LastPass
lastpass.comPassword manager from LastPass US LP, owned by Francisco Partners and Elliott, whose source code and encrypted vault backups were stolen in 2022.
- Owner
- Francisco Partners and Elliott
- Based in
- United States
- Founded
- 2008
- Type
- Standalone app
- Free plan
- Yes
- One device type only (computers or mobiles, not both); unlimited items; limited sharing
- Premium, per year
- $36
- renewal price not stated
- Latest audit
- None published
- No named, dated audit found
- On record
- 2022: data stolen
- encrypted vault data and source code
- 2022: encrypted vault data and source code stolen
- No published third-party audit found
- Has a free plan
How LastPass encrypts your vault
From LastPass's security documentation, next to the other 22. LastPass is outlined.
End-to-end encrypted
Encrypted on your device before it's stored (like 20 others)
Cipher: AES-256
Yes 21
Optional 1
No 1
Website addresses encrypted
Encrypted with the rest of the item (like 18 others)
LastPass began encrypting URL fields in vaults in 2024. In the vault backups copied in 2022, website URLs were stored unencrypted, per LastPass's own incident notice.
Encrypted 19
Readable 1
Not documented 3
Item names encrypted
Titles and folder names are encrypted (like 16 others)
Encrypted 17
Readable 1
Not documented 5
Memory-hard password hashing
Repeated hashing, but not memory-hard: cracking hardware has an easier time (like 10 others)
PBKDF2-HMAC-SHA256, 600,000 iterations (current default; username as salt)
Memory-hard 3
Not memory-hard 11
Not documented 7
Doesn't apply 2
Extra secret key
Your master password is the only secret (like 13 others)
Yes 1
No 14
Not documented 4
Doesn't apply 4
What you'll pay
In USD, from LastPass's own pricing page, checked 2026-10-16.
Free plan
Yes
One device type only (computers or mobiles, not both); unlimited items; limited sharing
Premium
$36/yr
billed yearly
After the first year
Not stated
Check the price at checkout
Family plan
Unknown
- Business:
- Unknown
- Free trial:
- 30 days
- Money-back:
- Unknown
- About the renewal:
- No introductory vs regular price distinction stated.
Audits
Independent security reviews, newest first.
No published third-party audit with a named auditor found for LastPass.
- Open-source appsNoNo
- Open-source serverNoNo
- Run it yourselfNoNo
- Bug bountyNot verifiedNot verified
Certifications: SOC 2
Incidents
Breaches, stolen data and serious flaws on record.
2026
Customer names, contact details and support case records were exposed through a breach at Klue, a third-party vendor. LastPass said vaults were not affected.
2022
Attackers copied encrypted customer vault backups; website URLs in them were unencrypted. Offline cracking of weak master passwords was later linked to cryptocurrency thefts, and the UK ICO fined LastPass £1.2M in 2025.
2022
Source code was stolen from LastPass.
- Wikipedia: LastPass 2022 data breach
- Research summary (no single link)
Apps, browsers and passkeys
- WindowsYesYes
- macOSYesYes
- LinuxYesYes
- iPhoneYesYes
- AndroidYesYes
- Web vaultYesYes
- ChromeYesYes
- FirefoxYesYes
- SafariYesYes
- EdgeYesYes
- Saves and fills passkeysYesYes
- Unlock the vault with a passkeyNoNo
- Passkey import and export (CXP)Not verifiedNot verified
Sharing, recovery and extras
- Shared vaultsYesYes
- Share with non-usersNot verifiedNot verified
- Emergency accessYesYes
- 2FA codes built inYesYes
- Breach monitoringYesYes
- Email aliasesNoNo
- File attachments1 GB on Premium1 GB on Premium
- SSH keys and agentNoNo
- Command lineYesYes
- Encrypted exportYesYes
- Works offlineYesYes
- Authenticator-app 2FAYesYes
- Security key for 2FAYesYes
- Password health reportYesYes
- CSV exportYesYes
Compare LastPass with
All sources for LastPass (13)
- Research summary of the vendor's pages (no single link)AI-assisted research, spot-checked, checked 2026-10-16
- Wikipedia: LastPassNews or reference, checked 2026-10-16
- Research summary of the vendor's pages (no single link)AI-assisted research, spot-checked, checked 2026-10-16
- LastPass zero-knowledge securityVendor, checked 2026-10-16
- LastPass blog: encrypting URLsVendor, checked 2026-10-16
- LastPass support: what makes LastPass secureVendor, checked 2026-10-16
- LastPass notice of the 2022 security incidentVendor, checked 2026-10-16
- BleepingComputer: LastPass confirms data breach in Klue supply-chain attack (2026)News or reference, checked 2026-10-16
- Wikipedia: LastPass 2022 data breachNews or reference, checked 2026-10-16
- LastPass personal pricingVendor, checked 2026-10-16
- LastPass featuresVendor, checked 2026-10-16
- LastPass support: about passkeysVendor, checked 2026-10-16
- LastPass support: passkey FAQsVendor, checked 2026-10-16