Unclaimed: Are you working at LastPass?
LastPass Reviews: 4.5/5 — Highly Rated
LastPass is a popular and easy-to-use password manager with premium features and great security tools and multiple account recovery options. Adding an advanced layer of security, the platform offers multi-factor authentication and time-based one-time password protection, dark web monitoring, a one-to-one authenticator, and secure notes. LastPass also offers effective pricing, with a freemium plan that covers extensive features and tiered plans with more robust security features and tools.
| Company | LogMeIn, Inc. |
|---|---|
| Year founded | 2003 |
| Company size | 1001-5000 employees |
| Headquarters | Boston, MA, United States |
| Social Media |
| Capabilities |
API
|
|---|---|
| Segment |
Small Business
Mid Market
Enterprise
|
| Deployment | Cloud / SaaS / Web-Based, Desktop Chromebook, Desktop Mac, Desktop Windows, Mobile Android, Mobile iPad, Mobile iPhone |
| Support | 24/7 (Live rep), Chat, Email/Help Desk, FAQs/Forum, Knowledge Base, Phone Support |
| Training | Documentation |
| Languages | English |
Any honest review of LastPass has to start with 2022, when attackers exfiltrated encrypted vault backups for the company’s entire customer base. The vaults were encrypted, and well-protected ones remain so. But that data is permanently in criminal hands, and researchers have traced cryptocurrency thefts to it as recently as late 2025. For a product whose only job is safeguarding secrets, that history is the review.
- What it is: A password manager with autofill, sharing, dark web monitoring, and business administration tooling.
- Best for: Existing users with strong master passwords who value the mature admin console — and who have already rotated anything sensitive.
- Pricing: Free (one device type). Premium ~$3.37/mo, Families ~$4.53, Teams ~$5.13/user, Business ~$7.54, Business Max ~$8.84. Billed annually.
- The honest catch: The free plan works on computers or mobile, never both, so it cannot sync your phone and laptop.
What Is LastPass?
LastPass is one of the longest-established password managers: a browser extension and app that stores credentials in an encrypted vault, autofills them, generates strong replacements, and shares them with family or colleagues. The business tiers add an admin console, security policies, directory integration, and single sign-on.
Functionally it is a capable, mature product. The admin console in particular is well developed, with over 100 configurable security policies on the Business tier, and the family plan covering six people is priced competitively. Dark web monitoring and a security dashboard are included even on the free tier.
The company operates on a zero-knowledge model, meaning your master password never reaches LastPass’s servers and the company cannot decrypt your vault. That architecture is what limited the 2022 breach from being an outright catastrophe — and understanding exactly how far it limited it is the point of the next section.
What Happened in 2022, and Why It Still Matters
The breach ran in two stages between August and October 2022. Attackers first compromised a developer’s laptop, taking source code and technical secrets. They then used what they had learned to target a DevOps engineer’s home computer, which gave them access to AWS S3 buckets holding customer vault backups. They obtained encrypted vault backups for the entire customer base.
Three things make this worse than a typical breach:
- Some data was not encrypted. Vault contents were encrypted, but metadata including stored website URLs was not, giving attackers a map of which accounts each vault held.
- Disclosure was slow. LastPass did not publicly connect the two incidents until 27 February 2023, months after the intrusion, and the communication drew heavy criticism from security researchers.
- Stolen encrypted data does not expire. Attackers can attempt to crack those vaults indefinitely — “harvest now, crack later.” Blockchain analytics firm TRM Labs has traced a years-long series of cryptocurrency thefts to these vaults, with incidents continuing into late 2025, typically where master passwords were weak or accounts predated later security hardening.
The consequences have been formal as well as technical. LastPass settled a class action for $24.5 million in 2025, and the UK’s Information Commissioner’s Office issued a monetary penalty against LastPass UK Ltd in November 2025.
What LastPass did in response: it raised the PBKDF2 iteration count to 600,000 rounds for all accounts, a substantial increase that makes brute-forcing a stolen vault far more expensive. Older accounts had been running on dramatically lower counts — some as low as 5,000 — which is precisely why certain vaults fell and others did not.
If you held a LastPass vault before August 2022, the actionable advice is unambiguous: assume that vault is in criminal hands and rotate every credential it contained, prioritising cryptocurrency seed phrases, financial accounts, and email. Changing your master password now does not help, because the copy they hold is encrypted with the old one.
