Unclaimed: Are you working at LastPass?
LastPass Reviews: 4.5/5 — Highly Rated
LastPass is a popular and easy-to-use password manager with premium features and great security tools and multiple account recovery options. Adding an advanced layer of security, the platform offers multi-factor authentication and time-based one-time password protection, dark web monitoring, a one-to-one authenticator, and secure notes. LastPass also offers effective pricing, with a freemium plan that covers extensive features and tiered plans with more robust security features and tools.
| Company | LogMeIn, Inc. |
|---|---|
| Year founded | 2003 |
| Company size | 1001-5000 employees |
| Headquarters | Boston, MA, United States |
| Social Media |
| Capabilities |
API
|
|---|---|
| Segment |
Small Business
Mid Market
Enterprise
|
| Deployment | Cloud / SaaS / Web-Based, Desktop Chromebook, Desktop Mac, Desktop Windows, Mobile Android, Mobile iPad, Mobile iPhone |
| Support | 24/7 (Live rep), Chat, Email/Help Desk, FAQs/Forum, Knowledge Base, Phone Support |
| Training | Documentation |
| Languages | English |
Any honest review of LastPass has to start with 2022, when attackers exfiltrated encrypted vault backups for the company’s entire customer base. The vaults were encrypted, and well-protected ones remain so. But that data is permanently in criminal hands, and researchers have traced cryptocurrency thefts to it as recently as late 2025. For a product whose only job is safeguarding secrets, that history is the review.
- What it is: A password manager with autofill, sharing, dark web monitoring, and business administration tooling.
- Best for: Existing users with strong master passwords who value the mature admin console — and who have already rotated anything sensitive.
- Pricing: Free (one device type). Premium ~$3.37/mo, Families ~$4.53, Teams ~$5.13/user, Business ~$7.54, Business Max ~$8.84. Billed annually.
- The honest catch: The free plan works on computers or mobile, never both, so it cannot sync your phone and laptop.
What Is LastPass?
LastPass is one of the longest-established password managers: a browser extension and app that stores credentials in an encrypted vault, autofills them, generates strong replacements, and shares them with family or colleagues. The business tiers add an admin console, security policies, directory integration, and single sign-on.
Functionally it is a capable, mature product. The admin console in particular is well developed, with over 100 configurable security policies on the Business tier, and the family plan covering six people is priced competitively. Dark web monitoring and a security dashboard are included even on the free tier.
The company operates on a zero-knowledge model, meaning your master password never reaches LastPass’s servers and the company cannot decrypt your vault. That architecture is what limited the 2022 breach from being an outright catastrophe — and understanding exactly how far it limited it is the point of the next section.
What Happened in 2022, and Why It Still Matters
The breach ran in two stages between August and October 2022. Attackers first compromised a developer’s laptop, taking source code and technical secrets. They then used what they had learned to target a DevOps engineer’s home computer, which gave them access to AWS S3 buckets holding customer vault backups. They obtained encrypted vault backups for the entire customer base.
Three things make this worse than a typical breach:
- Some data was not encrypted. Vault contents were encrypted, but metadata including stored website URLs was not, giving attackers a map of which accounts each vault held.
- Disclosure was slow. LastPass did not publicly connect the two incidents until 27 February 2023, months after the intrusion, and the communication drew heavy criticism from security researchers.
- Stolen encrypted data does not expire. Attackers can attempt to crack those vaults indefinitely — “harvest now, crack later.” Blockchain analytics firm TRM Labs has traced a years-long series of cryptocurrency thefts to these vaults, with incidents continuing into late 2025, typically where master passwords were weak or accounts predated later security hardening.
The consequences have been formal as well as technical. LastPass settled a class action for $24.5 million in 2025, and the UK’s Information Commissioner’s Office issued a monetary penalty against LastPass UK Ltd in November 2025.
What LastPass did in response: it raised the PBKDF2 iteration count to 600,000 rounds for all accounts, a substantial increase that makes brute-forcing a stolen vault far more expensive. Older accounts had been running on dramatically lower counts — some as low as 5,000 — which is precisely why certain vaults fell and others did not.
