Hermes 1Password sign-in is new in Hermes Agent v0.22.0: the browser agent can now log into websites using the logins stored in your 1Password, and the model never sees the password. If the 1Password CLI is installed and signed in, there's nothing to enable. You say "log into GitHub" and Hermes fills it for you.
📺 Watch: Hermes Agent V0.22 Just Changed AI Agents Forever!
🔥 Get the Agent OS as a free bonus: AI Profit Boardroom members get the full Agent OS zip, prompt libraries, daily tutorials and weekly live coaching calls. → Get inside
The same feature works with Bitwarden and with Hermes's own encrypted vault. Here's how it works, what you'll see the first time, how one-time codes are handled, and where the limits are.
What changed in v0.22
v0.22.0, the Threshold Release, went live on GitHub on 14 October 2026. One of its highlights, in the release notes' own words, is that the browser agent can log into sites with logins from 1Password, Bitwarden or Hermes's own encrypted vault, "and the model never sees the password."
The old problem with browser agents was simple. To log in, the model needed the password, which meant pasting it into chat or a config file. Now Hermes does the fill itself. The docs say the password goes straight into the page over the browser session, and the only thing the model gets back is a short result: how many fields were filled and which site.
The password is also registered with Hermes's redactor, so if the agent reads the page later, it can't echo the password back into the conversation.
I run Hermes every day inside my Agent OS with a profile per model, and logins have always been where browser automation stalls. I covered this sign-in feature in my v0.22 video. If you want the whole setup, the AI Profit Boardroom ($69/mo) has the Agent OS, a 30-day AI agent roadmap, daily tutorials as new tools drop, 4 coaching calls a week and the prompt library. 3,400+ members are inside.
How Hermes 1Password sign-in works
There's no setup screen. Per the Passwords and Logins docs, if the op command-line tool is installed and signed in, Hermes picks it up automatically and your 1Password website logins become fillable alongside any logins saved in Hermes.
- Ask for a login. "Log into GitHub and check my notifications."
- Unlock once. The first time the agent needs a 1Password login, you get a masked prompt for your master password. It's asked once per session and expires after 30 idle minutes.
- Hermes fills it. The agent types the username itself and Hermes fills the password into the page.
Your master password goes to 1Password's CLI through its non-interactive channel. Hermes keeps only the session token, in memory. The agent never sees the master password, the token or the login.
Items with several website URLs fill on each of those exact sites and nothing else. Nothing is guessed beyond the URLs saved on the item.
Running Hermes on a server with nobody to type a master password? The docs say you can give it a 1Password service account token through OP_SERVICE_ACCOUNT_TOKEN.
📺 Watch: Hermes3D Is INSANE: AI Agents Now Have a 3D Office
The masked save prompt
What if a site isn't in 1Password? The first time the agent reaches a sign-in page with no saved login, it asks you right there.
- CLI and TUI: a "Save login for" prompt with the site name. You type the email or username (shown on screen), then the password (hidden). It's encrypted on your machine and bound to that site.
- Desktop: a card asking to save your login for that site, with an identifier field and a masked password field. Save and sign in stores it and carries on. Don't save tells the agent to stop asking for that turn.
After that it just works. Saved logins live encrypted under the vault folder in your Hermes home, scoped to the profile. Labels, sites and usernames are visible metadata. Passwords only ever leave the vault into the page.
Want a hand working out which logins your agent should actually have? Book a free AI strategy session.
📺 Watch: Hermes Bot Mode DESTROYS Grok Bot? (FREE!)
One-time codes and two-factor
The release notes say one-time codes are filled without entering the conversation. The docs split it into three cases.
| 2FA type | What Hermes does | Do you do anything? |
|---|---|---|
| Authenticator key saved with the login (including 1Password and Bitwarden items that hold a TOTP seed) | Generates the current code and enters it, only on the login's own site | No. The item shows a 2FA auto badge |
| Code sent by text or email | Shows a small "Verification code" prompt, then enters what you type | Type the code once |
| Passkeys, hardware keys, app approvals | Tells you to finish on your device and waits for the page to move on | Approve on your device |
To add an authenticator key to a Hermes-vault login, use Settings, then Passwords and Logins, then Add, or run hermes vault add.
When a site throws something the agent can't handle, like a CAPTCHA, that's where the new Bot Screen comes in. For a bot running on a Linux gateway, you take over its screen from Hermes Desktop, finish the step and hand control back. I covered it in Hermes Bot Screen.
Hermes Bitwarden setup
Bitwarden works exactly like 1Password. If the bw command-line tool is installed and signed in, Hermes detects it and your Bitwarden website logins become fillable. The first time it needs one, you unlock with your master password in a masked prompt, which Hermes hands to the Bitwarden CLI without the agent ever seeing it.
Prefer not to use a detected manager? Run hermes vault sources --disable bitwarden, or flip its switch in Settings, then Passwords and Logins. In config.yaml the same thing is vault.bitwarden.enabled: false, or vault.onepassword.enabled: false for 1Password. v0.22 also fixed a bug where that Settings toggle didn't do anything.
Don't confuse this with the older Bitwarden Secrets Manager and 1Password secrets integrations. Those pull your model API keys into Hermes at startup. The v0.22 feature is about website logins for the browser agent.
Cards, addresses and checkout
Cards and addresses are saved the same way and bound to the checkout site. The important rule from the docs: every card fill asks you first, with the same approval prompt as a dangerous command. Decline and nothing is written.
Headless sessions like cron jobs, webhooks and the API server can't confirm, so card fills there are refused. The docs put it plainly: a prompt injection that reaches a checkout page can ask, but it can't spend. Address fills need no confirmation.
Managing your vault and its limits
Everything lives in Desktop, Settings, Passwords and Logins, with your detected managers and Unlock and Lock buttons. On the CLI: hermes vault list, hermes vault add, hermes vault rm, hermes vault sources and hermes vault key.
By default the vault key sits in a file next to the encrypted vault. You can move it into your system keychain with hermes vault key migrate --to keychain. That's opt-in, because a lost keychain entry means a vault you can't open.
Be clear on what this protects. The docs say the password never enters the model's context through Hermes, and fills are refused unless the page's site exactly matches the saved one. It does not protect you from the site itself: once a password is typed in, that site has it, the same as when you type it. And a third-party plugin running inside Hermes can do anything Hermes can, including filling a saved login. If you install plugins you haven't reviewed, the docs recommend running them out of process with plugins.isolation: host.
Your agent can now work inside apps too. See Hermes Notion and Hermes Linear for the new Connectors. To pick a model you trust with your browser, check Goldie Bench, and the Agent OS guide shows how I keep profiles separate. Want it set up properly? Grab a free AI strategy session.
FAQ
Does the AI model ever see my 1Password password?
No. Per the docs, the password never enters the model's context through Hermes: not in tool results, logs, the session database or process arguments.
Do I need to turn anything on?
No. If the 1Password or Bitwarden CLI is installed and signed in, Hermes picks it up. Logins you save in Hermes's own vault need no setup either.
Does it work in cron jobs?
Saved Hermes-vault logins keep working. A locked password manager reports it's unavailable, so unlock it in an interactive session first or use a 1Password service account token.
Can the agent pay for things on its own?
No. Every card fill asks you first, and headless sessions are refused.
Ready to let your agent log in without handing over your passwords? Join the AI Profit Boardroom for the Agent OS and daily Hermes tutorials, or book a free AI strategy session and we'll set it up together.
