the 2FA recovery code if applicable. These are full-access bearer credentials; they belong nowhere else.
Do not keep an incomplete kit (no password) and call it done; and do not store the account password in Layer 1 metadata.

What your survivors do

Find the 1Password Emergency Kit in the AmberKey vault (Layer 2). It has everything on one page: a web address to sign in at, an email, a “Secret Key” (a long code starting with A3-), and the account password.
Go to the sign-in address on the kit (or 1password.com > Sign in). Enter the email, the Secret Key, and the account password exactly as written. You’re in — you don’t need to contact 1Password, and no death certificate is needed for this step.
Export a backup of everything first (on 1Password.com or in the desktop app: look for Export), before changing anything.
Use the vault together with the AmberKey packet: the packet tells you which accounts matter most and what to do for each. Keep the deceased’s email accounts alive until the end — password resets for everything else land there.
If the kit’s password doesn’t work but the vault has a “recovery code”: go to the 1Password sign-in page, choose the recovery option, and enter the code. You’ll need access to the deceased’s email inbox to confirm it (see the Google/Apple playbooks in this packet). Recovery issues a new Secret Key and lets you set a new account password.
If the kit is missing or doesn’t work, and the family has 1Password Families: any Family Organizer can recover the account. The organizer signs in at 1Password.com, selects People in the sidebar, chooses the person’s name, and clicks Begin Recovery. A recovery email goes to the deceased’s email address — so again you need their inbox. Following the link issues a new Secret Key and a new password; the organizer then clicks Complete account recovery to finish.
If there is no kit, no recovery code, and no organizer: check whether any of the deceased’s devices still has 1Password signed in — a phone or laptop that unlocks with a device passcode (possibly in Layer 2) or biometrics you can’t use, but a passcode you can. A signed-in app can export the vault. If none exists, 1Password support cannot restore access to an individual account — the encryption genuinely prevents it. What remains is account-by-account password resets via the deceased’s email, guided by the AmberKey packet’s account list.

Required documents

With the Emergency Kit: none. It’s a bearer credential.
Family Organizer recovery: none — but it requires access to the deceased’s email inbox to click the recovery link.
1Password support cannot grant access to an individual account with any amount of paperwork; there is no death-certificate process that unlocks a vault.

Expected timeline

With the kit: minutes.
Family recovery: minutes to hours, gated on reaching the deceased’s email.
Without either: days-to-weeks of account-by-account resets — this is the outcome the escrowed kit exists to prevent.

Gotchas

The kit goes stale the moment you change your account password. The Secret Key rarely changes, but the handwritten password is only as current as your last escrow. Make “changed 1Password password → re-escrow kit” a reflex; a stale kit fails at the login screen with no error explaining why.
An Emergency Kit is a skeleton key. Anyone holding a completed kit owns your entire digital life, silently, with no waiting period (contrast Bitwarden’s timer). This is exactly what Layer 2’s encryption and your recovery circle’s quorum are for — never leave a completed kit in a desk drawer or an unencrypted cloud folder.
A single Family Organizer is a single point of failure. Standard recovery is something others do for you; if the person who died was the only organizer, family recovery is off the table for their account (their kit or recovery code is the only way in), and the surviving family also loses the ability to recover each other until someone gets into an organizer account. 1Password’s docs recommend at least two people who can recover accounts. Two organizers, always.
Any recovery resets the Secret Key. Family recovery and recovery codes both issue a new Secret Key — which silently invalidates any previously escrowed Emergency Kit for that person. If a recovery is ever performed, re-escrow the new kit (and generate a fresh recovery code) the same day.
Recovery emails go to the dead person’s inbox. Family recovery quietly depends on email access — which is why the Google/Apple playbooks in this packet matter and why email gets settled last.
2FA can still block a valid kit. A new device may demand the second factor. Escrow the 2FA recovery code alongside the kit, or the kit may not be enough.
Business accounts differ. Team admins/owners can recover member accounts; a work 1Password account is the employer’s to recover, not the family’s. Don’t plan the family’s access around a work account.