If you held a LastPass vault before August 2022, the actionable advice is unambiguous: assume that vault is in criminal hands and rotate every credential it contained, prioritising cryptocurrency seed phrases, financial accounts, and email. Changing your master password now does not help, because the copy they hold is encrypted with the old one.
LastPass Pricing
LastPass injects prices via JavaScript and blocks automated rendering, so the figures below are third-party reported for July 2026, while the plan structure, user counts, and trial terms were verified from LastPass’s own pricing page.
| Plan | Reported price | Users | Notes |
|---|---|---|---|
| Free | $0 | 1 | One device type only — computers or mobile, not both |
| Premium | ~$3.37/mo | 1 | All devices, 30-day trial, 30% off for new users |
| Families | ~$4.53/mo | 6 | Shared folders and family dashboard |
| Teams | ~$5.13/user/mo | up to 50 | Admin console, 25 security policies, 14-day trial |
| Business | ~$7.54/user/mo | Unlimited | 100+ policies, Families for employees |
| Business Max | ~$8.84/user/mo | Unlimited | Unlimited SSO apps, advanced MFA |
- The free plan’s restriction is severe and easy to miss. You choose either computers or mobile devices. Since the entire value of a password manager is having credentials wherever you are, this is a plan that cannot do the job. Bitwarden’s free tier, by contrast, syncs across all devices.
- Families is the best value in the lineup. Six people for ~$4.53 a month works out under $1 each.
- All paid plans bill annually. There is no monthly option, so the trial is your only low-commitment evaluation.
- Business Max is where SSO lives. Unlimited SSO applications and advanced MFA require the top tier.
Who Should Use LastPass
- Existing business customers with a working deployment. Migrating an organization’s password manager is genuinely disruptive, and the admin console is good. If your accounts postdate the breach and enforce strong master passwords, staying is defensible.
- Families wanting cheap coverage for six. The per-person economics are strong.
- Teams needing a mature admin console. Policy depth on Business is a real strength.
It fits poorly for anyone starting fresh, where equally priced competitors carry no comparable history; for cryptocurrency holders, given the documented and continuing pattern of thefts traced to these vaults; and for anyone wanting a usable free tier, which the one-device-type limit precludes.
Honest Pros and Cons
Strengths
- A mature, capable product. Autofill, sharing, and generation all work well after many years of refinement.
- Excellent admin console. 100-plus security policies on Business, which smaller competitors do not match.
- Strong family value. Six users for roughly $4.53 a month.
- 600,000 PBKDF2 iterations. A genuine and significant hardening after the breach.
- Dark web monitoring included, even on the free tier.
- Zero-knowledge architecture. LastPass cannot read your vault, which is what prevented the breach being total.
Limitations
- The 2022 breach is unresolved by nature. Stolen encrypted vaults cannot be recalled, and thefts traced to them continued into late 2025.
- Unencrypted metadata. Stored URLs were not encrypted, revealing which accounts each vault held.
- Slow, criticized disclosure. Months passed before the incidents were publicly connected.
- Regulatory and legal consequences. A $24.5M class action settlement and a UK ICO penalty in November 2025.
- The free plan cannot sync devices. Which defeats the purpose for most users.
- Annual billing only on every paid tier.
LastPass Alternatives and How It Compares
- 1Password is the most common destination for departing LastPass users, with a strong security record and comparable pricing.
- Keeper is the enterprise-oriented alternative with a robust compliance and security posture.
- Dashlane competes closely on features with a clean interface and bundled VPN on some plans.
- Zoho Vault is markedly cheaper and compelling for organizations already running Zoho.
- Bitwarden is the open-source option, auditable and with a genuinely usable free tier that syncs across all devices — the direct answer to LastPass’s free plan restriction.
For a broader survey, browse our password manager directory.
The Verdict
Judged purely as software, LastPass is good. The autofill is reliable, the admin console is among the best in the category, the family plan is excellent value, and raising PBKDF2 iterations to 600,000 was a serious and correct response. Nothing here is incompetent.
But a password manager is not judged purely as software. It is judged on whether you should hand it every secret you own, and LastPass is the only major option in this category asking that question against a breach in which encrypted vaults for its entire customer base were taken. The severity is not hypothetical: researchers have traced cryptocurrency thefts to those vaults into late 2025, the company settled a class action for $24.5 million, and a UK regulator issued a penalty in November 2025. Stolen encrypted data has no expiry date, and no amount of subsequent hardening retrieves it.
So the recommendation splits. If you are choosing a password manager today, choose a different one. 1Password, Keeper, Dashlane, and Bitwarden cost about the same, do the same job, and carry no equivalent history — there is no benefit LastPass offers that offsets the risk of starting here. If you are an existing customer, particularly a business with a working deployment, staying is defensible provided your account postdates the breach or your master password is long and unique. Migration is disruptive and the product is competent.
If you held a vault before August 2022, act regardless of what you decide about the software. Treat every credential in that vault as compromised and rotate it, starting with crypto seed phrases, financial logins, and email. Many affected users never received a direct warning, and the thefts have continued for years precisely because people assumed encryption meant safety. It meant time, and for weak master passwords that time has run out.
FAQ
Is LastPass safe to use in 2026?
The software is technically sound and now uses 600,000 PBKDF2 iterations, a substantial improvement. But encrypted vault backups for the entire customer base were stolen in 2022 and cannot be recovered, and cryptocurrency thefts traced to those vaults continued into late 2025. Accounts created after the breach with strong master passwords are in a materially better position than pre-2022 accounts, but the history is a legitimate reason to prefer a competitor when starting fresh.
What exactly was stolen in the LastPass breach?
Attackers accessed AWS S3 buckets containing encrypted customer vault backups, obtaining them for the entire customer base. Vault contents were encrypted, but metadata including stored website URLs was not, revealing which accounts each vault contained. Source code and technical secrets were also taken in the first stage of the attack. LastPass did not publicly connect the two incidents until February 2023.
I used LastPass before 2022 — what should I do?
Assume that vault is in criminal hands and rotate every credential it held, prioritising cryptocurrency seed phrases, financial accounts, and email. Changing your master password now does not protect the stolen copy, which is encrypted with the old one. This applies whether or not you still use LastPass, and whether or not you were ever notified — many affected users received no direct warning.
Is the LastPass free plan any good?
Not really, because of one restriction: it works on a single device type. You choose either computers or mobile devices, so your phone and laptop cannot both hold your passwords. Since having credentials available wherever you are is the entire point, this makes the free tier impractical for most people. Bitwarden’s free plan syncs across all devices and is the obvious comparison.
What is LastPass best for?
Existing business customers with a mature deployment who value its admin console and its 100-plus security policies, and families wanting six-person coverage cheaply. For anyone selecting a password manager for the first time, competitors at similar prices without a comparable breach history are the more sensible choice.
Compare LastPass with other popular tools in the same category.
Works on all my devices and syncs between them all pretty seamlessly. I use it on 2 iphones, 2 windows computers and an iPad..
Tries to save passwords over and over again resulting in duplicates and old duplicate entries
Keeping passwords updated across multiple work-stations and devices. Only have to input password data once and it populates across whole office
We've recently switched to using lastpass to store our department passwords for shared logins. After the switch there has been a lot less getting locked out of accounts due to incorrect passwords too many times.
The one downside of this service so far is that it does not update the password automatically, we we have to refresh/log out/back in to see changes others have made to passwords.
We are taking less time to get into our clients by having our passwords all loaded in one area that is accessible to only our dept and only our dept can see and change the information.
I really like the fact that I can share access to my accounts to others without having to share my personal password and I can also control when I want them to stop having access to those accounts. When I started working with my boss, this was vital for us. Now we've worked together for a long time and he trusts me enough to confide his passwords to me, but at first this was what helped us build that trust.
The mobile app is not that great, it's gotten better and it's great now that it's free. But it keeps popping up wherever I want to type something, even places that have nothing to do with signing up or logging in somewhere and I wasn't able to log into any google account through it while on my phone. It works great on my laptop though.
Like I said previously, it helps you give temporary or long-term access to people you don't necessarily trust enough to give permanent access or the passwords to your personal or business accounts.
You have great control over your passwords. Easily update and organize into your passwords into categories makes it easy to share with family and coworkers as necessary.
You have to install last pass across all your devices in order to get the passwords to sync. Not too much of a deal breaker but keep it in mind if you use LastPass's auto-generate password feature.
As a freelancer I have my personal set of passwords and well as passwords I share with clients. LastPass helps easily collaborate and share password access.
Forgetting Passwords is among the most irritating habits I have within myself and I always wanted a definite solution for this issue in my life. Resetting the password is not an easy job for me, because I usually tend to forget my secret questions and linked email addresses. The LastPass is a savior for me. I just don’t remember when was the last time I had to look for my passwords. Moreover the Auto Login facility in Last Pass is mind-blowing; I save a lot of time with not jugging around the login pages of my various accounts .
There are few concerns which last pass should take care of , Firstly my bank website do not allow last pass to auto fill the details and had locked my account several times because of the failed attempts to login. Secondly, I tried to disable auto login for particular websites, but that feature is not working for now.
Apart from those little flaws, there are more of advantages for using LastPass. Its simplicity is something which makes it unbeatable among its competitors. Moreover it is now available for my mobile devices as well..
LastPass allows me to store all my username and passwords in a secure place. It automatically gets sync with all OS such as Mac, Windows, or Linux as well as on Android and iOS. It has got an automatic password generator which offers strong passwords in replacement for the weak ones. I can replace them with something which has a combination of uppercase letters, lowercase letters, digits, and special characters. It also provides an emergency access feature to choose one or more person who can inherit your stored username and passwords in case of your demise.
If you are using a free account then you will not be able to sync all your devices where ever you have installed Lastpass. Also, if I try to dismiss a reminder from mobile app, it again pops back when I launch it after some time. It seems I can’t turn it off completely.
I needed protection from keyloggers as I work from various devices at different locations, where Lastpass came out to be handy. It provides protection from keyloggers by allowing entries to be captured from a virtual on-screen keyboard which can accept my inputs through mouse clicks itself. It also sends an email notification when I change my master password, so none can steal my account information. It has an automatic password changer which can change my passwords after certain fixed days.
When every website has different password requirements, it's obviously a pain to remember which password you've used where. Not to mention that it is bad to reuse passwords. Last pass very helpfully keeps a bank of my passwords, which in most cases are inserted with just one click using the chrome plugin.
Sometimes stumbles on certain websites, given the layout of their username/password prompts. I am currently limited to just one device, but understand that cross-platform support is a key draw for their paid plan, so I guess I'm getting what I pay for. Interface can feel a little clunky, but not the worst.
It saves me time and energy. Were I to pay for the premium version, it would increase business security, enabling me to generate unique/changing passwords for all sites.
It remembers everything but very discreet. Difficult to view by just glance.
Ask about sign on everytime. Consistent remknders and pop ups
Security.
I love that I only have to remember one password, as long as I remember to enter my passwords into the system. It's also great for business to be able to share passwords among the organization.
The interface feels quite glitchy and isn't always the most user friendly.
We manage multiple accounts and are able to use Lastpass to keep login information for all of them easily accessible.
LastPass is relatively inexpensive even if using the premium features of sharing and having data available via mobile devices. The Security Challenge tool is a nice way of reminding you to change old PWs and look for duplicates. The password generator includes options to include/exclude characters and the copy/paste username/password functions. It took a while to convert my passwords into LastPass as I chose to do it in one sitting (deleting saved PWs from Chrome) but you could do it gradually through LastPass's offer to remember to save password function.
There are several instances where updating a password does not "save" in the app. There are on-screen indicators that prompt you to make changes or confirm changes but doesn't seem to "take" 100% of the time. The workaround is to go into the vault and grab the password it should be and manually change the PW from the website.
Password and PII security. In addition to passwords, I've included banking information and form fill information. I'm also using secure notes to keep other records.
Simplified Sign On to multiple apps and programs
Setup was a bit confusing and how to maintain thereafter.
Multiple applications used here at our company. SSO/Simplified sign on is of value.
Saves a lot of effort with websites requiring different password styles (e.g. 1 num 1 lower case etc). Furthermore it attempts to increase the overall security of your accounts.
Encourages each password to be different which makes it hard to ever stop using it. Also, should this be cracked all passwords would be lost
Saves a lot of time when logging in (automatic logging in)
While I don't use LastPass for my personal password management, I have an enterprise LastPass account for work and use it to share system passwords between team members. i like the flexibility that LastPass offers in their product, ranging from a good, free password manager for those just getting started or who aren't looking for the top of the line or to pay a premium, but they also offer all the way up to a robust, enterprise-level product. LastPass is relatively easy to use and is a great way to get started in password management.
While I don't love LastPass' interface and design as much as other password managers, it works and serves its purpose. While they have a lot of settings and options which can be nice for power users, I think it can be a little more overwhelming and less user-friendly for many of the friends and family members I would recommend a product like this to. And while their web-based interface is convenient, I don't know if I trust it as much as others, but that may just be me.
LastPass has simplified sharing system passwords amongst my team at work. We are all able to access the sites and systems we need to, but the passwords are managed by those who own them. It greatly simplifies this process and keeps our accounts safe. It has solved the unsafe practice we used before of sending login credentials via email, IM, etc.
LastPass Enterprise is very reliable. I've never seen it have an outage of the 3 years I've been using it. Its easy to create new entries and search for existing ones. When it works, the automatic login upon one-click in LastPass is awesome. Being able to login from anywhere and access passwords.
The interface is going through a tablet crisis. With the introduction of LastPass 4, the GUI was made specifically for touch devices, which as a sysadmin who doesn't operate on any touch devices, it makes the interface too bloated. Luckily you can switch back to the LastPass 3 interface. Some of the features are too hidden, such as editing and creating enterprise groups. There doesn't seem to be a checkbox for removing the "Would you like to save this password" box when logging into somewhere it doesn't recognize. This can be annoying.
Shared passwords amongst an engineering team. Not having to maintain some sort of encrypted password file locally or on shared storage.
The fact that you can sync all your passwords across all of the different browsers and devices is a plus for me. I also like the feature enabling you to share passwords to other lastpass users.
Unfortunately the multi-device feature is for premium users, so you have to pay for it..
I work as QA in software development and we need to test the same things on different browsers. Lastpass makes it easy to store, use and update passwords across all browsers which is a significant time saver for me.
I have the premium edition which allows mobile access as well. One of the best features is the synchronising across devices, the sharing of passwords to other LivePass users. But I think most of all is the fine-grained security you can get on how you access your passwords. Locking down access by country, 2-factor-auth etc. One great feature is that if a companies systems are hacked and it was publicised you are alerted to change your password for that particular site. Also they have other tools to check your password strengths and if your using the same password on multiple sites.
They have recently released a new UI for LastPass. It is a great improvement on the previous one but still find myself doing too many steps to actually getting access to my passwords. Filtering per site is good but not when you have 100 usernames and passwords for the same site (which I get with Salesforce.com as I lots of customers using the same domain). I would love them to implement a "recently used" tab across the UI so that (eg) when you change your password you don't get all 100 passwords appearing and then having to scroll all the way through! I just logged in and changed my password! Put it at the top of the list! Passwords are stored "in the cloud" but encrypted using your master password. So theoretically quite secure but some could argue this is less secure than having the passwords stored locally.
Having stronger passwords and allowing those passwords to be shared across the organisation in a secure way if needed.
Compared to a few others I used, LastPass was quick and simple to install. I really liked the ability to provide emergency access to parties I designate
As with most password tools, I need to upgrade to premium in order to sync ad use across my multiple devices
I need to generate strong passwords for many of the tools and sites used at work and home. Rather than fumbling around trying to create a strong password, LastPass handles that for me. And I do not have to remember the strong passwords because they are stored for me.
I love that LastPass remembers all of my passwords and can even suggest and store complicated passwords for me.
Sometimes it doesn't start when I start my computer. Sometimes it doesn't auto-fill. Then there is the annoying "show vault" checkbox that somehow gets checked when I don't check it. That annoys me because I never want to see my vault.