LastPass Pricing
LastPass injects prices via JavaScript and blocks automated rendering, so the figures below are third-party reported for July 2026, while the plan structure, user counts, and trial terms were verified from LastPass’s own pricing page.
| Plan | Reported price | Users | Notes |
|---|---|---|---|
| Free | $0 | 1 | One device type only — computers or mobile, not both |
| Premium | ~$3.37/mo | 1 | All devices, 30-day trial, 30% off for new users |
| Families | ~$4.53/mo | 6 | Shared folders and family dashboard |
| Teams | ~$5.13/user/mo | up to 50 | Admin console, 25 security policies, 14-day trial |
| Business | ~$7.54/user/mo | Unlimited | 100+ policies, Families for employees |
| Business Max | ~$8.84/user/mo | Unlimited | Unlimited SSO apps, advanced MFA |
- The free plan’s restriction is severe and easy to miss. You choose either computers or mobile devices. Since the entire value of a password manager is having credentials wherever you are, this is a plan that cannot do the job. Bitwarden’s free tier, by contrast, syncs across all devices.
- Families is the best value in the lineup. Six people for ~$4.53 a month works out under $1 each.
- All paid plans bill annually. There is no monthly option, so the trial is your only low-commitment evaluation.
- Business Max is where SSO lives. Unlimited SSO applications and advanced MFA require the top tier.
Who Should Use LastPass
- Existing business customers with a working deployment. Migrating an organization’s password manager is genuinely disruptive, and the admin console is good. If your accounts postdate the breach and enforce strong master passwords, staying is defensible.
- Families wanting cheap coverage for six. The per-person economics are strong.
- Teams needing a mature admin console. Policy depth on Business is a real strength.
It fits poorly for anyone starting fresh, where equally priced competitors carry no comparable history; for cryptocurrency holders, given the documented and continuing pattern of thefts traced to these vaults; and for anyone wanting a usable free tier, which the one-device-type limit precludes.
Honest Pros and Cons
Strengths
- A mature, capable product. Autofill, sharing, and generation all work well after many years of refinement.
- Excellent admin console. 100-plus security policies on Business, which smaller competitors do not match.
- Strong family value. Six users for roughly $4.53 a month.
- 600,000 PBKDF2 iterations. A genuine and significant hardening after the breach.
- Dark web monitoring included, even on the free tier.
- Zero-knowledge architecture. LastPass cannot read your vault, which is what prevented the breach being total.
Limitations
- The 2022 breach is unresolved by nature. Stolen encrypted vaults cannot be recalled, and thefts traced to them continued into late 2025.
- Unencrypted metadata. Stored URLs were not encrypted, revealing which accounts each vault held.
- Slow, criticized disclosure. Months passed before the incidents were publicly connected.
- Regulatory and legal consequences. A $24.5M class action settlement and a UK ICO penalty in November 2025.
- The free plan cannot sync devices. Which defeats the purpose for most users.
- Annual billing only on every paid tier.
LastPass Alternatives and How It Compares
- 1Password is the most common destination for departing LastPass users, with a strong security record and comparable pricing.
- Keeper is the enterprise-oriented alternative with a robust compliance and security posture.
- Dashlane competes closely on features with a clean interface and bundled VPN on some plans.
- Zoho Vault is markedly cheaper and compelling for organizations already running Zoho.
- Bitwarden is the open-source option, auditable and with a genuinely usable free tier that syncs across all devices — the direct answer to LastPass’s free plan restriction.
For a broader survey, browse our password manager directory.
The Verdict
Judged purely as software, LastPass is good. The autofill is reliable, the admin console is among the best in the category, the family plan is excellent value, and raising PBKDF2 iterations to 600,000 was a serious and correct response. Nothing here is incompetent.
But a password manager is not judged purely as software. It is judged on whether you should hand it every secret you own, and LastPass is the only major option in this category asking that question against a breach in which encrypted vaults for its entire customer base were taken. The severity is not hypothetical: researchers have traced cryptocurrency thefts to those vaults into late 2025, the company settled a class action for $24.5 million, and a UK regulator issued a penalty in November 2025. Stolen encrypted data has no expiry date, and no amount of subsequent hardening retrieves it.
