If you use 1Password, you should prepare to find another product.
On August 31, 2026, DHH, a man known for promoting Nazism and serving on the board of a Nazi merch platform, published a self-incriminating announcement.
His Omacom Foundation blog post (PDF) declares “there’s no quid pro quo here” for a $100,000 a year fee that 1Password will pay for access. He then describes the quid precisely: 1Password “has been part of Omarchy from day one,” the first thing installed on every machine, wired into the product by default.
Nobody uses the phrase “no quid pro quo” casually.
It is the operative test in American sponsorship tax law for whether a payment stays clean. Someone wrote that blog post knowing the standard and published the disqualifying facts beside it anyway. Perhaps this will help jog their sense of morals.
The Record
| Date | Event | Classification | Source |
|---|---|---|---|
| 27 Jul 2021 | Tobi Lütke and Harley Finkelstein personally invest in 1Password’s $100 million Accel round; Shopify executives invest alongside them; Shopify is a flagship 1Password customer | Shopify’s founders now own a piece of 1Password; everyone in this story has money in everyone else | TechCrunch, 1Password |
| Jun 2025 | Omarchy ships with 1Password as the promoted commercial password manager: dedicated keybinding, CLI integration for scripts, manual copy stating “1password is a great solution”; the arrangement carried over from Omakub before it | 1Password already had the prime spot a full year before any disclosed money moved | Omarchy manual |
| Jul 2026 | DHH, sitting Shopify director, publishes the remigration essay; the full conduct record of the Shopify cluster is public and documented | Everything there was to know about DHH was public before anyone wrote a check | flyingpenguin, flyingpenguin |
| 21 Aug 2026 | DHH announces the foundation “launches” with $8 million while writing, in the same post, “I’m incorporating the Omacom Foundation.” Present tense. No jurisdiction, no legal form, no board, no filings disclosed. Lütke among the $1 million founding patrons | Millions pledged to a foundation that does not exist | Omarchy |
| 24-31 Aug 2026 | Drew Houston and Peter Steinberger join; then Brian Armstrong of Coinbase and Yunjie Dai of TapTap appear on the patrons page; founding total reaches $12 million across twelve donors | Nearly all the money comes from twelve rich men, which matters for tax status later | Omarchy |
| 31 Aug 2026 | 1Password and 37signals each commit $100,000 a year for three years; “no quid pro quo” published beside the description of first-install placement; DHH writes the mission “first has to be an amazing system for me, personally”; solicitation continues over a personal email address | One post denies the deal, describes the deal, and admits who the whole thing is really for | Omarchy |
The Quid
Recognition is a logo on the website. That is not what 1Password holds, not by a mile. The post itself describes the position: a default slot in the install path of an operating system, a reserved system keybinding, command line integration promoted in the official manual, and manual copy that calls the product “a great solution.”
I mean how much more quid could it get? Under Treasury Regulation 1.513-4, the regulation that governs the “no quid pro quo” claim, a sponsor acknowledgment stays clean only if it avoids qualitative or comparative language and avoids endorsement.
Does “a great solution” sound like endorsement to you? It is qualitative language violating the regulation, published under the foundation’s own brand, attached to a vendor charged $300,000 over three years. That is what regulators call advertising. Advertising is a substantial return benefit.
A substantial return benefit is a quid pro quo.
The placement predates the squeeze for money by more than a year. That means it’s not an entry charge for a sponsor. It is a vendor paying to keep the position it was already in. The grocery trade calls that an arrangement known as “pay to stay”. The payment is a maintenance fee: “sure would be sad if something were to happen to someone around here, I mean if they don’t pay some dues, amiright Vinnie?”
The Cluster F*ck
The corporate patron seems to be mixed, if not corrupted with, the founding patron. Lütke and Finkelstein sit on 1Password’s cap table personally, alongside a group of Shopify executives, since July 2021. Shopify is one of 1Password’s marquee customers. If I’m reading the money flow correctly, Lütke pledged $1 million on August 21 and ten days later his portfolio company followed as one of the first two corporate commitments.
The interval between the investor’s founding contribution and the portfolio company’s corporate commitment was ten days.
“Patron” implies independent support. Every relationship in this chain is NOT independent. It looks to be prior, financial, and easily documented.
There’s No Box to Check
DHH has made this mistake before, and his precedent is a big problem. The Rails Foundation, his 2022 vehicle, is a US 501(c)(6) business league, EIN 88-2382127, filings on public record. A business league was arguable for Rails because a framework used by GitHub, Shopify, and Cookpad could be posed as a line of business. The Supreme Court actually closed that route for single-brand entities in National Muffler Dealers Assn. v. United States, 440 U.S. 472 (1979): a business league must improve an entire line of business, not promote one brand. Yet Omacom’s stated purpose is to hold the trademarks and promote the work of exactly one product. That’s textbook violation material. And the founder specifies the brand is his and personal. The system installs “by DHH.”
It’s an exact repeat of National Muffler.
The charitable route is a disaster. Let me count the ways.
