My understanding is iCloud uses server-side encryption of customer data.

I am no expert but what about the data e.g. of an app like 1Password which can syncs very sensitive user data to many devices via iCloud.

Since 1Password purposefully encrypts data before sending it to iCloud, does this mean the data cannot be looked up by Apple employees?

  • 3
    Is it documented where iCould does the encryption? Also, feel free to edit this to explain more what you mean - anyone who intercepts data being sent over the internet or manages servers can inspect all the data they have access to.
    – bmike
    Dec 14, 2012 at 20:03

3 Answers 3


1Password does not use "iCloud" which is a service offering from Apple, by default it uses Dropbox but can also use other cloud solutions. 1Password does not support storing data on Apple's iCloud.

1Password 3 data file sync solutions

About 1Password Encryption

The slightly longer answer is that your data is encrypted using AES, the same state-of-the-art encryption algorithm used as the national standard in the United States. 1Password uses 128-bit keys for encryption, which means that it would take millions of years for a criminal to decrypt your data using a brute force attack.

And more about Agile Keychain Design and encryption

Information about Dropbox and encryption. Keep in mind that Dropbox does not encrypt the files that you store with their service, but they do encrypt the traffic between your computer and their servers at Amazon.

UPDATE 20121217: I see that the latest version of 1Password does offer the ability to use Apple's iCloud for storing and sharing.

Here is an knowledge base article from Apple on the subject, iCloud: iCloud security and privacy overview. But it does not cover the encryption of non-Apple application data.

Ars has a much better article discussing encryption in iCloud, Apple holds the master decryption key when it comes to iCloud security, privacy

It seems to me that Agilebits has really fallen behind on updating their web site with information about the latest version of 1Password for iOS. It looks like 1Password Pro, which I have been using for awhile now, has been removed from iTunes and the only version available is the new version here. I would guess that a new version for the desktop is also on its way.

  • 4
    1Password 4 for iOS does. Released December 13, 2012
    – afragen
    Dec 14, 2012 at 23:08
  • Ah, I see that now. I will look at it in the morning and update my answer. Looks like another paid update, that is getting old quick! Dec 17, 2012 at 3:36
  • But there's loads of new stuff. Well worth the $8
    – afragen
    Dec 18, 2012 at 2:33

I've been a 1Password user for several years and rely on the program across my Macs, iPhone and iPad. The chief architect seems to be on top of security and encryption.

With the release of 1Password 4 for iOS, it now uses iCloud and/or Dropbox for syncing encrypted password files. Regardless of the encryption used (or not) on the cloud layer, the program encrypts the 1Password keychain with a 128-bit AES key.

While the company has been fairly tight-lipped on the content of the Windows or OS X versions of 1Password 4, I'm willing to assume that the program will also sync the encrypted file through Dropbox and/or iCloud, like the iOS version.

I find this split syncing model fascinating for mixed-OS environments: the programs will push and pull the data around whatever cloud access you have.


1Password actually does use iCloud on iOS, if you enable it. I can't tell you that 1Password sends encrypted data to iCloud, but all data on iCloud is encrypted. No, Apple employees cannot sift your data, even if they wanted to it would be encrypted; however government agencies like the NSA, Chinese Intelligence agencies, international agencies, and even people will collect any data of interest, stored over the internet.

  • I don't see how you can confidently assert that "Apple employees cannot sift your data" if you don't know whether the data is encrypted server-side or client-side. If the data is encrypted server-side, or encrypted under a key that is available to the server, then it is highly likely that (at least some) Apple employees could sift through your data (if they wanted, and if they were willing to violate policy).
    – D.W.
    Jan 9, 2013 at 10:53
  • If you have worked at any company like Apple, Google, Facebook or any large reputable internet company you will know that there are huge restrictions to how data is accessed, and that it would be hard for an employee to pinpoint and access someone's data without permission, time to do so or management's inquiry. And as well Apple has certain undisclosed security measures, making it impossible for a rogue employee to do such a thing.
    – zzz
    Jan 17, 2013 at 19:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .