Changed my master password via the 1password application for Mac OS X. Shortly launched the 1passwo

John D
John D
Community Member

Changed my master password via the 1Password application for Mac OS X. Shortly thereafter launched the 1Password application with the new master password, no problem. A few hours later, and for more than a day since, 1Password application rejects the new master password. Tried to log in via the 1Password web page, also rejected. Old master password also rejected. Can still access my 1Password vault on my iPhone via the iOS app using TouchID. Now, on my Macs I have to manually enter login data by reading the screen of my iPhone. Need to restore functionality of the Mac OS X application and the web page.


1Password Version: 7.2.5
Extension Version: 4.7.3.90
OS Version: 10.14.4
Sync Type: Not Provided
Referrer: forum-search:new master password won't work

Comments

  • ag_ana
    ag_ana
    1Password Alumni

    Hi @John D!

    Have you ever been able to login to the 1Password website, even before changing the Master Password?

    Because I think, reading your post, that you didn't change the Master Password for your 1Password account, but rather the password that protects your 1Password app. Only if you have additional standalone vaults you can change the Master Password from the 1Password app. If you only have a Membership, you can only change the password through the website.

    If you could give us some more details about you configuration, it would be really appreciated. Thank you!

  • John D
    John D
    Community Member

    Yes, I've logged into the 1Password web site for at least a couple of years. It's the only way to access my passwords in the office, where we're not allowed to install 3rd party applications on our desktops.

    To clarify, I changed the password via the Preferences function in the 1Password application for Mac OS X. After the initial success in using the new password once in the application, I have not been able to successfully use it again in either the desktop OS X application or on the website.

    I can access my passwords using the iOS app on my iPhone, by opening the 1Password app using iTouch. When I open it, it gives me an alert that there is a discrepancy in my master password. It asks me to enter my new master password, but I can ignore that by tapping "not now" at which point the app opens up to the normal iOS app screen with Favorites, Categories, Tags, Settings. I cannot actually use the 1Password autofill function with any other applications because, of course, when I try to do so, I'm prompted for the master password, which does not work. But I can at least manually retrieve and type in the login data for various sites.

    Presumably I will never be able to update the iOS app so long as the master password problem persists, but at least I still have access to the 242 logins I've saved in 1Password.

    If this cannot be fixed, is there a way to export the data from the iOS app? If I can't use the app anymore, I'd like to export the data to another application so it is not lost completely.

  • Lars
    Lars
    1Password Alumni

    @John D - that "discrepancy" message you're getting means that the Master Password you're using (on the iPhone) for your 1password.com account is NOT the same as the correct one. You're able to ignore it because you had previously signed into that account using the Master Password for the account that was correct for the time, and so the decryption keys for the data are stored in 1Password for iOS...for now. But even here, until you enter the correct, updated details, you will not be able to receive new data from the server (that was changed on other devices, for example), nor will any changes or additions you make to items on the iPhone be pushed to the server. In short, this is a temporary "solution" that isn't going to be a stable, long-term.

    I know you've said you've logged into the 1password.com website for "a couple of years" and that's also how you do it at work, so forgive me for getting detailed here, but have you done this - tried to sign into your 1Password account in a browser at 1password.com - either at your office or anywhere else SINCE this problem started happening? If the answer is no, please try to do so now: open a browser, visit your account, and attempt to sign in using the Master Password you expect to work. Let us know what you discover.

  • John D
    John D
    Community Member

    Yes, per my note above, I did try to access 1Password via the website since changing the master password, and I did it again just now. I get the following message:

    Cannot sign in. Your email address, Secret Key, or Master Password is incorrect.
    If you were invited to 1Password by someone else, they can recover your account.

