In a recent shift toward AI-native software development, 1Password has integrated OpenAI Codex into its engineering workflow, resulting in a 21% increase in productivity. By utilizing OpenAI’s specialized models for code generation, the security-first company has successfully compressed the time between planning and production without compromising its rigorous data protection standards.

Quantifying the Impact of Codex at 1Password

1Password's implementation of Codex across the software delivery lifecycle (SDLC) has produced measurable efficiency gains. For a modeled cohort of 50 active developers, the company estimated an annual engineering capacity value of $783,750.

Key Performance Indicators (KPIs):

• 20.9% Productivity Improvement: Measured across the core Codex user cohort.
• 10.9% Reduction in Cycle Time: The median time for pull request cycles was significantly shortened.
• 90% Faster Investigations: A complex production issue spanning 10+ microservices had its investigation time slashed from 2 hours to just 5–20 minutes.
• 553% ROI: Modeled return on investment based on productive capacity reinvested into innovation.

"One-Shotting" Features: From Idea to Prototype

One of the most significant changes noted by Nancy Wang, CTO of 1Password, is the ability to "one-shot" new features. Previously, projects required extensive breakdown into sprints across multiple scrum teams. With Codex, engineers can provide a user story and specific instructions, and the AI generates functional specs and a near-final prototype.

Examples of tools built using this accelerated workflow include:

• Knox: A fully agentic frontend design system to help teams build interfaces.
• Internal AI SRE Agent: Specialized for site reliability engineering tasks.
• AI Spend Management: An internal tool for financial oversight.

Maintaining Security in an AI-Driven Workflow

For a company like 1Password, security is not optional. The team maintains a zero-knowledge architecture, ensuring that sensitive data remains encrypted and inaccessible to the AI model itself.

To achieve this, 1Password utilizes "secret references." Instead of placing plaintext credentials in code repositories where a model might process them, the company keeps references. When Codex calls an internal tool, 1Password injects the actual credential only at the point of action, keeping the sensitive values out of the model's context.

Furthermore, 1Password has codified its security policies into "reusable AppSec skills." These automated checks travel with the development workflow, ensuring that every line of AI-assisted code meets the company's stringent standards before it moves to production.

The Democratization of Building

The success in engineering has led 1Password to expand access to OpenAI tools to other departments, including finance and marketing. This shift marks what CTO Nancy Wang calls the "second wave" of AI—where roles traditionally distant from code, such as Product Managers and Designers, begin shipping code and building tools independently.

"I think the last mile is actually getting everybody in a company to build. That’s what we’re going to see over the next 12 months... folks who don’t think of themselves as builders becoming so comfortable with AI tools that they can ship code confidently." — Nancy Wang, CTO, 1Password

FAQ: OpenAI Codex at 1Password

Q: How does 1Password keep user data safe while using AI?
A: 1Password uses a zero-knowledge architecture. Sensitive credentials are never shared with the AI. Instead, the company uses "secret references" that are only resolved at the moment of execution, keeping the model context clean of plaintext data.

Q: What is the main benefit 1Password saw from Codex?
A: Beyond a 21% productivity boost, the primary benefit was shortening the feedback loop between customer feedback and UI changes, allowing the company to ship features faster.

Q: Is Codex only used for writing new code?
A: No. 1Password uses Codex across the entire lifecycle, including technical design, pull request reviews, automated testing, and investigating production incidents across multiple microservices.