1Password vs Ente Auth

Agent access

1. ai-native userPoint an agent at llms.txt or agent-oriented docs

   weight 2 · round to 1Password
   1Password✓fullprobed9/10

   1Password.dev and support.1password.com both serve confirmed llms.txt/llms-full.txt files plus markdown mirrors of every docs page, and this is directly verified via live probes, not just claims. missing for 10: independent third-party (non-vendor) confirmation that agents actually consume these files successfully in practice.

   • [probe] “PROBE llms.txt: HTTP 200 at https://support.1password.com/llms.txt # 1Password Support > LLM-friendly exports of English public support gui…”
   • [probe] “PROBE runtime (recorded 2026-09-15): 1password.dev serves llms.txt ('# 1Password Developer Documentation') plus llms-full.txt, and every doc…”
   • [claimed-docs] “The 1Password Environments MCP Server lets MCP clients such as Claude Code, Codex, Cursor, and Kiro securely manage your 1Password Environme…”
   • [probe] “PROBE runtime (recorded 2026-09-15): 1Password's public docs MCP server at https://www.1password.dev/mcp completed a FULL keyless initialize…”

   proof ↗⚑ flag

   Ente Auth✓fullprobed7/10

   Ente serves a live llms.txt at ente.com/llms.txt confirmed by two independent probes, giving an agent a fair entry point; however, docs-as-markdown and OpenAPI endpoints 404, so agent-oriented documentation beyond the single llms.txt file is thin. missing for 10: markdown-served docs pages, OpenAPI/agent-consumable API spec, broader agent-oriented doc structure beyond one root file.

   • [probe] “PROBE llms.txt: HTTP 200 at https://ente.com/llms.txt # Ente > Ente builds private, end-to-end encrypted apps for photos, two-factor authen…”
   • [probe] “PROBE runtime (recorded 2026-09-15): ente.com serves a live llms.txt — '# Ente — Ente builds private, end-to-end encrypted apps for photos, …”
   • [probe] “PROBE docs-md: HTTP 404 at https://ente.com/help/auth/.md”
   • [probe] “PROBE openapi: all candidate paths 404 (https://ente.com/openapi.json, https://ente.com/swagger.json, https://ente.com/api/openapi.json, htt…”

   proof ↗⚑ flag

2. ai-native userRun the product headlessly / in CI for automation

   weight 2 · round to 1Password
   1Password✓fullprobed8/10

   1Password ships a dedicated CLI (confirmed packaged via Homebrew cask), Service Accounts explicitly for automating secrets in CI/infrastructure without extra services, Connect Servers exposing a REST API for machine workflows, and a Credential Broker for CI/CD short-lived access — all first-party documented and headless by design. Missing for 10: independent hands-on case studies/community reports specifically validating CI pipeline usage rather than just vendor docs.

   • [claimed-docs] “1Password CLI brings 1Password to your terminal. Learn how to install the CLI, then integrate it with your 1Password app and sign in with To…”
   • [claimed-docs] “Use the 1Password Credential Broker to give CI/CD and other machine workflows short-lived access to secrets, without managing service accoun…”
   • [claimed-docs] “1Password Connect Servers allow you to securely access your 1Password items and vaults in your company's apps and cloud infrastructure using…”
   • [claimed-docs] “1Password Service Accounts help automate secrets management in your applications and infrastructure without the need to deploy additional se…”
   • [probe] “PROBE runtime (recorded 2026-09-15): the official op CLI is packaged in Homebrew as the 1password-cli cask ('Command-line interface for 1Pas…”
   • [probe] “official CLI documented at https://www.1password.dev/cli/get-started”

   proof ↗⚑ flag

   Ente Auth~partialprobed3/10

   Ente provides an official CLI (ente-cli) that can run headlessly to export/backup Auth codes, which is scriptable and could be used in automation/CI contexts, but evidence only documents it for exporting/decrypting backups, not for generic headless operation, generating TOTP codes on demand, or CI-integrated workflows. Missing for 10: documentation of CLI usage for retrieving/generating codes programmatically, CI-specific examples, and any first-party statement about automation/agentic use beyond backup.

   • [claimed-docs] “You can use [Ente's CLI](https://github.com/ente/ente/tree/main/cli#readme) to automatically backup your Auth codes.”
   • [probe] “PROBE runtime (recorded 2026-09-15): Ente's official CLI is packaged in Homebrew as ente-cli 0.3.0, described by the formula itself as 'Util…”

   proof ↗⚑ flag

3. ai-native userConnect an agent via an official MCP server

   weight 3 · round to 1Password
   1Password✓fullprobed8/10

   1Password ships an official Environments MCP Server that lets MCP clients (Claude Code, Codex, Cursor, Kiro) securely manage 1Password Environments without exposing secrets to the agent, and a runtime probe confirms a live keyless MCP initialize handshake against 1Password's own MCP endpoint. This is first-party documentation plus real runtime corroboration of the server actually working. Missing for 10: broader independent/community hands-on reports beyond the vendor probe, and clarity since the Environments MCP server is explicitly marked Beta.

   • [claimed-docs] “The 1Password Environments MCP Server lets MCP clients such as Claude Code, Codex, Cursor, and Kiro securely manage your 1Password Environme…”
   • [probe] “official MCP server documented at https://www.1password.dev/environments/mcp-server”
   • [probe] “PROBE runtime (recorded 2026-09-15): 1Password's public docs MCP server at https://www.1password.dev/mcp completed a FULL keyless initialize…”

   proof ↗⚑ flag

   Ente Auth—none0/10

   The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)

   ⚑ flag

4. ai-native userUse an official CLI

   weight 2 · round to 1Password
   1Password✓fullprobed9/10

   1Password ships an official `op` CLI with detailed docs, reference commands, Homebrew packaging, and integration with secrets automation, service accounts, and SSH/Git workflows, making it well-suited to AI-native/agentic scripting. missing for 10: independent hands-on review or benchmark of the CLI's use in agentic workflows beyond vendor docs and packaging.

   • [claimed-docs] “1Password CLI brings 1Password to your terminal. Learn how to install the CLI, then integrate it with your 1Password app and sign in with To…”
   • [claimed-docs] “op item list --vault Private”
   • [probe] “official CLI documented at https://www.1password.dev/cli/get-started”
   • [probe] “PROBE runtime (recorded 2026-09-15): the official op CLI is packaged in Homebrew as the 1password-cli cask ('Command-line interface for 1Pas…”
   • [claimed-docs] “Use the 1Password SSH Agent to authenticate all your Git and SSH workflows.”

   proof ↗⚑ flag

   Ente Auth~partialprobed6/10

   Ente ships an official CLI (github.com/ente/ente/tree/main/cli) confirmed to be packaged via Homebrew as 'ente-cli', documented as scriptable tooling to 'automatically backup your Auth codes' and decrypt exports — this is a real, official, automatable interface. However it is scoped narrowly to backup/export/decrypt operations rather than full account/code management or general agentic control. Missing for 10: broader CLI command coverage (add/edit/delete codes, sharing, sync), first-party docs detailing CLI usage beyond export, and independent hands-on reports of using it in automated/agentic workflows.

   • [claimed-docs] “You can use [Ente's CLI](https://github.com/ente/ente/tree/main/cli#readme) to automatically backup your Auth codes.”
   • [probe] “PROBE runtime (recorded 2026-09-15): Ente's official CLI is packaged in Homebrew as ente-cli 0.3.0, described by the formula itself as 'Util…”

   proof ↗⚑ flag

5. ai-native userDrive the product through a documented public API

   weight 3 · round to 1Password
   1Password✓fullprobed9/10

   1Password exposes a well-documented public API surface for programmatic control: a scriptable CLI (op), official SDKs in Go/JS/Python, a Connect Server REST API, Service Accounts, Events API, and even a public MCP server for AI agents — all backed by first-party docs and confirmed via runtime probes (CLI packaged in Homebrew, MCP handshake succeeding, llms.txt/markdown mirrors of docs). This directly satisfies an AI-native user's need to drive the product via documented APIs rather than only a GUI. Missing for 10: independent third-party developer testimonials/case studies of building against these APIs beyond vendor docs and probes.

   • [claimed-docs] “1Password CLI brings 1Password to your terminal. Learn how to install the CLI, then integrate it with your 1Password app and sign in with To…”
   • [claimed-docs] “op item list --vault Private”
   • [claimed-docs] “1Password Connect Servers allow you to securely access your 1Password items and vaults in your company's apps and cloud infrastructure using…”
   • [claimed-docs] “1Password Service Accounts help automate secrets management in your applications and infrastructure without the need to deploy additional se…”
   • [claimed-docs] “1Password SDKs allow you to build integrations that programmatically interact with 1Password using Go, JavaScript, or Python.”
   • [github] “Build integrations that programmatically interact with 1Password.”
   • [claimed-docs] “The 1Password Environments MCP Server lets MCP clients such as Claude Code, Codex, Cursor, and Kiro securely manage your 1Password Environme…”
   • [probe] “official MCP server documented at https://www.1password.dev/environments/mcp-server”
   • [probe] “official CLI documented at https://www.1password.dev/cli/get-started”
   • [probe] “PROBE runtime (recorded 2026-09-15): 1Password's public docs MCP server at https://www.1password.dev/mcp completed a FULL keyless initialize…”
   • [probe] “PROBE runtime (recorded 2026-09-15): 1password.dev serves llms.txt ('# 1Password Developer Documentation') plus llms-full.txt, and every doc…”
   • [probe] “PROBE runtime (recorded 2026-09-15): the official op CLI is packaged in Homebrew as the 1password-cli cask ('Command-line interface for 1Pas…”

   proof ↗⚑ flag

   Ente Auth~partialprobed3/10

   Ente provides a CLI (ente-cli) for exporting/backing up Auth codes and a documented deep-link scheme (enteauth://search), but there is no documented public REST/GraphQL API or SDK for driving the product programmatically — OpenAPI probes returned 404s. missing for 10: a documented public API/SDK covering core operations (add/edit/delete codes, sharing, sync), API authentication docs, and independent developer corroboration of API usage.

   • [probe] “PROBE runtime (recorded 2026-09-15): Ente's official CLI is packaged in Homebrew as ente-cli 0.3.0, described by the formula itself as 'Util…”
   • [claimed-docs] “You can use [Ente's CLI](https://github.com/ente/ente/tree/main/cli#readme) to automatically backup your Auth codes.”
   • [claimed-docs] “Added support for search deep links via enteauth://search.”
   • [probe] “PROBE openapi: all candidate paths 404 (https://ente.com/openapi.json, https://ente.com/swagger.json, https://ente.com/api/openapi.json, htt…”

   proof ↗⚑ flag

6. ai-native userIssue scoped/least-privilege API credentials for an agent

   weight 2 · round to 1Password
   1Password~partialprobed6/10

   1Password Service Accounts and Connect Servers support scoped, vault-limited, short-lived credentials for machine/agent workflows, and the Environments MCP Server explicitly avoids returning secrets to the agent, which aligns with least-privilege agent access. However, evidence doesn't show fine-grained per-agent scoping controls, credential rotation/expiry specifics, or audit tooling tailored to AI agents specifically (vs generic machine/service workflows). missing for 10: documentation of granular per-agent permission scoping, credential lifecycle/expiry controls for agents, and independent/hands-on verification of least-privilege enforcement in agent contexts.

   • [claimed-docs] “Use the 1Password Credential Broker to give CI/CD and other machine workflows short-lived access to secrets, without managing service accoun…”
   • [claimed-docs] “1Password Connect Servers allow you to securely access your 1Password items and vaults in your company's apps and cloud infrastructure using…”
   • [claimed-docs] “1Password Service Accounts help automate secrets management in your applications and infrastructure without the need to deploy additional se…”
   • [claimed-docs] “The 1Password Environments MCP Server lets MCP clients such as Claude Code, Codex, Cursor, and Kiro securely manage your 1Password Environme…”
   • [probe] “PROBE runtime (recorded 2026-09-15): 1Password's public docs MCP server at https://www.1password.dev/mcp completed a FULL keyless initialize…”

   proof ↗⚑ flag

   Ente Auth—none0/10

   The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)

   ⚑ flag

7. ai-native userBuild against official SDKs

   weight 2 · round to 1Password
   1Password✓fullprobed8/10

   1Password ships official SDKs for Go, JavaScript, and Python for programmatically interacting with vaults, secrets, and items, backed by GitHub repos, docs, and complementary CLI/Connect/Service Accounts tooling for automation workflows. missing for 10: independent third-party developer testimonials/case studies validating real-world SDK usage beyond vendor docs and GitHub repo descriptions.

   • [claimed-docs] “Secure your applications: Load secrets into your code with secret references or read environment variables from 1Password Environments.”
   • [claimed-docs] “Automate item management: Programmatically manage items in your 1Password account.”
   • [claimed-docs] “1Password SDKs allow you to build integrations that programmatically interact with 1Password using Go, JavaScript, or Python.”
   • [github] “Build integrations that programmatically interact with 1Password.”
   • [claimed-docs] “1Password Service Accounts help automate secrets management in your applications and infrastructure without the need to deploy additional se…”
   • [claimed-docs] “1Password Connect Servers allow you to securely access your 1Password items and vaults in your company's apps and cloud infrastructure using…”
   • [probe] “PROBE runtime (recorded 2026-09-15): the official op CLI is packaged in Homebrew as the 1password-cli cask ('Command-line interface for 1Pas…”

   proof ↗⚑ flag

   Ente Auth—none0/10

   The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)

   ⚑ flag

Agentic features

1. ai-native userSet up automations that run autonomously in the background

   weight 2 · round to 1Password
   1Password~partialprobed5/10

   1Password provides machine-facing automation building blocks — Service Accounts, Connect Servers, Credential Broker, CLI, and SDKs — that let CI/CD pipelines and other unattended workflows fetch secrets autonomously in the background, and the Environments MCP Server lets AI agents manage secrets without human intervention. However, there's no evidence of a general-purpose scheduler, trigger system, or orchestration layer for building broader 'automations' beyond secrets retrieval/injection. Missing for 10: native scheduling/triggers, workflow orchestration UI, and evidence of autonomous multi-step automations beyond secret access.

   • [claimed-docs] “Use the 1Password Credential Broker to give CI/CD and other machine workflows short-lived access to secrets, without managing service accoun…”
   • [claimed-docs] “1Password Connect Servers allow you to securely access your 1Password items and vaults in your company's apps and cloud infrastructure using…”
   • [claimed-docs] “1Password Service Accounts help automate secrets management in your applications and infrastructure without the need to deploy additional se…”
   • [claimed-docs] “Secure your applications: Load secrets into your code with secret references or read environment variables from 1Password Environments.”
   • [claimed-docs] “1Password SDKs allow you to build integrations that programmatically interact with 1Password using Go, JavaScript, or Python.”
   • [probe] “PROBE runtime (recorded 2026-09-15): 1Password's public docs MCP server at https://www.1password.dev/mcp completed a FULL keyless initialize…”
   • [claimed-docs] “The 1Password Environments MCP Server lets MCP clients such as Claude Code, Codex, Cursor, and Kiro securely manage your 1Password Environme…”

   proof ↗⚑ flag

   Ente Auth—none0/10

   The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)

   ⚑ flag

2. ai-native userOperate the product with natural-language commands

   weight 2 · round to 1Password
   1Password~partialprobed6/10

   1Password ships an official Environments MCP Server that lets AI agents (Claude Code, Codex, Cursor, Kiro) manage 1Password Environments via natural-language prompts through MCP clients, and a public docs MCP server for AI-readable documentation — genuine natural-language operability. However this is explicitly Beta and scoped only to Environments/secrets management, not the broader vault/login/passkey functionality that makes up most of 1Password's product surface, and the primary automation surface (CLI, SDKs) is structured commands, not natural language. Missing for 10: NL control over core password/vault/item management, general-availability status of the MCP server, independent hands-on verification of the NL workflow.

   • [claimed-docs] “The 1Password Environments MCP Server lets MCP clients such as Claude Code, Codex, Cursor, and Kiro securely manage your 1Password Environme…”
   • [probe] “PROBE runtime (recorded 2026-09-15): 1Password's public docs MCP server at https://www.1password.dev/mcp completed a FULL keyless initialize…”
   • [probe] “official MCP server documented at https://www.1password.dev/environments/mcp-server”

   proof ↗⚑ flag

   Ente Auth—none0/10

   The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)

   ⚑ flag

Api quality

1. ai-native userExplore an interactive API reference with runnable examples

   weight 2 · round drawn
   1Password—none0/10

   1Password ships CLI/SDK/API docs, llms.txt exports, and an MCP server, but nothing in the evidence describes an interactive API reference with runnable/try-it examples (e.g., an API console or embedded sandbox); the CLI reference is static text, not executable in-browser. missing for 10: an interactive API explorer/playground, evidence of runnable code samples, any 'try it' console for the REST or SDK APIs.

   • [claimed-docs] “op item list --vault Private”
   • [claimed-docs] “1Password Connect Servers allow you to securely access your 1Password items and vaults in your company's apps and cloud infrastructure using…”
   • [claimed-docs] “1Password SDKs allow you to build integrations that programmatically interact with 1Password using Go, JavaScript, or Python.”
   • [probe] “PROBE runtime (recorded 2026-09-15): 1password.dev serves llms.txt ('# 1Password Developer Documentation') plus llms-full.txt, and every doc…”

   proof ↗⚑ flag

   Ente Auth—none0/10

   No evidence of an interactive API reference or runnable examples; OpenAPI/swagger probes returned 404s and no developer API docs are mentioned anywhere in the pack.

   • [probe] “PROBE openapi: all candidate paths 404 (https://ente.com/openapi.json, https://ente.com/swagger.json, https://ente.com/api/openapi.json, htt…”
   • [probe] “PROBE docs-md: HTTP 404 at https://ente.com/help/auth/.md”

   proof ↗⚑ flag

2. ai-native userDownload a machine-readable API spec (OpenAPI or equivalent)

   weight 2 · round drawn
   1Password—none0/10

   1Password documents REST APIs (Connect Server, Events API) and SDKs, but no evidence pack item mentions a downloadable OpenAPI/Swagger spec or any machine-readable API schema for these APIs. Missing for 10: any OpenAPI/Swagger file, schema reference, or equivalent machine-readable spec for Connect, Events API, or SDKs.

   ⚑ flag

   Ente Auth—none0/10

   Probe results explicitly show all candidate OpenAPI/Swagger paths return 404, and there is no documented machine-readable API spec anywhere in the evidence pack; missing for 10: any published OpenAPI/Swagger file, API reference docs, or equivalent machine-readable spec.

   • [probe] “PROBE openapi: all candidate paths 404 (https://ente.com/openapi.json, https://ente.com/swagger.json, https://ente.com/api/openapi.json, htt…”

   proof ↗⚑ flag

3. ai-native userRely on versioned APIs with a documented deprecation policy

   weight 2 · round drawn
   1Password—none0/10

   The evidence pack shows 1Password has developer APIs, SDKs, CLI, and Connect servers, but nowhere does it document API versioning schemes or a formal deprecation policy for these interfaces. Missing for 10: explicit API version numbers/headers, a published deprecation/sunset policy, changelog or migration guides for breaking changes.

   ⚑ flag

   Ente Auth—none0/10

   Ente Auth is a 2FA authenticator app; there is no evidence of a public API, API versioning scheme, or documented deprecation policy — OpenAPI probes 404 and no API docs exist in the evidence pack.

   • [probe] “PROBE openapi: all candidate paths 404 (https://ente.com/openapi.json, https://ente.com/swagger.json, https://ente.com/api/openapi.json, htt…”
   • [probe] “PROBE docs-md: HTTP 404 at https://ente.com/help/auth/.md”

   proof ↗⚑ flag

1. ai-native userPerform bulk operations across many items at once

   weight 2 · round to 1Password
   1Password~partialprobed6/10

   The 1Password CLI (`op item list`, etc.) and SDKs explicitly support programmatic, scriptable management of items ('Automate item management: Programmatically manage items in your 1Password account'), which enables bulk operations via scripting loops or SDK calls. However, there is no dedicated bulk-edit/batch-update command or documentation showing native multi-item bulk operations (e.g., bulk delete, bulk tag) — missing for 10: explicit bulk-operation commands/API endpoints, documented examples of bulk updates across many items, and independent verification of bulk-scale performance.