It helps me "remember" all of my passwords! We are supposed to have unique passwords for each personal and work related website. Who can keep up?!
I love how convenient lastpass is. I save so much time every day using this tool.
I wish there was better app integration for mobile. I would love to open apps and be able to login using lastpass without having to shuffle between the two apps.
We work with a lot of clients for whom we need to login to their accounts and handle a lot of sensitive information. Lastpass allows our clients to confidently give us the access that we need while giving them the confidence that their information is protected.
Simple setup, and fills a genuine need for secure password management. The enterprise admin features are useful, allowing for granular permissions and for sharing between users
UI is ugly and not intuitive to use, occasional downtime, general weirdness with browser extensions (e.g. sometimes you have to log in twice, sometimes auto-logoff doesn't work)
Secure password management and sharing
I liked the easy way to add a retrieve passwords, as you entered a webpage, and create complex passwords for anything without having to remember them. The only thing you need to remember is your LastPass Password. It is also great to be able to synchronise your passwords on to an iPhone, making it a great way to manage your passwords. The user interface on the iphone is easy to use and automatically adds the website icons to the password making it easy to find your passwords.
The one thing i did not like about lastpass is the pricing structure, although it isn't expensive, my preference is to pay a one off price rather than a yearly fee.
To conveniantly store and manage work and personal passwords in a single place.
i like how intuitive and easy it is to use the software, and that it has a chrome plugin that responds quickly and well.
i wish there was a free version of the accompanying app that i could use on my mobile platform as well. i wish there was a reminder to update passwords on a scheduled basis.
used for personal and professional passwords and username storage.
It is very simple to use. Login once. Save your password. Done. There is a feature to save all entered data in form which is incredibly helpful if there is a form you fill regularly but a lot of the entries stay the same.
The user interface of the Last Pass Vault is definitely tired. If you have multiple logins to a single site it could get messy with auto logging in. It is also unnecessarily difficult to get a last pass box to go away when you do not want to use it.
It's a simple product that gives me back some time and keeps me a bit more organized. Knowing all my passwords are stored securely instead of written in a notebook is definitely a plus.
I like that I never have to remember any of my passwords, because LastPass keeps them all easy to access and auto-fills my login info for every site.
I hate that my passwords for everything are all in one place. A scary thought to say the least.
I probably have 100 different usernames and passwords that I would never remember without lastpass... saves a lot of time and brain space.
I like that all the passwords are stored on a central server and can be accessed from multiple devices. Also like the new releases functionality to search directly from the toolbar without going to the vault.
Every once and a while, it thinks a form is a login form and puts login icons on the screen when the form is not actually a login form. Also would like to be able to edit directly from the toolbar search results
Security, Time Savings
Browser compatible, easy to use with shortcuts and secure
Very difficult to use in a enterprise schema. Impossible to customize fields label and targets.
Not provided
LastPass is a very well thoroughly designed platform for password management. They securely encrypt all of your password data, even on their free version. I know that they also have a mobile version that works really nicely too. Their browser plug-ins make it invaluable. And with the ability to use hot keys it makes the entire experience that much better.
I do wish that there was better support for different operating systems. When using the program it would be great to have a better syncing method. However, that being said it's pretty amazing considering the level of encryption and security protocols that LastPass has built.
Not provided
Ideal way to remember usernames and passwords. One Click-login system making access to sites quicker. Supports syncronisation across multiple browsers such as Firefox and Safari. If you use an alternate solution you can import/export data.
Its difficult to note any negatives, however many security programmes which companies utilise may offer a similar service.
Not provided
It has been very helpful in organizing my information, passwords, and all that. It's my go to second brain for important things that I would normally have to write down. The autofill has been so helpful, and I do use it most days.
I get notifications frequently about LastPass being hacked, and that worries me. I know it is likely just part of the business, but it makes me worried about putting sensitive information in sometimes
Helping me keep track of many accounts and share any information easily with others
I like that it suggest strong passwords for our accounts and shows their overall security level and strength. It is also easy to delegate certain shared passwords and notes with certain team members.
I don't like that they've had several breaches in the last decade.
Keeping all of my passwords and notes secure in one place and allowing me to share this information with certain team members.
