1Password Has Been Remote Since 2005. It Still Will Not Hire You Anywhere.

Last week we read Grafana Labs' job posts and found a company that hires in two regions and describes them eleven different ways. Nobody had centralised the sentence, and you could see the org chart in the mess.

This week, the control case.

1Password has been distributed since 2005. Every one of its twenty-six open roles is remote, every one publishes a salary band, and twenty-three of them carry the same restriction written almost identically every time.

Two companies, same question, opposite fingerprints. The second one is more interesting than we expected.

Fact box

The story

Dave Teare and Roustem Karimov were building websites in Toronto in 2005 and got tired of typing the same test logins into the same forms. So they wrote something to do it for them, on a weekend, for themselves. That was the first version of 1Password.

The company they incorporated it under, AgileBits, stayed the legal name for years while 1Password became the thing anyone had heard of. Teare has written that commuting less and seeing his family more was on his mind from the start, which is a fairly ordinary motivation that turned into a fairly unusual company: they were remote before remote was a position anyone held.

The other unusual part is that they stayed private and profitable on their own money for fourteen years. The founders owned the whole thing until 2019, when they took outside investment for the first time in a round led by Accel. Most companies you can name were built the other way around.

That matters for reading their hiring. A team that spent fourteen years unable to hire ahead of revenue develops habits, and you can still see them in the job posts.

How they build

Go is the centre of gravity. It shows up in more of their open roles than anything else, with Rust in the systems-adjacent work and TypeScript with React on the front end. Kubernetes underneath, split across GCP and AWS rather than committed to one.

For a company whose product is a secrets manager, the stack is refreshingly boring, and boring is almost certainly the point. There is a category of company where "we use a well-understood language with a small surface area and we do not chase things" is a security posture rather than a lack of ambition.

Their careers pipeline runs on Ashby, which by our numbers puts them with the smaller and newer end of the market rather than the enterprise recruiting-org end, despite their size.

How they hire

Senior-heavy, and unapologetically so. Twenty of the twenty-six open roles are senior, six are mid, and there is not a single junior role open. That is more top-loaded than the market, which runs 60% senior. They are hiring people who arrive knowing how to do the job.

Every role is remote. Not remote-friendly, not hybrid with flexibility, not a remote policy with an office you are quietly expected to visit. Zero onsite roles, zero hybrid roles, twenty-six remote ones.

And every role publishes a salary band. All twenty-six. Across the set, advertised pay runs from about $63k at the bottom of the lowest band to about $369k at the top of the highest, which is a wide spread reflecting a wide set of roles rather than a wide band on any one job.

The market average is 52.5%. Among companies with fifteen or more open roles, full disclosure is rare enough that the list fits on one screen, and 1Password is on it while headquartered in Canada, where no law makes them. Grafana Labs is on the same short list, which is either a coincidence or a hint about what kind of company ends up there.

The benefits also read as centrally set rather than per-req improvisation: paid volunteer days and a free 1Password account appear on all twenty-six postings, with RSUs, retirement matching, parental leave top-up and PTO on most.

The observation

Here is the thing our data shows that their about page will not.

Twenty-three of the twenty-six roles carry a written geographic restriction. Between them, those twenty-three use five distinct strings:

• "United States and Canada", thirteen times

• "US and Canada", five times

• "US or Canada", three times

• "US and Canada only", once

• "United States, United Kingdom, Canada", once

Twenty-two of the twenty-three say the same two countries. One stretches to add the UK. Three roles carry no restriction string at all.

Set that beside Grafana Labs: thirteen restricted roles, eleven distinct phrasings, four of which name an identical set of five countries in four different word orders.

The number of ways a company describes its own remote policy is a readable signal, and it is not about writing quality. Eleven phrasings means each hiring manager writes their own req and the real policy lives somewhere nobody has written down. Five phrasings across twenty-three roles, twenty-two of them saying one thing, means somebody owns the template. Neither is better to work at. They are different machines, and you can see which one you are dealing with before you open a single job description.

Then there is the substance underneath the phrasing, which is the part that decides whether you can actually take the job.

A company that has been distributed since 2005, that has never had a return-to-office fight because it never had an office to return to, that puts every single role out as remote, will hire you in two countries.

Remote-first is a statement about desks. Hire-anywhere is a statement about payroll, tax residency, and legal entities. They are unrelated, and a company can be maximal on the first and conservative on the second for twenty years running.

We do not read this as hypocrisy. Employing someone in a new country means an entity or an employer-of-record contract, local employment law, benefits parity, and a payroll function that understands all of it. A bootstrapped company that spent fourteen years watching its own costs does not casually add jurisdictions. The restriction looks like the same discipline that kept them profitable, applied to headcount.

But if you are reading their careers page from Lisbon or Bangalore or Warsaw, "remote" means something narrower than it sounds, and it is better to know that in the first thirty seconds than in the third interview.

It is also, in fairness, more honest than the alternative. They write the restriction into the posting, consistently, twenty-three times out of twenty-six. Plenty of companies leave "Remote" unqualified and mention the geography once you are attached.

Questions people ask

What is 1Password's tech ecosystem? Primarily Go, with Rust in systems work and TypeScript with React on the front end, running on Kubernetes across GCP and AWS.

Does 1Password hire remote? Every one of its 26 currently tracked roles is remote, with no onsite or hybrid postings. Twenty-three are restricted, effectively all to the United States and Canada.

Does 1Password hire juniors? Not right now. All 26 open roles are mid or senior, with 20 at senior level.

Does 1Password publish salaries? Yes, on every open role, including for positions based outside pay-transparency jurisdictions.

Close

Companies don't pay for spotlights; we choose them from what our users star.

The full stack and the current open roles are on the 1Password listing, and starring it puts anything new on your file without you going back to check. If you would rather ask an agent than click, connect one here.

Four spotlights in, the pattern holds and has got weirder: the interesting fact about a company is almost never the one on its careers page, and twice now it has been hiding in a field nobody proofreads. If you work at 1Password and we have read your job posts wrong, or you work somewhere we should look at next, Discord is the place. We would rather be corrected than flattered.