TORONTO — Since launching its public beta in May 2006, Toronto-based 1Password has become one of the world’s most popular tools to help businesses keep track of digital passwords across multiple platforms. But about a decade and a half later, the company rolled out its new passkey feature in beta in June—paving the way for a passwordless future.

As artificial intelligence threatens to help cybercriminals perform more sophisticated attacks, CEO Jeff Shiner told The Logic that he believes passkeys will help combat some of those new challenges by making it impossible for them to steal user credentials. A passkey consists of two parts: a private key on a trusted device like a smartphone that is protected by biometrics or a PIN, and a public key that’s shared with the app or website—anyone can encrypt using the public key, but only the private key can decrypt it and authorize a login. 

1Password bought Texas-based ID authentication startup Passage for its passkey technology last November, deploying some of the funds from its record-breaking US$620-million Series C in January 2022, which valued the Toronto firm at US$6.8 billion. The company was bootstrapped until 2019, when it accepted a US$200-million Series A led by Accel.

In an interview with The Logic on the sidelines of the Collision tech conference in June, Shiner talked about AI’s impact on cybersecurity, the future of passkeys in online retail and 1Password’s relationship with Big Tech.

This interview has been edited for length and clarity.

1Password used to turn down external funding and then, at the beginning of last year, you raised one of the biggest funding rounds in the country. What changed?

The truth is, back in 2019, I didn’t know how to [grow the company] alone. We were such a private company, people didn’t know—are we making any money? Do we have any customers? It was hard to attract world-class leaders, and that was what led to the US$200-million round with Accel.

Going into the start of 2022, the purpose [of the US$620-million round] was twofold. One: I wanted what we call “courage capital,” so that should companies like Passage and more come, we don’t have to raise for the purpose of an acquisition. The other thing: I wanted to bring on Iconiq Capital as a lead investor. If we do things like go public in the future, a decision we haven’t firmly made, [Iconiq and Accel] would be companies that could guide us through that.

How has the US$620 million changed things for 1Password and where have the funds been deployed?

It hasn’t changed much.

Bluntly, a lot of the funds haven’t been deployed yet. We continue to look for opportunities in different apps—not going to share which ones—but opportunities in different areas for things like acquisitions where they can help move us forward.

How is 1Password thinking about AI?

I think the biggest impact AI is going to have is worsening the security challenges that businesses face. The most obvious example is phishing. They will be able to create a much more targeted attack. Imagine a Zoom call from somebody who you believe you know, who sounds like them, looks like them and talks about things that they would talk about. AI will very quickly become smart enough to fool far more than the average person.

With a passkey, there is no credential that you can give them, and that’s taking the reward away. As we go a little further, I think passkeys are the first of what will probably be many of these, replacing a credential with what I’ll call a token. Instead of providing your address when you go to a retail site, you should just be able to provide a token that the shipping service can understand, but is meaningless to anybody else—same thing with credit cards and driver’s licenses. As an industry, we need to look at how we turn digital identity more into “proof of” as opposed to providing that information.

Is 1Password using any AI tools in its operations?

I’m not going to share everything we use, but one of the important things about 1Password as it relates to anything you put in a vault, like all of your data—it’s just encrypted blobs to us, we have no ability to decrypt that information.

That said, I think there’s lots of ways that we can leverage AI as a business. I even use it for internal notes and things like that. In terms of the ability to rephrase things, I think AI is going to significantly change how people do work, I think in the most case for the positive.

You acquired Passage late last year for its passkey technology. What’s the plan?

I like to shop at Home Depot. If you go in and try to register at Home Depot, you’re going to end up with a page that says, “Please choose a password,” and make it 12 characters and this, that and the other thing. It’s a pain, right?

What happens when that person comes back, puts something in their cart and checks out? Now they’ve forgotten their password, so Home Depot has carts that are abandoned or interrupted. Not only are the Home Depots of the world very quickly going to look at passkeys and say, “Hey, we don’t have to store millions of people’s passwords anymore,” which is a big security benefit, but on their marketing and sales side they’re saying, “Man, now we can avoid a bunch of these abandoned carts.” To the end user, it’s good for them because they also have an easier experience. That’s the trifecta of awesomeness.

It’s going to be an advantage to a business to offer a passkey experience to their customers. But 12 or maybe 18 months from now, it will be a disadvantage to the businesses who don’t offer a passkey experience.

You’re saying that in about 12 months they’ll become more or less standard among the large online retailers?

Not just retailers, but you think of almost any SaaS app, they have the same thing. It’s all of the same issues now with almost any app.

How would you compare 1Password’s product to Apple’s digital security?

The platform players have always been a hugely necessary part of the solution. How do you educate millions on the need for secure passwords for secure practices? That’s a role that they’ve played. When iCloud Keychain came out 10-ish years ago, our business doubled. When browsers got their first password managers, our business doubled. Why does it grow each time? Because of education.

Microsoft, Apple, Google—they’re all in the FIDO Alliance, as is 1Password. What’s that relationship like between 1Password and Big Tech on that level of collaboration?

It’s been surprisingly positive and I think we’re starting to see the impact of that. Overall, there’s a recognition that when it comes to people’s private information, it should be their choice as to where that information is stored and how that information is stored, and that means making it available.

Things like you saw at Apple’s Worldwide Developers Conference, where Apple is opening it up so that passkeys can be moved into things like 1Password. I think we’ll see more and more of it from a legislation side as well, and I think having the opportunity to store it in an independent security [or] privacy-focused service like ours is very important.

Are there any plans to cut staff in the near future?

In terms of hiring overall—no—we continue to hire. We’re just hitting 1,000 people right now. We’ll probably end the year around 1,100. Our hiring in 2023 is certainly going to be less than it was in the first half of 2022, but we are continuing to grow and we are continuing to hire.