  • Lars
    Lars
    1Password Alumni

    @John D - I'm sorry to hear it; if you can't remember the password you used for your 1password.com account, you won't be able to recover that data unless you're a member of a 1Password Families or 1Password Business account where you might be able to have a Family Organizer or Administrator help recover your account. If it's an individual account or you are the sole Family Organizer of Admin, you'll need to try to remember your Master Password. First, limit the variables: make sure the sign-in address is correct (typically https://my.1password.com but might be different for a business or family account), and make sure you're using the correct Secret Key as well (if you've never changed this, it's likely correct, but good to verify just in case. That will leave you with only the Master Password as the potential culprit. I'd try these suggestions to see if you can jog your memory or enter the correct Master Password. If none of that works, let me know. Also, do any experimenting/troubleshooting ONLY on your Mac; if your data is available on your iPhone, we'll need that to effect a rescue, so don't change anything there. Let us know how you get on, and good luck.

  • John D
    John D
    Community Member

    Thanks for your help. I have the correct master password, it is written down. As noted above, I successfully used the new password once in the 1Password desktop application immediately after changing it. It is only since then that the password has failed to work. If there is a way to export the data from the iOS, please pass that on.

  • @John D

    The Master Password for the desktop application and for 1Password.com may be different (and it sounds like that may be the case here). In any event, if you still have access to your 1Password data on iOS, here is what I'd recommend:

    1. Sign up for a new 1Password Families membership trial (note: it must be 1Password Families) at https://start.1password.com/sign-up/plan in a web browser on a computer
    2. Print the Emergency Kit generated during the sign-up process, and write your chosen Master Password on it
    3. Use the information on the Emergency Kit to sign into this new membership account on your iOS device
    4. Move all of the data you want to keep from the vault(s) it currently lives in into the vault in the new 1Password Families membership
    5. Verify that at https://my.1password.com/ you're able to see all of the data you want to keep while signed into the new account
    6. Delete your existing individual account: FAQ: I'm locked out of my account (membership) / need to start over
    7. Downgrade the new 1Password Families membership to individual: sign in to your 1Password account at https://start.1password.com. Click Settings in the sidebar. Under Change Account type, click: Convert to Individual
    8. Sign in to the new membership account on each of your other devices
    9. Make sure NONE of the devices have a vault called "Primary" — this is important. This is how the Master Password ends up being different to unlock the apps vs 1Password.com.
    10. Email our billing team at support+billing@1password.com to get the billing sorted out.

    Please let me know how it turns out.

    Ben

  • Lars
    Lars
    1Password Alumni

    @John D - late to this one, but just to give a potential alternate method to part of Ben's instructions, which may save you some time. It would be easiest if you could just open another individual account (since that's what you want), but the reason Ben told you to open a 1Password Families account instead is that, to prevent fraud, the server won't allow more than one individual account from any given email address. So, since you already have one individual account, you can't open another with that same email address, but you can open a 1Password Families account.

    However, opening a 1Password Families account would require you to sort out billing via email with our billing/sales team, and that's several extra steps. Another approach -- IF you have more than one email address you're willing to use -- would be to just open a second individual account instead of a 1Password Families account, using that alternate email address. Then complete the rest of Ben's steps. At the end, instead of having to sort things out in email with Billing, you would only need to sign into your new account in a browser and change your email address by clicking My Profile > Change Email. Considerably less work, if you have a second email address you're able/willing to use.

  • John D
    John D
    Community Member

    I have not yet taken the above steps. On my iPhone, the iOS 1Password app has two vaults: a personal vault (the one I use) and a "Primary" vault which I believe dates to when I synced files via Dropbox. Should I delete that Primary vault before I take any of the above steps? Is there any way that simply deleting that Primary vault might solve the problem? Thank you.

  • Lars
    Lars
    1Password Alumni

    @John D - there's no reason not to, if the Primary vaults on your iPhone and your Mac are currently in sync. Assuming they are, you won't lose anything by removing it on your iPhone. And no, simply deleting Primary won't do it; your credentials for your 1password.com account are the problem right now, not your Primary vault.