Better Business Bureau v. United States, 326 U.S. 279 (1945), holds that a single substantial nonexempt purpose destroys exemption, and the nonexempt purpose here was published by the founder in the sponsorship announcement itself: the system “first has to be an amazing system for me, personally.”
An examiner does not need to infer private benefit. It is published by DHH, in the record in the first person, as the whole point.
Second, the IRS has already ruled on the category. Its May 2014 determination letter denying the Yorba Foundation, an open source Linux desktop project, held that publishing software for anyone to use, including commercially, is a substantial nonexempt purpose. If GNOME photo software failed that test after a four and a half year review, a distro whose founder announces it exists first for himself does not present anything new.
Third, do the math: under the public support test, each donor’s countable contribution is capped at two percent of total support. Fourteen donors supplying $12.6 million yields roughly 28 percent public support against a one-third threshold. Omacom defaults to private foundation status, and the “tier open to everyone, coming soon” on the foundation page reads as an attempt to artificially manufacture a claim of public support after the concentration is already being promoted as “elite” capital.
Private foundation status is where the 37signals payment fails. Under section 4946, DHH is a disqualified person as substantial contributor and manager, Jason Fried is a disqualified person as substantial contributor, and 37signals, a company the two of them control, is therefore itself a disqualified person. How is this not obvious to them?
Section 4941 prohibits self-dealing between a private foundation and a disqualified person per se: no fair value defense, no good faith defense, excise tax plus mandatory unwinding.
While a pure gift from a disqualified person could be permitted, the announcement itself describes what 37signals receives: the foundation exists to promote and fund the system that, in DHH’s words, the company’s “whole technical team” already runs on.
The regulations would make an exception for benefits that are incidental or tenuous, like public recognition of a donor. But again, DHH is boasting about operating infrastructure for the donor’s business, which is precisely the benefit the exception does not cover.
Put it all together and it’s quite a problem.
- A business league is barred by National Muffler.
- A charity is barred by Better Business Bureau, by Yorba, and by the founder’s own published sentence.
- A private foundation is the default classification and immediately trips self-dealing on one of its first two corporate transactions.
There is no box in the Internal Revenue Code for a tax-exempt entity whose purpose is holding and promoting the trademark of one man’s personally branded product.
So I’ll tell you what DHH means when he says “nonprofit foundation”: a marketing claim about an unincorporated pool of money, solicited over a personal email address, held by the only person named anywhere in the paperwork, because there is no paperwork.
Corrupting the Records
Criminal tax liability would be making a willfully false statement on a document signed under penalty of perjury. My guess is that Omacom has signed nothing and there is no incorporation, no exemption application, no return, nothing that yet carries a penalty of perjury.
An announcement on a website isn’t enough to hold him accountable with… yet.
It is a willfulness exhibit for filings that have not happened yet. Exemption applications and annual returns become public records by statute once they exist. Whoever eventually signs Omacom’s application or first return, and characterizes these payments as sponsorship without return benefit, signs against an August 31 document proving the drafter knew the correct legal standard and knew the facts that defeat it, because the drafter published both together.
Interestingly, willfulness is ordinarily the element hardest to document: what the signer knew, and when. Yet with the DHH post we can see clearly the knowledge and date it before the entity existed to sign anything.
1Password is Untrustworthy
Now the part that is not a tax question. 1Password is a credential security company. Its entire product is the claim that it can be trusted with the keys. That company just committed $300,000 into an unincorporated fund with no board, no charter, no disclosed jurisdiction, and no filings, run over one man’s personal email, in exchange for holding default placement inside an operating system that ships autonomous AI agents as a core feature.
Yeah, that’s not trustworthy.
I get the technical part. Agents need a secrets layer. 1Password sells the secrets layer.
But this is a product placement contract described in the vocabulary of patronage, and 1Password’s own accountants will book it as marketing because, absent any exempt entity, there is nothing else to book it as.
More to the point, 1Password looked at all the evidence, all the risk, and signed up with a Nazi-promotion platform. Framework’s sponsorship of this ecosystem rightly produced a sustained backlash through late 2025, forced the company to publish a running list of everything it funds, and put every future sponsor on notice of exactly what association with this project costs. Sidekiq pulled its Ruby Central funding in September 2025 over the platforming of DHH. By the time 1Password signed, the remigration essay was seven weeks old. The swastika sale on the platform where DHH holds a board seat was eighteen months old. The citizenship review record for the Shopify founder was public. Toronto-headquartered 1Password read all of the Nazism and committed the money anyway. That is not obliviousness. A company that reads that record and still wires the money is willfully buying into the Nazi association.
Exemption applications and annual returns become public records the moment they exist. When Omacom finally files, examiners get to read the paperwork next to an August 31 announcement that invoked the legal standard and then listed the facts that fail it.
DHH wrote the government’s case against himself. All that’s missing is his signature.
But more importantly, perhaps, DHH just published the proof that 1Password users can no longer trust it. Migration to another product should start now.