How 1Password and Junify differ for shared accounts

1Password is a password manager: people keep logins in vaults, share them and have them filled in. Junify lets people sign in to your company’s shared accounts without being shown the password. So 1Password suits each employee’s own passwords, and Junify suits shared accounts that staff use but don’t need to know.

What 1Password does for a business

1Password’s business plans include Teams and Business, and the features differ by plan. In both, you share a vault with people or with groups.

In Teams, vault access comes in three levels: viewing, editing and managing. Viewing includes showing concealed passwords and copying them to the clipboard. Business splits this up. It has separate permissions for viewing, creating, editing, archiving and deleting items. It also has settings such as View and Copy Passwords: without it, the 1Password apps conceal the password from that person.

Business also has a usage report. For each item it shows who last used it, when, and how, such as copying the password, filling it or revealing it. Item history goes back 12 months.

1Password also offers:

• One-time codes for two-step verification, saved in a login item and filled in along with the username and password. On Android you copy and paste the code.
• Guests, who can open only the one vault you choose.
• In Business, sign-in through your identity provider, such as Okta or Microsoft Entra ID, which 1Password calls “Unlock with SSO”. Business can also add and suspend people from the identity provider.
• Apps for Mac, Windows, Linux, iOS and Android, plus browser extensions that also save passkeys.

1Password sells a separate Privileged Access product, which gives just-in-time access to cloud infrastructure, databases and SSH or RDP connections. This article compares password management only.

What 1Password leaves open for shared accounts

A hidden password still sits on the person’s device

1Password ranks its permissions by how they’re enforced: by encryption, by its server, or by its apps. View and Copy Passwords is in the weakest group, enforced only by the apps. The apps hide the password, but the person’s device still holds it unencrypted, and 1Password says it “could be extracted with some effort.” Its advice: “These permissions shouldn’t be relied on to prevent hostile behaviour or enforce trust.” Does hiding a shared password keep it secret? compares how the main products handle this.

Removing someone means changing passwords

1Password’s offboarding steps include reviewing the vaults the person could open and changing the passwords in them. If the person was an owner or administrator, it says to treat every password in the vaults they manage as one they have already seen. 1Password’s page on guests adds that a guest may have copied items before removal, and says to change every password they could reach. A person who is offline when suspended keeps their items until they next open 1Password while connected to the internet. The full steps are in What to stop and what to change when someone leaves a shared password manager.

Records and suspension stop at the vault

The usage report covers what people did inside 1Password, and suspending someone closes the vault. We found no way, in 1Password’s help pages for password management, to record what someone does on the service after autofill. We also found no way there to block downloads on that service or close a site the person already has open on their computer.

An invitation needs a working email address

Email invitations must go to an address with a working inbox. A sign-up link works only for addresses on the domains you allow. Part-time staff without a company email need an address that receives mail.

Using 1Password and Junify together

Split the vaults by who should know each password. Employees’ own logins, passkeys and personal vaults stay in 1Password. Shared logins that staff use for work, the ones you’d otherwise share without the View and Copy Passwords permission, move to Junify.

When you move an account, change its password on the service first. Store the new password only in Junify, and delete the old item from the vault. If you skip the change, everyone who could open that vault still signs in with the old password.

Which one fits

Everything in the 1Password column comes from 1Password’s support site and product pages, and “not found” means only that we didn’t find it there. We kept to that basis because the FTC’s statement on comparative advertising, 16 CFR 14.15(c), supports brand comparisons whose basis is clearly identified.

1Password alone is the better choice when the people sharing a login are long-term employees with working email addresses. Changing the vault’s passwords after a departure should also be manageable for you. It’s the one to pick, too, when people need passwords in desktop and phone apps or keep personal vaults and passkeys. And if you need access control for cloud infrastructure and databases, 1Password’s Privileged Access covers that.

Junify fits shared logins used by part-time staff or contractors. Under 1Password’s offboarding advice, each of their departures means changing the passwords in every vault they could open. It also fits when some of those people have no company email, or when you want downloads blocked and uploads flagged while people use the service.