   • [claimed-docs] “op item list --vault Private”
   • [claimed-docs] “Automate item management: Programmatically manage items in your 1Password account.”
   • [claimed-docs] “1Password SDKs allow you to build integrations that programmatically interact with 1Password using Go, JavaScript, or Python.”
   • [probe] “PROBE runtime (recorded 2026-09-15): the official op CLI is packaged in Homebrew as the 1password-cli cask ('Command-line interface for 1Pas…”

   proof ↗⚑ flag

   Ente Auth~partialprobed4/10

   Ente Auth documents bulk import from other 2FA apps and a CLI tool for scripted export/backup of all codes, which supports some automation-depth for a bulk operation, but there is no evidence of programmatic bulk editing, deleting, or tagging across many stored codes at once (only single-item edit/delete via long-press is documented). missing for 10: bulk edit/delete/tag API or CLI beyond import/export, evidence of scripted multi-item management, independent hands-on confirmation of bulk workflows.

   • [claimed-docs] “Bulk import from other 2FA apps”
   • [claimed-docs] “Ente Auth natively supports imports from many 2FA providers.”
   • [claimed-docs] “You can use [Ente's CLI](https://github.com/ente/ente/tree/main/cli#readme) to automatically backup your Auth codes.”
   • [probe] “PROBE runtime (recorded 2026-09-15): Ente's official CLI is packaged in Homebrew as ente-cli 0.3.0, described by the formula itself as 'Util…”
   • [claimed-docs] “You can delete or edit a code by long pressing (or right clicking on desktop) on that item.”

   proof ↗⚑ flag

1. ai-native userDo everything through the API that I can do in the UI

   weight 2 · round to 1Password
   1Password~partialclaimed5/10

   1Password's CLI, SDKs (Go/JS/Python), Connect Server, and Service Accounts let AI/automation programmatically read, create, and manage vault items and secrets ([1password-docs-2],[1password-docs-4],[1password-docs-5],[1password-docs-8],[1password-docs-26]), which covers the core secrets-management workflows. However, many UI-only capabilities — passkey creation/autofill in the browser extension, Watchtower breach/weak-password monitoring, Apple Watch lookups, import/export flows, SSH agent autofill — have no documented API/CLI equivalent, so full UI/API parity is not evidenced. Missing for 10: API-exposed passkey management, Watchtower/security-alerts API, and full item-type/browser-feature parity via CLI or SDK.

   • [claimed-docs] “op item list --vault Private”
   • [claimed-docs] “1Password Connect Servers allow you to securely access your 1Password items and vaults in your company's apps and cloud infrastructure using…”
   • [claimed-docs] “1Password Service Accounts help automate secrets management in your applications and infrastructure without the need to deploy additional se…”
   • [claimed-docs] “Automate item management: Programmatically manage items in your 1Password account.”
   • [claimed-docs] “1Password SDKs allow you to build integrations that programmatically interact with 1Password using Go, JavaScript, or Python.”
   • [claimed-docs] “Watchtower tells you about breaches, weak passwords, duplicate items, and other security problems with the items you have saved in 1Password…”
   • [claimed-docs] “you can now create, manage, and sign in with passkeys on a growing number of websites and apps directly from the 1Password browser extension”
   • [claimed-docs] “1Password lets you easily sign in to sites, use suggested passwords, and find what you need – all without leaving your browser.”

   proof ↗⚑ flag

   Ente Auth—none0/10

   Ente Auth exposes only a CLI for exporting/decrypting backups, not a general API covering all UI actions (add/edit/share/organize codes, etc.); probes for OpenAPI/API docs all returned 404, and no documentation describes a comprehensive API surface.

   • [probe] “PROBE openapi: all candidate paths 404 (https://ente.com/openapi.json, https://ente.com/swagger.json, https://ente.com/api/openapi.json, htt…”
   • [probe] “PROBE runtime (recorded 2026-09-15): Ente's official CLI is packaged in Homebrew as ente-cli 0.3.0, described by the formula itself as 'Util…”
   • [claimed-docs] “You can use [Ente's CLI](https://github.com/ente/ente/tree/main/cli#readme) to automatically backup your Auth codes.”

   proof ↗⚑ flag

2. ai-native userExport all of my data in open formats and leave

   weight 3 · round to 1Password
   1Password~partialclaimed5/10

   1Password documents a built-in export feature explicitly for moving data to another app, and separately documents CSV import compatibility, implying an open-format export path (e.g. CSV) exists — but the evidence never states which formats export actually produces (1Password's native export is typically 1PUX, not just CSV) nor confirms full data coverage (attachments, SSH keys, secure notes) is included. missing for 10: explicit confirmation that exported format is open/interoperable (not proprietary 1PUX), evidence of full-fidelity data portability, and independent/hands-on confirmation of successful migration.

   • [claimed-docs] “You can export your information from the 1Password apps if you want to move it to a different app.”
   • [claimed-docs] “You can import data into 1Password from many different browsers and applications, including applications that export data in the comma-separ…”
   • [claimed-docs] “Learn how to transfer your passwords and other information from other applications into 1Password.”

   proof ↗⚑ flag

   Ente Auth!disputedcontradicted5/10

   Ente ships an official CLI to export and decrypt Auth data and documents password-encrypted local backups, and some HN commenters confirm easy export/import between apps (comm-6,7,8; probe-rt-1). But a first-hand HN commenter explicitly states 'You cant easily export your codes into a different format using this app, meaning that it is difficult to migrate away' (comm-2), directly contradicting the frictionless open-format export claim. Missing for 10: a documented plain/open (non-proprietary) full export format, resolution of the lock-in complaint, and independent verification that CLI-exported data is usable outside Ente.

   • [claimed-docs] “Automatic daily backups: When enabled, Ente Auth creates one local backup per day when you open the app.”
   • [claimed-docs] “Password-protected: All local backups are encrypted with a password you set. Keep this password safe, because Ente cannot recover it for you…”
   • [claimed-docs] “You can use [Ente's CLI](https://github.com/ente/ente/tree/main/cli#readme) to automatically backup your Auth codes.”
   • [claimed-docs] “the data is encrypted using a key derived from the user's password”
   • [probe] “PROBE runtime (recorded 2026-09-15): Ente's official CLI is packaged in Homebrew as ente-cli 0.3.0, described by the formula itself as 'Util…”
   • [community] “I'm waiting for bitwarden or aegis export capability before trying this out. You cant easily export your codes into a different format using…”
   • [community] “I have been using Aegis but switched to Ente Auth as I decided to use Ente Photos as well. Both Aegis and Ente Auth are great options. This …”
   • [community] “I think it has its own backup service. But it otherwise lets you export/import your data. I feel like as long as I can do an export in some …”

   proof ↗⚑ flag

3. ai-native userRead the product's source under an open license

   weight 2 · round to Ente Auth
   1Password—none0/10

   1Password is closed-source proprietary software; the evidence pack shows CLI, SDKs, MCP servers and docs, but nothing indicating source code is published under an open license. Missing for 10: any evidence of an open-source license, public source repository, or statement of source availability.

   ⚑ flag

   Ente Auth✓fullprobed7/10

   Ente's own llms.txt explicitly states 'Ente's apps and server are open source,' and a GitHub repo (ente/ente) is referenced for the CLI/export tooling; independent HN commentary corroborates ('thank you for releasing it open source'). Missing for 10: explicit license name/text and a direct link to the license file are not shown in the evidence pack.

   • [probe] “PROBE llms.txt: HTTP 200 at https://ente.com/llms.txt # Ente > Ente builds private, end-to-end encrypted apps for photos, two-factor authen…”
   • [probe] “PROBE runtime (recorded 2026-09-15): ente.com serves a live llms.txt — '# Ente — Ente builds private, end-to-end encrypted apps for photos, …”
   • [community] “This looks quite nice, thank you for releasing it open source... One note as I signed up for an account is that the email verification went …”
   • [claimed-docs] “You can use [Ente's CLI](https://github.com/ente/ente/tree/main/cli#readme) to automatically backup your Auth codes.”

   proof ↗⚑ flag

4. ai-native userSelf-host the core product

   weight 3 · round to Ente Auth
   1Password—none0/10

   1Password is a cloud-hosted SaaS vault; the only 'self-hosted' pieces are Connect Servers/Environments proxies that still require a cloud 1Password account behind them, not the core vault itself. Community comments explicitly confirm the loss of local/offline vault storage and no self-host option ('no native apps, no local vault storage... VC rot has already set in'), and there is no docs evidence of a self-hostable core product.

   • [claimed-docs] “1Password Connect Servers allow you to securely access your 1Password items and vaults in your company's apps and cloud infrastructure using…”
   • [community] “Use a tiny portion of that to continue support for local, non-cloud-based vault files please.”
   • [community] “Except they have already started to diminish what used to make 1P great. We now get no native apps, no local vault storage, no upfront payme…”

   proof ↗⚑ flag

   Ente Auth✓fullprobed8/10

   Ente explicitly documents self-hosting instructions, pointing users to run Ente Auth at localhost/machine-ip:3003, and the product is described as open source, consistent with independent verification via the llms.txt runtime probe. missing for 10: independent hands-on report of a full self-hosted deployment (beyond docs/probe), and details on self-hosting server setup/requirements beyond the port reference.

   • [claimed-docs] “Alternatively, if using Ente Auth, get started by adding an account (assuming you are running Ente Auth at `http://<machine-ip>:3003` or `ht…”
   • [probe] “PROBE llms.txt: HTTP 200 at https://ente.com/llms.txt # Ente > Ente builds private, end-to-end encrypted apps for photos, two-factor authen…”
   • [probe] “PROBE runtime (recorded 2026-09-15): ente.com serves a live llms.txt — '# Ente — Ente builds private, end-to-end encrypted apps for photos, …”

   proof ↗⚑ flag

Storage

1. everyday userThe app stores passkeys and signs me into websites and apps with them, not just TOTP codes

   weight 3 · round to 1Password
   1Password✓fullclaimed8/10

   1Password's own support docs confirm passkey creation, storage, and sign-in on websites/apps directly through 1Password (browser extension and apps), plus Watchtower flagging logins that can upgrade to passkeys, going well beyond just TOTP storage which is also documented separately. Missing for 10: independent hands-on verification of passkey sign-in reliability across many sites and no explicit mobile-app (non-browser) passkey autofill confirmation.

   • [claimed-docs] “you can now create, manage, and sign in with passkeys on a growing number of websites and apps directly from the 1Password browser extension”
   • [claimed-docs] “opening Watchtower in 1Password, which now flags all of your existing logins that could be updated with a passkey”
   • [claimed-docs] “You can use 1Password to save the passkeys you create for your accounts and sign in to websites with passkeys in your browser.”
   • [claimed-docs] “Learn how to use 1Password to store and quickly access your one-time passwords when you turn on two-step verification for a website.”

   proof ↗⚑ flag

   Ente Auth—none0/10

   The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)

   ⚑ flag

Sync

1. power userMy passkeys sync across ecosystems — iOS, Android, Windows, Linux, browsers — instead of being locked to one platform vendor

   weight 2 · round to 1Password
   1Password~partialcommunity6/10

   1Password's docs show passkeys can be created, saved, and used from the browser extension across 'a growing number of websites and apps' and Watchtower flags logins for passkey upgrade, implying sync across whatever platform the extension/app runs on rather than vendor lock-in. However the evidence pack never explicitly confirms native passkey support/sync parity on Linux or Android apps (only browser extension and Apple-ecosystem mentions like Apple Watch/Touch ID), and an older community comment specifically raises concerns about a missing Linux client, leaving cross-platform parity unconfirmed by direct docs. Missing for 10: explicit Linux and Android app passkey documentation, independent hands-on confirmation of parity across all five listed platforms.

   • [claimed-docs] “you can now create, manage, and sign in with passkeys on a growing number of websites and apps directly from the 1Password browser extension”
   • [claimed-docs] “opening Watchtower in 1Password, which now flags all of your existing logins that could be updated with a passkey”
   • [claimed-docs] “You can use 1Password to save the passkeys you create for your accounts and sign in to websites with passkeys in your browser.”
   • [community] “Mandatory 'No Linux client' comment :| Does anyone have any insight if this is a pure business decision or there's something holding them ba…”

   proof ↗⚑ flag

   Ente Auth—none0/10

   Ente Auth is a TOTP/2FA code manager; the only passkey mention in evidence (doc-14) refers to passkey login for the separate Ente Photos account, not Ente Auth storing/syncing passkeys as credentials across iOS/Android/Windows/Linux/browsers. No evidence shows Ente Auth itself functions as a cross-platform passkey vault.

   • [claimed-docs] “Ente also offers [Legacy](/help/photos/features/legacy/) (emergency contacts) and support for [Passkeys](/help/photos/features/passkeys).”
   • [claimed-docs] “Auth has an app for every platform. Mobile, desktop and web. Your codes sync across all your devices, end-to-end encrypted.”

   proof ↗⚑ flag

Export

1. power userExport all my TOTP secrets in an open, readable format and leave for another app whenever I choose — no lock-in

   weight 3 · round to 1Password
   1Password~partialclaimed4/10

   1Password documents a general export feature to move data to another app ([1password-docs-15]), and TOTP/OTP storage is documented ([1password-docs-20]), but no evidence specifies that TOTP secrets are included in the export or that the export format is an open, readable standard (e.g., otpauth:// URIs or plain text) rather than 1Password's proprietary 1PUX format. Missing for 10: explicit confirmation that TOTP secrets are exportable, evidence of an open/readable export format, and independent/hands-on corroboration of successful migration of OTP secrets to another app.

   • [claimed-docs] “You can export your information from the 1Password apps if you want to move it to a different app.”
   • [claimed-docs] “Learn how to use 1Password to store and quickly access your one-time passwords when you turn on two-step verification for a website.”

   proof ↗⚑ flag

   Ente Auth!disputedcontradicted4/10

   Ente Auth does offer local encrypted backups and a CLI ('ente-cli') that can export and decrypt Auth data (docs-8/9/11, probe-rt-1), and Authy-specific tooling explicitly produces a 'plaintext export format' for importing into Ente (docs-5/40) — but this is import-facing, not an open export for leaving Ente. A hands-on community report explicitly states the opposite of the 'no lock-in' claim: 'You cant easily export your codes into a different format using this app, meaning that it is difficult to migrate away once you have already moved your codes over' (comm-2), while other users only describe importing into Ente, not exporting out to a different app's format. Missing for 10: documented open/standard export format usable directly by other authenticator apps, and independent confirmation that migrating away (not just in) is easy.

   • [claimed-docs] “Automatic daily backups: When enabled, Ente Auth creates one local backup per day when you open the app.”
   • [claimed-docs] “Password-protected: All local backups are encrypted with a password you set. Keep this password safe, because Ente cannot recover it for you…”
   • [claimed-docs] “You can use [Ente's CLI](https://github.com/ente/ente/tree/main/cli#readme) to automatically backup your Auth codes.”
   • [claimed-docs] “you should type this for MacOS... This will generate a text file called authy_codes.txt, which contains your Authy codes in Ente's plaintext…”
   • [probe] “PROBE runtime (recorded 2026-09-15): Ente's official CLI is packaged in Homebrew as ente-cli 0.3.0, described by the formula itself as 'Util…”
   • [community] “I'm waiting for bitwarden or aegis export capability before trying this out. You cant easily export your codes into a different format using…”
   • [community] “Ente has free backups and it's own encrypted export format, which sounds promissing.”

   proof ↗⚑ flag

Import

1. power userImport tokens in bulk from other authenticator apps instead of re-enrolling every account by hand

   weight 2 · round to Ente Auth
   1Password~partialclaimed4/10

   1Password documents general import from other apps/browsers via CSV and the newer Credential Exchange standard on iOS 26+, and it supports storing one-time passwords, but no evidence explicitly confirms bulk import of authenticator/OTP tokens specifically from other authenticator apps (e.g., Google Authenticator, Authy) rather than just passwords/logins. Missing for 10: explicit documentation of OTP-specific bulk import/migration flow from named authenticator apps, and any hands-on/community confirmation that OTP secrets survive the CSV or Credential Exchange import.

   • [claimed-docs] “You can import data into 1Password from many different browsers and applications, including applications that export data in the comma-separ…”
   • [claimed-docs] “If you use 1Password on iOS or iPadOS 26 or later, you can import data directly from apps that support the Credential Exchange standard.”
   • [claimed-docs] “Learn how to transfer your passwords and other information from other applications into 1Password.”
   • [claimed-docs] “Learn how to use 1Password to store and quickly access your one-time passwords when you turn on two-step verification for a website.”

   proof ↗⚑ flag

   Ente Auth✓fullcommunity9/10

   Ente Auth has a dedicated bulk-import feature and docs listing native support for many 2FA providers (2FAS, Aegis, andOTP, Bitwarden, Google Authenticator, LastPass, Proton, Raivo OTP) plus conversion paths for others like Authy, with community testimony confirming easy export/import migration from Aegis. missing for 10: no independent hands-on walkthrough of the bulk-import UI itself, only docs and one community mention.

   • [claimed-docs] “Ente Auth natively supports imports from many 2FA providers.”
   • [claimed-docs] “Bulk import from other 2FA apps”
   • [claimed-docs] “2FAS Authenticator * Aegis Authenticator * andOTP (including encrypted backups, except MOTP) * Bitwarden * Google Authenticator * …”
   • [claimed-docs] “you might be still able to import from them by first converting the data from your old provider into these plaintext files and then importin…”
   • [claimed-docs] “you should type this for MacOS... This will generate a text file called authy_codes.txt, which contains your Authy codes in Ente's plaintext…”
   • [community] “I have been using Aegis but switched to Ente Auth as I decided to use Ente Photos as well. Both Aegis and Ente Auth are great options. This …”

   proof ↗⚑ flag

Migration

1. everyday userMoving to a new phone transfers all my tokens in one guided step

   weight 2 · round to Ente Auth
   1Password—none0/10

   The evidence pack covers CLI/SDK/Connect integrations, browser passkeys, import/export from other apps, and OTP storage, but nothing describes a guided 'move to new phone' flow that automatically transfers all tokens/OTPs in one step. Cloud sync via account sign-in is 1Password's usual mechanism, but no citation confirms this specific onboarding experience or that it covers OTP/token migration seamlessly.

   ⚑ flag

   Ente Auth✓fullprobed7/10

   Ente Auth syncs codes end-to-end encrypted across all devices (docs-27, docs-34), so on a new phone a user simply logs into their existing account and their tokens reappear automatically—effectively a single guided step. Community feedback corroborates that switching devices via export/import was 'very easy' (ente-auth-comm-6), and offline-mode users can restore via password-protected local/CLI backups (docs-7, docs-8, docs-9, docs-11, ente-auth-probe-rt-1). Missing for 10: no explicit first-party step-by-step 'new phone setup/restore' walkthrough, and no independent hands-on account of the exact new-device login-and-sync flow.

   • [claimed-docs] “Auth has an app for every platform. Mobile, desktop and web. Your codes sync across all your devices, end-to-end encrypted.”
   • [claimed-docs] “Auth provides end-to-end encrypted cloud backups so you don't have to worry about losing your tokens.”
   • [claimed-docs] “Ente Auth can be used without an account by choosing **Use without backups**. In offline mode, your codes are stored only on that device.”
   • [claimed-docs] “Automatic daily backups: When enabled, Ente Auth creates one local backup per day when you open the app.”
   • [claimed-docs] “You can use [Ente's CLI](https://github.com/ente/ente/tree/main/cli#readme) to automatically backup your Auth codes.”
   • [community] “I have been using Aegis but switched to Ente Auth as I decided to use Ente Photos as well. Both Aegis and Ente Auth are great options. This …”
   • [probe] “PROBE runtime (recorded 2026-09-15): Ente's official CLI is packaged in Homebrew as ente-cli 0.3.0, described by the formula itself as 'Util…”

   proof ↗⚑ flag

1. ai-native userChoose where my data is stored (region/residency)

   weight 2 · round to Ente Auth
   1Password—none0/10

   No evidence pack item mentions data residency, regional storage options, or the ability to choose where a vault/account's data is physically stored; 1Password's architecture appears to be a single managed cloud service without documented regional selection. Missing for 10: any documentation of region/residency selection, EU/US data center choice, or self-hosted storage location controls.

   ⚑ flag

   Ente Auth~partialprobed5/10

   Ente Auth offers self-hosting instructions (running your own Ente Auth server) and an offline mode that keeps codes only on-device, both of which let a user control where their data lives rather than being forced into a fixed cloud region. However, there's no explicit region/residency selection (e.g., choosing an EU vs US data center) for its hosted cloud service. Missing for 10: explicit multi-region cloud storage options, documented data-residency guarantees for the hosted service.

   • [claimed-docs] “Alternatively, if using Ente Auth, get started by adding an account (assuming you are running Ente Auth at `http://<machine-ip>:3003` or `ht…”
   • [claimed-docs] “Ente Auth can be used without an account by choosing **Use without backups**. In offline mode, your codes are stored only on that device.”
   • [probe] “PROBE llms.txt: HTTP 200 at https://ente.com/llms.txt # Ente > Ente builds private, end-to-end encrypted apps for photos, two-factor authen…”

   proof ↗⚑ flag

2. ai-native userPrevent my data from being used to train AI models

   weight 3 · round to Ente Auth
   1Password—none0/10

   No evidence in the pack addresses any policy, setting, or documentation about opting out of or preventing data use for AI model training; the pack covers CLI/SDK/Connect/SSH/passkeys but nothing about AI training data usage or opt-outs.

   ⚑ flag

   Ente Auth~partialprobed5/10

   Ente Auth stores codes with end-to-end encryption, meaning Ente itself cannot access plaintext data, which structurally prevents it from being used to train AI models — but there is no explicit policy statement addressing AI training use of data. Missing for 10: an explicit AI-training data-use policy/statement, and any independent confirmation of this posture beyond the general E2E encryption claim.

   • [claimed-docs] “Auth provides end-to-end encrypted cloud backups so you don't have to worry about losing your tokens.”
   • [claimed-docs] “the data is encrypted using a key derived from the user's password”
   • [probe] “PROBE docs-md: HTTP 404 at https://ente.com/help/auth/.md”

   proof ↗⚑ flag

3. ai-native userControl data retention and deletion

   weight 2 · round to Ente Auth
   1Password—none0/10

   The pack shows data export/import and an MCP design that avoids returning secrets to agents, but there is no evidence of explicit controls for data retention policies or deletion (e.g., audit-log retention settings, vault/item purge, GDPR-style deletion) tailored to AI-native workflows. missing for 10: retention policy controls, explicit deletion/purge mechanisms for AI-consumed data, documentation tying these to AI agent use.

   ⚑ flag

   Ente Auth~partialprobed7/10

   Ente Auth lets users delete/trash codes with recovery or permanent deletion (docs-18/33/38), control backup location and encryption (docs-9/10), run fully offline with no cloud retention (doc-7), and export/decrypt all data via the official CLI for full portability (docs-11, probe-rt-1). However there's no explicit documentation on cloud-side account/data deletion policies or retention periods for encrypted server backups. Missing for 10: documented cloud account deletion/retention policy, independent confirmation of full data erasure on request.

   • [claimed-docs] “You can now trash codes that you don't need. ... You can recover codes from here, in case of accidental deletions, or delete them permanentl…”
   • [claimed-docs] “You can delete or edit a code by long pressing (or right clicking on desktop) on that item.”
   • [claimed-docs] “You can now trash codes that you don't need. These items will be moved to a separate section within the app, under the "Trash" header.”
   • [claimed-docs] “Ente Auth can be used without an account by choosing **Use without backups**. In offline mode, your codes are stored only on that device.”
   • [claimed-docs] “Password-protected: All local backups are encrypted with a password you set. Keep this password safe, because Ente cannot recover it for you…”
   • [claimed-docs] “Custom backup location: Choose where to store your backups on your device.”
   • [claimed-docs] “You can use [Ente's CLI](https://github.com/ente/ente/tree/main/cli#readme) to automatically backup your Auth codes.”
   • [probe] “PROBE runtime (recorded 2026-09-15): Ente's official CLI is packaged in Homebrew as ente-cli 0.3.0, described by the formula itself as 'Util…”

   proof ↗⚑ flag

4. ai-native userOpt out of telemetry and usage tracking

   weight 2 · round drawn
   1Password—none0/10

   No evidence pack item addresses telemetry/usage-tracking opt-out settings or privacy controls for AI-native usage; all evidence covers unrelated features like CLI, SSH, SDKs, and password management. This is a fair axis for any product handling sensitive data, but no documentation or community evidence confirms or denies a telemetry opt-out option.

   ⚑ flag

   Ente Auth—none0/10

   No evidence pack mentions any telemetry, analytics, or usage-tracking settings, opt-out toggles, or privacy policy statements about data collection in Ente Auth; the evidence covers import/export, backups, and sync features only.

   ⚑ flag

App lock

1. everyday userThe app itself locks behind biometrics or a PIN, so a borrowed phone doesn't expose my codes

   weight 2 · round to Ente Auth
   1Password—none0/10

   The evidence pack only covers CLI/SDK sign-in via system authentication (Touch ID/Windows Hello) for developer tooling, not the everyday consumer app's biometric/PIN lock screen protecting saved logins or OTP codes on a borrowed phone. No documentation or community evidence in the pack describes the mobile/desktop app requiring biometrics or PIN to unlock and view items like one-time passwords.

   ⚑ flag

   Ente Auth✓fullclaimed8/10

   Docs explicitly confirm FaceID lock (Settings → Security → Lockscreen) and a custom lock screen supporting PINs and passwords, directly matching the story's biometric/PIN app-lock requirement. missing for 10: no independent/hands-on confirmation that the lock actually blocks access on a borrowed device, and no mention of Android biometric or desktop lock parity beyond FaceID/PIN.

   • [claimed-docs] “You can enable FaceID lock under Settings → Security → Lockscreen.”
   • [claimed-docs] “You can now further protect your codes with a custom lock screen that supports PINs and passwords.”

   proof ↗⚑ flag

Audits

1. security engineerThe vendor publishes independent security audits of the app and its sync protocol

   weight 2 · round drawn
   1Password—none0/10

   No evidence in the pack references independent third-party security audits, pen-test reports, or cryptographic protocol reviews of 1Password's app or sync protocol (e.g., no mention of the publicly known white paper audits by NCC Group/etc.). All citations cover CLI, SDKs, SSH, passkeys, and general product docs, none addressing audit publication.

   ⚑ flag

   Ente Auth—none0/10

   No evidence pack item references any independent security audit of Ente Auth or its sync protocol; documentation focuses on features, encryption claims, and migration, not third-party audit reports.

   ⚑ flag

Monitoring

1. power userThe app warns me when a service I use is breached or a stored credential is weak, reused, or exposed

   weight 2 · round to 1Password
   1Password✓fullclaimed8/10

   Watchtower explicitly flags breaches, weak passwords, duplicate/reused items, and other security problems across saved items, directly matching the story's requirements, and it's surfaced natively in the app/browser extension (also flagging passkey-upgrade opportunities). Missing for 10: independent hands-on verification of Watchtower's breach-detection accuracy/coverage beyond vendor docs.

   • [claimed-docs] “Watchtower tells you about breaches, weak passwords, duplicate items, and other security problems with the items you have saved in 1Password…”
   • [claimed-docs] “opening Watchtower in 1Password, which now flags all of your existing logins that could be updated with a passkey”

   proof ↗⚑ flag

   Ente Auth—none0/10

   Ente Auth is a TOTP/HOTP authenticator app; nothing in the evidence pack shows breach-monitoring, weak/reused-credential detection, or exposure alerts — its documented features are around code storage, import/export, sharing, and lockscreen security.

   ⚑ flag

Push

1. it adminPush-based sign-in includes phishing defenses — number matching, location context, and admin-enforced MFA policies

   weight 2 · round drawn
   1Password—none0/10

   The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)

   ⚑ flag

   Ente Auth—none0/10

   The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)

   ⚑ flag

Server

1. it adminSelf-host the sync server on my own infrastructure and keep every secret inside my perimeter

   weight 2 · round to Ente Auth
   1Password!disputedcontradicted4/10

   1Password markets a 'Connect Server' that can be deployed in a company's own infrastructure to access items via REST API (docs-4), which sounds like partial self-hosting, but this is only a caching/access layer in front of 1Password's cloud vaults, not a full self-hosted sync server. Community evidence directly contradicts the idea that secrets can stay entirely within an admin's perimeter: users note 1Password has 'no local vault storage' anymore and ask the vendor to 'continue support for local, non-cloud-based vault files' (comm-7, comm-8), confirming that the cloud remains the source of truth. Missing for 10: any documented on-prem deployment of the full sync/vault backend, migration guide for self-hosted secret storage, or evidence that Connect Server operates without 1Password's cloud.

   • [claimed-docs] “1Password Connect Servers allow you to securely access your 1Password items and vaults in your company's apps and cloud infrastructure using…”
   • [community] “Use a tiny portion of that to continue support for local, non-cloud-based vault files please.”
   • [community] “Except they have already started to diminish what used to make 1P great. We now get no native apps, no local vault storage, no upfront payme…”

   proof ↗⚑ flag

   Ente Auth~partialprobed6/10

   Ente explicitly documents running the Auth server locally (e.g. at http://localhost:3003) and its server code is confirmed open source, supporting self-hosting for IT admins wanting to keep secrets in-perimeter. However, the evidence pack lacks detailed self-hosting setup docs (Docker/compose instructions, hardware requirements, upgrade/security guidance) and no independent community reports specifically about self-hosting the Auth server (only cloud usage is discussed in community threads). Missing for 10: full self-hosting deployment guide, independent hands-on verification of self-hosted Auth server, and security/perimeter assurances specific to self-hosted mode.

   • [claimed-docs] “Alternatively, if using Ente Auth, get started by adding an account (assuming you are running Ente Auth at `http://<machine-ip>:3003` or `ht…”
   • [probe] “PROBE runtime (recorded 2026-09-15): ente.com serves a live llms.txt — '# Ente — Ente builds private, end-to-end encrypted apps for photos, …”
   • [probe] “PROBE llms.txt: HTTP 200 at https://ente.com/llms.txt # Ente > Ente builds private, end-to-end encrypted apps for photos, two-factor authen…”

   proof ↗⚑ flag

Source

1. security engineerThe client apps are open source, so the code handling my seeds can be inspected and community-reviewed

   weight 2 · round to Ente Auth
   1Password—none0/10

   No evidence in the pack indicates 1Password's client apps are open source or available for community code review; all citations describe closed commercial SDKs, CLI, Connect servers, and browser extension features without any open-source licensing or public repository claims for the core vault/client apps themselves. missing for 10: any statement of open-source licensing for 1Password clients, a public source repository for the desktop/mobile/browser apps, or third-party audit citing open code review.

   ⚑ flag

   Ente Auth✓fullprobed7/10

   Ente's own llms.txt explicitly states 'Ente's apps and server are open source,' and a community poster on HN independently confirms 'thank you for releasing it open source,' corroborating that the client code is publicly available for inspection. Missing for 10: a direct link/reference to the actual auth client source repo, and independent evidence of community security review or audits of the seed-handling code.

   • [probe] “PROBE runtime (recorded 2026-09-15): ente.com serves a live llms.txt — '# Ente — Ente builds private, end-to-end encrypted apps for photos, …”
   • [community] “This looks quite nice, thank you for releasing it open source... One note as I signed up for an account is that the email verification went …”

   proof ↗⚑ flag

Automation

1. ai-native userAn agent can fetch a current TOTP code programmatically — via CLI or API — to complete a 2FA login inside an automated workflow

   weight 2 · round to 1Password
   1Password~partialprobed4/10

   1Password docs confirm OTP storage/lookup in the app (docs-20, docs-24, docs-19) and a general-purpose CLI/SDK for programmatic item access (docs-1, docs-2, docs-26, probe-rt-3), which together imply an agent could retrieve a TOTP field via CLI, but no evidence explicitly documents a TOTP-specific command or API response format for pulling a live 2FA code in an automated workflow. missing for 10: explicit CLI/API documentation of TOTP field retrieval (e.g., a `--otp` flag or field type), and any example/community confirmation of an agent completing 2FA end-to-end.

   • [claimed-docs] “Learn how to use 1Password to store and quickly access your one-time passwords when you turn on two-step verification for a website.”
   • [claimed-docs] “Use 1Password on your Apple Watch to quickly look up information: credit card numbers and PINs, one-time passwords”
   • [claimed-docs] “Use 1Password on your Apple Watch to quickly look up information: credit card numbers and PINs, one-time passwords, bank account details, pa…”
   • [claimed-docs] “1Password CLI brings 1Password to your terminal. Learn how to install the CLI, then integrate it with your 1Password app and sign in with To…”
   • [claimed-docs] “op item list --vault Private”
   • [claimed-docs] “1Password SDKs allow you to build integrations that programmatically interact with 1Password using Go, JavaScript, or Python.”
   • [probe] “PROBE runtime (recorded 2026-09-15): the official op CLI is packaged in Homebrew as the 1password-cli cask ('Command-line interface for 1Pas…”

   proof ↗⚑ flag

   Ente Auth—none0/10

   Evidence only shows a CLI for exporting/backing up and decrypting Ente Auth data (ente-auth-docs-11, ente-auth-probe-rt-1), not for programmatically retrieving a live/current TOTP code for use in an automated 2FA login. No API, CLI subcommand, or docs describe generating a real-time code for agent consumption.

   • [claimed-docs] “You can use [Ente's CLI](https://github.com/ente/ente/tree/main/cli#readme) to automatically backup your Auth codes.”
   • [probe] “PROBE runtime (recorded 2026-09-15): Ente's official CLI is packaged in Homebrew as ente-cli 0.3.0, described by the formula itself as 'Util…”
   • [probe] “PROBE openapi: all candidate paths 404 (https://ente.com/openapi.json, https://ente.com/swagger.json, https://ente.com/api/openapi.json, htt…”

   proof ↗⚑ flag

2. ai-native userExpose the vault through a local programmatic endpoint an agent can query for codes and secrets without screen-scraping the app

   weight 1 · round to 1Password
   1Password✓fullprobed8/10

   The 1Password CLI (`op`) and SDKs/Connect Server provide a local, scriptable, programmatic interface (not screen-scraping) that returns items, secrets, and OTP codes directly, and this is corroborated by real-world packaging (Homebrew cask) confirming it's a genuine local endpoint agents can shell out to. Missing for 10: no direct hands-on evidence of an AI agent actually querying the CLI/Connect Server for codes, and the newer MCP server explicitly withholds raw secrets from the agent, so full 'codes and secrets' access is only fully realized via CLI/SDK, not MCP.

   • [claimed-docs] “1Password CLI brings 1Password to your terminal. Learn how to install the CLI, then integrate it with your 1Password app and sign in with To…”
   • [claimed-docs] “op item list --vault Private”
   • [claimed-docs] “Use the 1Password Credential Broker to give CI/CD and other machine workflows short-lived access to secrets, without managing service accoun…”
   • [claimed-docs] “1Password Connect Servers allow you to securely access your 1Password items and vaults in your company's apps and cloud infrastructure using…”
   • [claimed-docs] “1Password SDKs allow you to build integrations that programmatically interact with 1Password using Go, JavaScript, or Python.”
   • [probe] “official CLI documented at https://www.1password.dev/cli/get-started”
   • [probe] “PROBE runtime (recorded 2026-09-15): the official op CLI is packaged in Homebrew as the 1password-cli cask ('Command-line interface for 1Pas…”
   • [probe] “PROBE runtime (recorded 2026-09-15): 1Password's public docs MCP server at https://www.1password.dev/mcp completed a FULL keyless initialize…”

   proof ↗⚑ flag

   Ente Auth—none0/10

   No evidence of any local API, IPC endpoint, or programmatic interface for querying codes; the only related tooling is the export/backup CLI (docs-11, probe-rt-1), which produces files rather than a queryable local endpoint an agent could hit live. No OpenAPI/local server documentation was found (probe-3 confirms no openapi endpoint).

   • [claimed-docs] “You can use [Ente's CLI](https://github.com/ente/ente/tree/main/cli#readme) to automatically backup your Auth codes.”
   • [probe] “PROBE runtime (recorded 2026-09-15): Ente's official CLI is packaged in Homebrew as ente-cli 0.3.0, described by the formula itself as 'Util…”
   • [probe] “PROBE openapi: all candidate paths 404 (https://ente.com/openapi.json, https://ente.com/swagger.json, https://ente.com/api/openapi.json, htt…”

   proof ↗⚑ flag

Browser

1. everyday userA browser extension autofills my TOTP codes and passkeys during login instead of making me retype them

   weight 2 · round to 1Password
   1Password✓fullcommunity8/10

   Docs confirm browser extension autofills passkeys during sign-in and stores/retrieves one-time passwords (TOTP), covering both parts of the story, with community corroboration of browser extension quality and iframe-aware autofill behavior. Missing for 10: explicit first-party statement or hands-on demo showing TOTP codes specifically autofilled (rather than just 'stored/accessed') and independent confirmation of passkey autofill working reliably across sites.

   • [claimed-docs] “you can now create, manage, and sign in with passkeys on a growing number of websites and apps directly from the 1Password browser extension”
   • [claimed-docs] “You can use 1Password to save the passkeys you create for your accounts and sign in to websites with passkeys in your browser.”
   • [claimed-docs] “Learn how to use 1Password to store and quickly access your one-time passwords when you turn on two-step verification for a website.”
   • [claimed-docs] “1Password lets you easily sign in to sites, use suggested passwords, and find what you need – all without leaving your browser.”
   • [community] “1Password fills iframes based on their domain rather than the parents... In my opinion this is the right security model.”
   • [community] “Both the Fastmail and Privacy integrations have made 1Password a joy to use in the past few years. I've used premium BitWarden in the past, …”

   proof ↗⚑ flag

   Ente Auth—none0/10

   No evidence of a browser extension for Ente Auth; the product is described as apps for mobile, desktop and web with manual QR-scan/setup-key entry, not autofill via a browser extension for TOTP or passkeys during login.

   ⚑ flag

Desktop

1. power userA first-class desktop app gives me codes and vault access on my computer, not just on mobile

   weight 2 · round to Ente Auth
   1Password~partialcommunity5/10

   Evidence confirms a desktop 1Password app exists (CLI integrates with 'the 1Password app' via Touch ID/Windows Hello, and community references to the Electron-based desktop client) and that vault/OTP data is stored centrally and accessible from apps generally, but no evidence pack item explicitly documents desktop-specific vault UI or OTP display screens, and community notes flag desktop app quality concerns (Electron complaints, no native app comments). missing for 10: dedicated desktop-app feature docs (OTP display, vault browsing UI on Mac/Windows/Linux), first-party screenshots or hands-on confirmation of parity with mobile, and resolution of the Electron/native-app criticism.

   • [claimed-docs] “1Password CLI brings 1Password to your terminal. Learn how to install the CLI, then integrate it with your 1Password app and sign in with To…”
   • [claimed-docs] “Learn how to use 1Password to store and quickly access your one-time passwords when you turn on two-step verification for a website.”
   • [community] “Except they have already started to diminish what used to make 1P great. We now get no native apps, no local vault storage, no upfront payme…”
   • [community] “It would be nice to say goodbye to Electron, though... (referring to 1Password's desktop app).”
   • [community] “Mandatory 'No Linux client' comment :| Does anyone have any insight if this is a pure business decision or there's something holding them ba…”

   proof ↗⚑ flag

   Ente Auth✓fullcommunity7/10

   Ente Auth explicitly ships native desktop clients (Flathub Linux app, plus 'app for every platform: Mobile, desktop and web' with full sync) and desktop-specific UI features like right-click code editing, matching a first-class desktop experience; a HN user corroborates switching to it specifically for its desktop app after Authy dropped theirs. missing for 10: explicit list/docs of Windows/Mac desktop builds beyond Flathub, and an independent hands-on review confirming full feature parity with mobile.

   • [claimed-docs] “Auth is now officially available on [Flathub](https://flathub.org/apps/io.ente.auth)!”
   • [claimed-docs] “Auth has an app for every platform. Mobile, desktop and web. Your codes sync across all your devices, end-to-end encrypted.”
   • [claimed-docs] “You can delete or edit a code by long pressing (or right clicking on desktop) on that item.”
   • [community] “Ente Auth is awesome - I've been using it ever since Authy discontinued their desktop app.”

   proof ↗⚑ flag

Watch

1. everyday userRead my codes from my smartwatch without pulling out my phone

   weight 1 · round to 1Password
   1Password✓fullclaimed8/10

   1Password explicitly documents Apple Watch support for quickly looking up saved information including one-time passwords, letting users read codes without pulling out their phone. This directly matches the story, though evidence is limited to Apple Watch (no mention of other smartwatch platforms like Wear OS) and lacks independent hands-on corroboration. Missing for 10: evidence of Android/Wear OS smartwatch support, independent user reviews confirming the watch OTP experience.

   • [claimed-docs] “Use 1Password on your Apple Watch to quickly look up information: credit card numbers and PINs, one-time passwords, bank account details, pa…”
   • [claimed-docs] “Use 1Password on your Apple Watch to quickly look up information: credit card numbers and PINs, one-time passwords”
   • [claimed-docs] “Learn how to use 1Password to store and quickly access your one-time passwords when you turn on two-step verification for a website.”

   proof ↗⚑ flag

   Ente Auth—none0/10

   The evidence pack covers mobile/desktop/web platform support, import/export, sharing, and lockscreen features, but contains no mention of smartwatch (e.g. Wear OS, watchOS) support or companion app for viewing codes without pulling out a phone.

   ⚑ flag

Backup

1. security engineerBackups are end-to-end encrypted with a key the vendor never holds, and the encryption design is documented

   weight 3 · round to Ente Auth
   1Password—none0/10

   The evidence pack contains no documentation of 1Password's end-to-end encryption architecture, Secret Key design, or zero-knowledge claims for vaults/backups — it only covers CLI/SDK/Connect/SSH tooling and unrelated community commentary on UX and pricing. Without any citation describing the encryption design or vendor-key-never-held guarantee, this axis is unevidenced.

   ⚑ flag

   Ente Auth~partialprobed6/10

   Ente docs state cloud backups are end-to-end encrypted (docs-27, docs-34) and local backups are encrypted with a password-derived key that Ente cannot recover (docs-9, docs-12), plus open-source apps/server are confirmed (probe-rt-2), supporting a 'vendor never holds key' claim. However there is no detailed cryptographic design doc (key derivation algorithm, protocol specifics, audit report) in the evidence, only high-level marketing/FAQ statements. Missing for 10: a published encryption whitepaper or technical spec, and independent security audit/corroboration of the E2E design.

   • [claimed-docs] “Auth has an app for every platform. Mobile, desktop and web. Your codes sync across all your devices, end-to-end encrypted.”
   • [claimed-docs] “Auth provides end-to-end encrypted cloud backups so you don't have to worry about losing your tokens.”
   • [claimed-docs] “Password-protected: All local backups are encrypted with a password you set. Keep this password safe, because Ente cannot recover it for you…”
   • [claimed-docs] “the data is encrypted using a key derived from the user's password”
   • [probe] “PROBE runtime (recorded 2026-09-15): ente.com serves a live llms.txt — '# Ente — Ente builds private, end-to-end encrypted apps for photos, …”

   proof ↗⚑ flag

Multi device

1. everyday userMy tokens are available on my phone, tablet, and computer at the same time, kept in sync automatically

   weight 2 · round to Ente Auth
   1Password✓fullcommunity6/10

   Docs show 1Password stores and retrieves one-time-passwords (tokens) across the browser, Apple Watch, and other apps (docs-20, docs-19/24, docs-21), implying that the same vault (and thus tokens) is accessible from phone, tablet, and desktop, and a community comment confirms 'desktop and mobile work great' (comm-9), suggesting real-world cross-device consistency. However none of the evidence explicitly describes the automatic sync mechanism or confirms real-time consistency across all three device types simultaneously. Missing for 10: explicit documentation of the cloud-sync architecture ensuring instant multi-device consistency, and independent testing/benchmarks of sync latency or conflict handling.

   • [claimed-docs] “Learn how to use 1Password to store and quickly access your one-time passwords when you turn on two-step verification for a website.”
   • [claimed-docs] “Use 1Password on your Apple Watch to quickly look up information: credit card numbers and PINs, one-time passwords, bank account details, pa…”
   • [claimed-docs] “Use 1Password on your Apple Watch to quickly look up information: credit card numbers and PINs, one-time passwords”
   • [claimed-docs] “1Password lets you easily sign in to sites, use suggested passwords, and find what you need – all without leaving your browser.”
   • [community] “I've used 1password for years and so far haven't had any problem, all apps (desktop and mobile) work great, but I don't understand why they …”

   proof ↗⚑ flag

   Ente Auth✓fullcommunity8/10

   Ente Auth explicitly advertises multi-platform apps (mobile, desktop, web) with end-to-end encrypted cloud sync so codes stay in sync across devices, and community evidence corroborates real-world use across app switches without complaint about sync failures. Missing for 10: independent hands-on confirmation of real-time multi-device sync latency/reliability and any edge-case sync bugs reported by users.

   • [claimed-docs] “Auth has an app for every platform. Mobile, desktop and web. Your codes sync across all your devices, end-to-end encrypted.”
   • [claimed-docs] “Auth provides end-to-end encrypted cloud backups so you don't have to worry about losing your tokens.”
   • [community] “Ente Auth is awesome - I've been using it ever since Authy discontinued their desktop app.”
   • [community] “I have been using Aegis but switched to Ente Auth as I decided to use Ente Photos as well. Both Aegis and Ente Auth are great options. This …”

   proof ↗⚑ flag

Recovery

1. everyday userLosing my phone doesn't lose my accounts — a documented recovery path restores my tokens on a new device

   weight 3 · round to Ente Auth
   1Password—none0/10

   The evidence pack covers 1Password's password/OTP storage, sync, import/export between apps, SSH/passkey features, and developer tooling, but contains no documentation of a lost-device recovery path (e.g., Emergency Kit, Secret Key re-enrollment, account recovery flow) that would restore an everyday user's tokens on a new device after losing their phone. Missing for 10: documented device-loss/account-recovery procedure, evidence of Secret Key or Emergency Kit restoration flow, any confirmation that OTPs specifically survive a lost-device scenario.

   ⚑ flag

   Ente Auth✓fullprobed8/10

   Ente Auth documents end-to-end encrypted cloud sync/backups so codes restore on a new device after login, plus a recovery key to bypass 2FA lockouts, local encrypted backups, and a CLI export tool as additional restore paths. missing for 10: no independent hands-on account of a real device-loss recovery walkthrough, and no detail on exact steps to restore cloud-synced codes on a fresh device beyond general sync claims.

   • [claimed-docs] “Auth has an app for every platform. Mobile, desktop and web. Your codes sync across all your devices, end-to-end encrypted.”
   • [claimed-docs] “Auth provides end-to-end encrypted cloud backups so you don't have to worry about losing your tokens.”
   • [claimed-docs] “We recommend that you ensure you store your recovery key in a safe place (writing it down on a paper is a good idea). This key can be used t…”
   • [claimed-docs] “Automatic daily backups: When enabled, Ente Auth creates one local backup per day when you open the app.”
   • [claimed-docs] “Password-protected: All local backups are encrypted with a password you set. Keep this password safe, because Ente cannot recover it for you…”
   • [claimed-docs] “You can use [Ente's CLI](https://github.com/ente/ente/tree/main/cli#readme) to automatically backup your Auth codes.”
   • [probe] “PROBE runtime (recorded 2026-09-15): Ente's official CLI is packaged in Homebrew as ente-cli 0.3.0, described by the formula itself as 'Util…”
   • [community] “Ente has free backups and it's own encrypted export format, which sounds promissing.”

   proof ↗⚑ flag

Automation

1. ai-native userAn agent can create and update vault entries — seeding new TOTP secrets, storing credentials — through documented programmatic surfaces

   weight 2 · round to 1Password
   1Password✓fullprobed7/10

   1Password documents multiple programmatic surfaces (CLI, SDKs in Go/JS/Python, Connect Servers REST API, Service Accounts) explicitly for 'Automate item management: Programmatically manage items in your 1Password account,' which covers creating and updating vault entries including credentials. These are official, well-documented interfaces suitable for agent-driven automation. Missing for 10: an explicit documented example/field reference for seeding TOTP secrets via these APIs, and independent/hands-on verification that write operations (create/update, not just read) work reliably in practice.

   • [claimed-docs] “Automate item management: Programmatically manage items in your 1Password account.”
   • [claimed-docs] “1Password SDKs allow you to build integrations that programmatically interact with 1Password using Go, JavaScript, or Python.”
   • [claimed-docs] “1Password Connect Servers allow you to securely access your 1Password items and vaults in your company's apps and cloud infrastructure using…”
   • [claimed-docs] “1Password Service Accounts help automate secrets management in your applications and infrastructure without the need to deploy additional se…”
   • [claimed-docs] “1Password CLI brings 1Password to your terminal. Learn how to install the CLI, then integrate it with your 1Password app and sign in with To…”
   • [probe] “PROBE runtime (recorded 2026-09-15): the official op CLI is packaged in Homebrew as the 1password-cli cask ('Command-line interface for 1Pas…”

   proof ↗⚑ flag

   Ente Auth—none0/10

   Evidence shows only manual QR-scan/setup-key entry, GUI import/export, and a CLI limited to exporting and decrypting backups—no documented API, SDK, or CLI subcommand for programmatically creating or updating vault entries. No OpenAPI/API surface was found (ente-auth-probe-3 confirms no openapi.json), so an agent has no documented programmatic surface to seed or update TOTP secrets.

   • [claimed-docs] “You can use [Ente's CLI](https://github.com/ente/ente/tree/main/cli#readme) to automatically backup your Auth codes.”
   • [probe] “PROBE runtime (recorded 2026-09-15): Ente's official CLI is packaged in Homebrew as ente-cli 0.3.0, described by the formula itself as 'Util…”
   • [probe] “PROBE openapi: all candidate paths 404 (https://ente.com/openapi.json, https://ente.com/swagger.json, https://ente.com/api/openapi.json, htt…”
   • [claimed-docs] “Scan the QR code shown by the service.”
   • [claimed-docs] “Enter the account name, issuer, and secret (setup key).”

   proof ↗⚑ flag

Policy

1. it adminEnforce org-wide policies — require app lock, restrict export, mandate strong master credentials — across every member's app

   weight 1 · round drawn
   1Password—none0/10

   The evidence pack covers CLI/SDK developer tooling, personal password features, import/export, and community sentiment, but contains no documentation of admin console policies for enforcing app lock, restricting export, or mandating master password strength across an organization. This axis clearly applies to a business password manager, but no supporting evidence is present.

   ⚑ flag

   Ente Auth—none0/10

   No evidence of any org-wide admin console, centralized policy enforcement, mandated master password strength, or app lock/export restrictions applied across members — Ente Auth is a personal/individual authenticator with local lock screen (per-device) and personal backup/export options, not a managed enterprise policy tool.

   • [claimed-docs] “You can now further protect your codes with a custom lock screen that supports PINs and passwords.”
   • [claimed-docs] “Password-protected: All local backups are encrypted with a password you set. Keep this password safe, because Ente cannot recover it for you…”
   • [claimed-docs] “You can use [Ente's CLI](https://github.com/ente/ente/tree/main/cli#readme) to automatically backup your Auth codes.”

   proof ↗⚑ flag

Sharing

1. it adminMy team can share TOTP-protected logins through shared vaults or collections with per-member access control

   weight 2 · round to Ente Auth
   1Password—none0/10

   The evidence pack covers 1Password's developer tooling (CLI, SDKs, Connect, SSH agent) and personal features (Watchtower, OTP storage, passkeys) but contains no mention of shared vaults, collections, group/per-member permissions, or admin controls for team sharing of TOTP items. Missing for 10: documentation of shared vaults/collections, per-member access control settings, or admin console screenshots showing granular sharing permissions for TOTP logins.

   • [claimed-docs] “Learn how to use 1Password to store and quickly access your one-time passwords when you turn on two-step verification for a website.”
   • [claimed-docs] “Watchtower tells you about breaches, weak passwords, duplicate items, and other security problems with the items you have saved in 1Password…”

   proof ↗⚑ flag

   Ente Auth~partialclaimed4/10

   Ente Auth documents sharing individual TOTP codes via temporary, end-to-end encrypted links with teammates (docs-16, docs-35), and explicitly restricts sharing to TOTP (not HOTP) entries (docs-30), which covers the core 'share TOTP logins with team' idea. However there is no evidence of a vault/collection construct or per-member access control (e.g., role-based permissions, group vaults, admin-managed membership) — sharing appears to be per-code link generation rather than an admin-managed shared vault. Missing for 10: evidence of collection/vault-based sharing, per-member access control or roles, and admin management console for team access.

   • [claimed-docs] “You can now easily share specific codes with your team, with temporary links that are end-to-end encrypted.”
   • [claimed-docs] “Share codes with your team securely”
   • [claimed-docs] “Sharing is now limited to TOTP codes; the share option is hidden for HOTP entries.”

   proof ↗⚑ flag

Enrollment

1. everyday userScan a QR code and immediately start generating TOTP codes for a new account

   weight 3 · round to Ente Auth
   1Password~partialclaimed4/10

   Docs confirm 1Password stores and generates one-time passwords for two-step verification (docs-20, docs-19/24), which implies TOTP support, but no evidence explicitly describes the QR-code scanning flow for adding a new TOTP account. Missing for 10: explicit documentation or screenshots of QR code scanning to add a new TOTP entry, and independent/hands-on confirmation of the immediate code-generation experience.

   • [claimed-docs] “Learn how to use 1Password to store and quickly access your one-time passwords when you turn on two-step verification for a website.”
   • [claimed-docs] “Use 1Password on your Apple Watch to quickly look up information: credit card numbers and PINs, one-time passwords, bank account details, pa…”
   • [claimed-docs] “Use 1Password on your Apple Watch to quickly look up information: credit card numbers and PINs, one-time passwords”

   proof ↗⚑ flag

   Ente Auth✓fullclaimed8/10

   Docs explicitly describe scanning a QR code shown by a service to add a new account, both generally (docs-1) and for specific migration flows (docs-6/41), which immediately generates TOTP codes in the app. This core flow is directly and simply documented as the primary onboarding method. Missing for 10: independent hands-on confirmation of the exact scan-to-code-generation moment and any UX friction reports.

   • [claimed-docs] “Scan the QR code shown by the service.”
   • [claimed-docs] “Enter the account name, issuer, and secret (setup key).”
   • [claimed-docs] “Tap the add button and scan the QR code shown by the service.”
   • [claimed-docs] “Open Ente Auth. Tap the add button and scan the QR code shown by the service.”

   proof ↗⚑ flag

Offline

1. power userCodes generate fully offline — no network, no vendor account required just to see my TOTP codes

   weight 2 · round to Ente Auth
   1Password!disputedcontradicted3/10

   1Password does store and display OTP codes (docs-20, docs-24), but the product fundamentally requires a 1Password account/subscription and cloud-synced vault to unlock and view items — community evidence explicitly states 1Password has moved away from local, non-cloud vault storage ('no native apps, no local vault storage... The VC rot has already set in'), directly contradicting the 'no vendor account required' claim. Missing for 10: any first-party or independent confirmation of a fully offline mode with no account signup/sync dependency, and no evidence disputes this gap.

   • [claimed-docs] “Learn how to use 1Password to store and quickly access your one-time passwords when you turn on two-step verification for a website.”
   • [claimed-docs] “Use 1Password on your Apple Watch to quickly look up information: credit card numbers and PINs, one-time passwords”
   • [community] “My 1Password installation is grandfathered from a time when it was just a standalone app, without subscription. Will it just stop working on…”
   • [community] “Use a tiny portion of that to continue support for local, non-cloud-based vault files please.”
   • [community] “Except they have already started to diminish what used to make 1P great. We now get no native apps, no local vault storage, no upfront payme…”

   proof ↗⚑ flag

   Ente Auth✓fullclaimed8/10

   Docs explicitly confirm offline mode with no account required, codes stored only on-device, and no network dependency for viewing codes. Missing for 10: independent hands-on verification (e.g. airplane-mode test) beyond vendor docs, and no detail on how backups/imports work fully offline without any cloud touchpoint.

   • [claimed-docs] “Ente Auth can be used without an account by choosing **Use without backups**. In offline mode, your codes are stored only on that device.”
   • [claimed-docs] “Use without an account”

   proof ↗⚑ flag

Organization

1. power userKeep dozens of tokens organized — search, folders or groups, and service icons — so the right code is always two taps away

   weight 2 · round to Ente Auth
   1Password~partialclaimed3/10

   Docs confirm 1Password stores and quickly surfaces one-time passwords (including via Apple Watch) and flags login issues via Watchtower, but the pack provides no evidence of folder/tag/group organization, dedicated search, or service icons for TOTP entries specifically. missing for 10: explicit search functionality, folder/tag/group organization for TOTP items, service icon display for OTP entries, independent hands-on validation of organizing many tokens.

   • [claimed-docs] “Learn how to use 1Password to store and quickly access your one-time passwords when you turn on two-step verification for a website.”
   • [claimed-docs] “Use 1Password on your Apple Watch to quickly look up information: credit card numbers and PINs, one-time passwords, bank account details, pa…”
   • [claimed-docs] “Use 1Password on your Apple Watch to quickly look up information: credit card numbers and PINs, one-time passwords”
   • [claimed-docs] “Watchtower tells you about breaches, weak passwords, duplicate items, and other security problems with the items you have saved in 1Password…”

   proof ↗⚑ flag

   Ente Auth~partialclaimed6/10

   Ente Auth's marketing docs confirm search (deep-link search feature), service icons, and favoriting/organizing features ('Organize with ease', 'Favorite services to the top', 'Don't scroll'), directly supporting quick access to tokens. However, there is no concrete evidence of folder or group/category organization for large token sets — only vague 'organize with ease' copy and free-text notes (500-char annotations), not structured grouping. Missing for 10: explicit folder/category/tagging feature documentation, evidence of grouping many tokens, independent hands-on confirmation of organization UX at scale.

   • [claimed-docs] “Save time by viewing your next code”
   • [claimed-docs] “Easily identify your tokens by their icons”
   • [claimed-docs] “Organize with ease”
   • [claimed-docs] “Favorite services to the top”
   • [claimed-docs] “Don't scroll”
   • [claimed-docs] “Added support for search deep links via enteauth://search.”
   • [claimed-docs] “You can attach any text (upto a maximum of 500 characters), to provide more information about your accounts.”

   proof ↗⚑ flag

Variants

1. power userNon-standard tokens work too — Steam Guard, HOTP counters, custom periods and digit lengths

   weight 2 · round to Ente Auth
   1Password—none0/10

   The evidence only confirms basic one-time password storage (docs-20, docs-19) but contains no mention of Steam Guard tokens, HOTP counter-based codes, or custom period/digit-length TOTP support. Missing for 10: any documentation of Steam Guard support, HOTP counter handling, or custom period/digit configuration.

   ⚑ flag

   Ente Auth~partialclaimed4/10

   Evidence confirms HOTP entries are supported (the changelog notes sharing is now limited to TOTP and hidden for HOTP entries), implying native HOTP counter support. However, there is no mention anywhere in the evidence pack of Steam Guard token support, or of custom period/digit-length configuration for TOTP entries. missing for 10: explicit Steam Guard support, custom period/digit-length configuration, and any hands-on confirmation beyond the changelog note.

   • [claimed-docs] “Sharing is now limited to TOTP codes; the share option is hidden for HOTP entries.”

   proof ↗⚑ flag