For passkey export, there is a FIDO specification for both a format and secure protocol for exchanging passwords and passkey information between password managers, with support on all Apple platforms, and implemented by 1Password, Bitwarden, Dashlane, and more:
https://rmondello.com/2026/09/07/switching-password-managers...
https://fidoalliance.org/download-credential-exchange-specif...
For the iCloud syncing, I believe they've done that since iCloud Keychain/Apple Passwords was first a thing; I've been aware of it since they introduced it, but perhaps that was more explicit when it was first added. The comment below from a now-defunct 1Password employee account describes the thinking there:
> Importantly, the entire role of the Secret Key is to protect you from us and anything that might happen on our end, like a breach of 1Password’s servers. It does not (and can not) protect you from a local attack. This is mentioned in 1Password’s Security Design white paper [ed: on page 74 of an old PDF; I've linked the newer HTML document below], which goes into detail about the locally exposed Secret Key.
https://www.reddit.com/r/1Password/comments/10iqhdp/comment/...
https://agilebits.github.io/security-design/index.html
I do get why that might be surprising. Without going through the whole onboarding process on a fresh device I can't say how well they highlight that or how easy it is to blow past. All I can say is 1) I've known about it for years and 2) having read through the white paper of how iCloud Keychain works I _personally_ trust iCloud Keychain/Passwords about as much as I trust 1Password, maybe _slightly_ more - but I am also not a security professional, so take my word with very little salt :)
https://rmondello.com/2026/09/07/switching-password-managers...
https://fidoalliance.org/download-credential-exchange-specif...
For the iCloud syncing, I believe they've done that since iCloud Keychain/Apple Passwords was first a thing; I've been aware of it since they introduced it, but perhaps that was more explicit when it was first added. The comment below from a now-defunct 1Password employee account describes the thinking there:
> Importantly, the entire role of the Secret Key is to protect you from us and anything that might happen on our end, like a breach of 1Password’s servers. It does not (and can not) protect you from a local attack. This is mentioned in 1Password’s Security Design white paper [ed: on page 74 of an old PDF; I've linked the newer HTML document below], which goes into detail about the locally exposed Secret Key.
https://www.reddit.com/r/1Password/comments/10iqhdp/comment/...
https://agilebits.github.io/security-design/index.html
I do get why that might be surprising. Without going through the whole onboarding process on a fresh device I can't say how well they highlight that or how easy it is to blow past. All I can say is 1) I've known about it for years and 2) having read through the white paper of how iCloud Keychain works I _personally_ trust iCloud Keychain/Passwords about as much as I trust 1Password, maybe _slightly_ more - but I am also not a security professional, so take my word with very little salt :)