I wasn’t using 1Password 8 in Arc while working on “Using Apple’s iCloud Passwords Outside Safari” (1 April 2024), so when I reenabled it, I was surprised—and a little annoyed—to discover that it would show only four of the six credit cards in my vault in its autofill pop-up.
It wasn’t hard to use 1Password Quick Access to copy the relevant information the first time or two it happened, but I have little patience for such speed bumps. Comparing the various entries in 1Password, I discovered the two cards that failed to appear had “website” entries in the Additional Details section, and one had another such entry in the Contact Information section.
Therein lay the key. When I deleted the website entry that appeared in Additional Details, 1Password promptly started offering that credit card in its autofill pop-up. I suspect a spurious Additional Details website entry causes 1Password to display that credit card only on the specified site. A website entry in Contact Information made no difference either way.
So, problem solved. I don’t know how a website entry ended up in the Additional Details section because you can’t add one manually—the website option appears only when adding fields to Contact Information. I could add a website entry to Contact Information and then drag it into Additional Details, but that didn’t trigger the problem. Besides, I’m sure I didn’t add those website entries manually.
At first, I thought the spurious website entries might have been artifacts from my import from LastPass when I switched to 1Password (see “LastPass Publishes More Details about Its Data Breaches,” 3 March 2023). That idea was bolstered by how 1Password release notes over the past year show refinements to the LastPass import process. However, when I checked, no URLs were associated with those credit cards in LastPass, so that’s not it.
A better clue comes from the URL in the screenshot above. It’s from ReserveAmerica, the site I use to reserve a pavilion at a nearby state park for our annual Finger Lakes Runners Club picnic. When I checked my email to see when I made that reservation, I discovered that it was 4 February 2024, the exact date that 1Password reports for the modified date. A veritable smoking gun!
Something related to autofilling credit card information on that site must have caused 1Password to add the ReserveAmerica URL to the card’s Additional Details section. I doubt I would have accepted a prompt to update the credit card information, so I’ll chalk this up to a bug. The same thing happened with the other credit card on a different site; I can’t explain why our primary personal card wasn’t affected despite being used more regularly.
Regardless, the moral of the story is that if 1Password isn’t offering all your credit cards in its autofill pop-up, look for and delete any website entries under Additional Details.
Investigating with 1Password Support
As a coda, I reported the issue to 1Password and have been working with a highly responsive support rep to see if we can figure out what happened. I’ve learned some interesting things:
- On 1Password.com, you can view and restore the history of all changes to any item (the 1Password app only lets you see password changes to login items). That revealed that the other card in question was modified on 3 February 2024, the day before the one I show above.
- The 1Password.com display of the two credit cards in question doesn’t show the spurious website entries in either the current version or the item history.
- When I restored the 3 February 2024 version of the card I had fixed, the problem returned. So the spurious information is deep inside that credit card item.
- In the desktop version of 1Password, you can turn on 1Password > Settings > Advanced > Show Debugging Tools, after which every item in 1Password gets a Copy Item JSON menu in the vertical ••• menu. JSON is human-readable text, so I could see the underlying information and share a redacted version with 1Password support.
- It turns out that these spurious website entries aren’t in the Additional Details section—they appear slightly below it. The JSON file shows them in an “overview” section.
Although I still don’t know what happened, we’re getting closer. I hope these details are helpful for others investigating oddities in their 1Password items. I’ll report what I learn in the comments.