  • John D
    John D
    Community Member

    One final (I hope) clarification: Ben's step 4 says the following:

    • Move all of the data you want to keep from the vault(s) it currently lives in into the vault in the new 1Password Families membership.

    How do I "move all of the data?" Is there an export file function?

  • Lars
    Lars
    1Password Alumni
  • John D
    John D
    Community Member

    OK, progress. Followed the combined Lars/Ben steps above and successfully created a new account with a different email address. Moved all the items from the old vault to the new vault. Verified via the 1Password website that all the data has arrived in the new vault. Changed my email address back to my original email. That all worked fine. Also, I can access the new vault via the iOS 1Password app via iTouch on my iPhone.

    But...

    I still cannot open the 1Password Mac OS X application on my iMac, it rejects the new password. I also cannot open the iOS 1Password app on my iPad, it rejects the new password. (Unlike my iPhone, I never set up iTouch for the 1Password app on my iPad.) I presume this has to do with the "Primary" vault problem that Ben mentioned. The app on my iPhone has a "primary" file which I can't delete because I don't have the password. Suggestions? Should I just delete the apps from both the iMac and the iPad and reinstall them?

  • Lars
    Lars
    1Password Alumni

    @John D - so, for your other devices (the ones on which you did NOT perform the moving of data), you need to add the new account to those devices, then remove the Primary vault. If you don't do this, then whatever Master Password you used for the old Primary vault will still be the one that unlocks that copy of 1Password -- because, when first installed, 1Password will use as the app's Master Password the vault password of the first vault or account that's added to it. Doesn't matter how many subsequent accounts you add, the Master Password will remain unchanged as long as that first vault or account is present. So (on other devices):

    1. Sign into the new account (if you haven't already).
    2. Remove the Primary vault.

    Again, instructions for how to do this vary by platform, but the overall process is similar. You can find those instructions here.

    Alternatively, if you prefer, you can simply erase all the data on the 1Password app and Start Over if that seems easier to you. Each method will work. You just need to be sure you've got all your data in your new account before you go deleting data. Let us know how you get on. :)

  • John D
    John D
    Community Member

    Thanks very much. The first suggestion stopped at step 1, because I couldn't sign into any accounts on the other devices because I didn't have a valid password. But the "Start Over" method worked. So all seems back to normal.

    As aggravating as this has been, I give full credit to 1Password support for speedy responses and determination to find a solution, without the snarky "customer error" attitude that seems to pervade much IT support. It's a great product and I'm glad I can keep it.

    Given the problems I've had each time I've changed my master password, I do think there's an issue in that process somewhere. I can only assume it has something to do with this "primary" v. "personal" vault conflict. Had I not been able to access my information via iTouch, I think the data would have been unrecoverable. My advice to users would be:

    1. always ensure your account is accessible via iTouch on at least one device
    2. never change your master password
    3. if you must change your master password, do it via the website, not via the desktop application.

    One last minor issue: billing. Using the solution above, I'm now operating on a new free trial. I paid for a year's subscription in January. Am I at risk of being hit with an autopay each January for that original account? (I don't recall how the account was originally set up and of course I can't access it now.) Is there simple any way to transfer that payment to this account? If I simply set up a credit card for the new account, will I end up being billed for two subscriptions?

    Thank you for your help.

  • Lars
    Lars
    1Password Alumni

    @John D - hey, congratulations! Glad we were able to help you get to a stable solution. And thanks so much for the kind words -- they're much appreciated. :)

    I can only assume it has something to do with this "primary" v. "personal" vault conflict.

    Yup, exactly. Our name is "1Password," and it's a cornerstone of our product that you only need to remember ONE password to unlock all your data. But behind the scenes, the reality is considerably more complicated. Each vault has its own set of encryption keys, and each user may have multiple accounts, each with a different Master Password -- or a mix or standalone vaults and 1password.com accounts. But each 1Password app (on all platforms) requires only ONE password to unlock. We manage this by having the first vault/account you add to any instance of the app be the Master Password for that app. There's really no other way to do it. Then, when you add further accounts/vaults in the future, we require you enter the Master Password for those one time...after which the keys are sort of "escrowed" in the first vault, so that the next time you enter the Master Password for the app, it unlocks not only that first vault you added but also any subsequent ones you added later. It's a pretty neat system, and it allows us to be "1Password" instead of "1Password for every account you have, plus any standalone vaults." That latter was too big to fit on a business card and didn't poll well in test-marketing. ;)

    Unfortunately, what this means is that if you have one Master Password for an existing standalone setup (let's call it MP-1), and you then create a 1password.com account and give it a different Master Password (let's call this MP-2), your local 1Password for Mac will unlock with MP-1 (because that's the one you first used on it). So, when you add your new account that opens with MP-2 to the 1Password for Mac app, it still opens with MP-1. And what can happen over time, especially if MP-2 was a complicated one that you made up brand new for the account, if you never again have to use it because you're still opening 1Password for Mac with MP-1...is...you guessed it: you forget what MP-2 even was. Which means...

    Had I not been able to access my information via iTouch, I think the data would have been unrecoverable.

    Yup. It's a real danger. When you upgrade from a standalone setup to a 1password.com account, the process in 1Password 7 for Mac is supposed to walk you through adding your account, and migrating the data. Then, the way it used to be, we would ask if you wanted to remove the (now-useless and redundant) Primary vault, expecting people to understand this was the right thing to do for the vast majority of users (no need to keep an old, empty standalone vault if you've transferred all your data to your account, right?)

    But what we noticed over time is that we'd "trained" some of you too well, or maybe you were just too smart and security conscious on your own -- you saw a prompt that said "delete Primary vault?" and you thought "oh HECK NO, I'm not stupid! I don't want to lose any data!" And you elected to keep the Primary vault. Which meant: you were still using that older Primary vault's Master Password to unlock 1Password for Mac. And if you had chosen to use the same Master Password for your new 1password.com account as you used for the old Primary vault, you'd have noticed no difference. But here again, WE'VE consistently told you not to re-use passwords, so a lot of you thought up brand new, complicated passwords to be the Master Password for your new account. Which is great!...except if you thought up a brand new Master Password and you kept your Primary vault so in day-to-day use, you weren't using that new Master Password (because you were still using the old one)...you eventually forget what that shiny new Master Password IS. Not good.

    That's why, a while ago, we simply removed the option in 1Password for Mac to keep the old Primary vault. Yes, there are reasons why someone might want to have standalone vaults AND a 1password.com account...but if so, they can always add other standalone vaults later, if necessary. Now, when someone goes through the migration process from standalone --> a 1password.com account within 1Password for Mac, we no longer ask if they want to remove the empty Primary vault, we just do it. So hopefully, there won't be too many more people like you who took what seemed like perfectly reasonable, even laudable cautious steps, and got yourself in a jam.

    Using the solution above, I'm now operating on a new free trial.

    Right.

    I paid for a year's subscription in January. Am I at risk of being hit with an autopay each January for that original account?

    No.

    Is there simple any way to transfer that payment to this account?

    Simple? No. It requires me to do math, and anything that does that isn't "simple." 😆But if you take the $35.88 annual charge and divide by 365 days, you get 0.098301369863014, the daily rate. Then you multiply that number by the number of days you had remaining in your previous year's subscription (273, I counted), and you get 26.836273972602822. Round it up to $26.84. And that's the amount I've credited your new account. Consider the 30-day trial a small compensation for the hassle. :) Just add a credit card to the billing section anytime in the next 30 days, and on the 31st day, you'll get charged for a full year starting from that date ($35.88) less the amount of the credit for the remaining time from the previous account. Hope that's OK. :)

This discussion has been closed.