So the recommendation splits. If you are choosing a password manager today, choose a different one. 1Password, Keeper, Dashlane, and Bitwarden cost about the same, do the same job, and carry no equivalent history — there is no benefit LastPass offers that offsets the risk of starting here. If you are an existing customer, particularly a business with a working deployment, staying is defensible provided your account postdates the breach or your master password is long and unique. Migration is disruptive and the product is competent.
If you held a vault before August 2022, act regardless of what you decide about the software. Treat every credential in that vault as compromised and rotate it, starting with crypto seed phrases, financial logins, and email. Many affected users never received a direct warning, and the thefts have continued for years precisely because people assumed encryption meant safety. It meant time, and for weak master passwords that time has run out.
FAQ
Is LastPass safe to use in 2026?
The software is technically sound and now uses 600,000 PBKDF2 iterations, a substantial improvement. But encrypted vault backups for the entire customer base were stolen in 2022 and cannot be recovered, and cryptocurrency thefts traced to those vaults continued into late 2025. Accounts created after the breach with strong master passwords are in a materially better position than pre-2022 accounts, but the history is a legitimate reason to prefer a competitor when starting fresh.
What exactly was stolen in the LastPass breach?
Attackers accessed AWS S3 buckets containing encrypted customer vault backups, obtaining them for the entire customer base. Vault contents were encrypted, but metadata including stored website URLs was not, revealing which accounts each vault contained. Source code and technical secrets were also taken in the first stage of the attack. LastPass did not publicly connect the two incidents until February 2023.
I used LastPass before 2022 — what should I do?
Assume that vault is in criminal hands and rotate every credential it held, prioritising cryptocurrency seed phrases, financial accounts, and email. Changing your master password now does not protect the stolen copy, which is encrypted with the old one. This applies whether or not you still use LastPass, and whether or not you were ever notified — many affected users received no direct warning.
Is the LastPass free plan any good?
Not really, because of one restriction: it works on a single device type. You choose either computers or mobile devices, so your phone and laptop cannot both hold your passwords. Since having credentials available wherever you are is the entire point, this makes the free tier impractical for most people. Bitwarden’s free plan syncs across all devices and is the obvious comparison.
What is LastPass best for?
Existing business customers with a mature deployment who value its admin console and its 100-plus security policies, and families wanting six-person coverage cheaply. For anyone selecting a password manager for the first time, competitors at similar prices without a comparable breach history are the more sensible choice.
Compare LastPass with other popular tools in the same category.
I rave about how easy it is to sign in and share passwords at work. Having personally used a password manager for years, I was excited to get staff set up with the system
It has proven difficult to get some staff on-boarded due to technical skill or competency
Gone are the days of lost or forgotten passwords. It's also so easy to share vital passwords with management via shared folders.
So easy to log into apps, websites on all of my devices.
I have found no downsides to using LastPass.
I no longer have to keep 3 pages of notes for all the passwords I have to keep up with.
Simple, easy, effective tool - and being able to use as an app or extension makes it truly functional. The interface, app, etc. are very easy to use - I've used "enterprise" tools that are way too "full featured" which means people aim to never use them! Having a single solution that encourages people to not just protect corporate data but also better address online security in their personal lives, is phenomenal.
In the family version, having to clone existing passwords to shared folders is a pain. Moving them would have been ok, but wasn't an option. (If you're starting from scratch, that's not an issue)
Primarily, creating secure and unique passwords for every site or app that you need. Secondarily, being able to share those to family-members or colleagues, as appropriate.
easy to use can be used by several people
sometimes it appears when I do not need it
An easy way to share passwords with your colleagues
LastPass keeps all my passwords, log-in information, and personal digital details safe, secure and available from anywhere. For instance, if my phone was lost or stolen while traveling, I would only need to log into my LastPass account, where all my personal and business information is stored for easy retrieval. I keep the details of my passport, credit information, and even health information so that in the event of an emergency, I have immediate access from anywhere in the world. Most importantly, I only have to remember ONE password. I have used LastPass since 2012 and recommend it to all my clients.
I cannot think of anything I dislike about LastPass. The service has been continually improving, and I'm pleased with it.
I am a web designer, and I store hundreds, if not thousands, of passwords and details about my sites. I can also share passwords securely with my clients through the system.
I like that I can share credentials with my team in a secure environment, without compromising the safety of our systems.
The computer app does not communicate too well with all my web browsers.
Sharing credentials and sensisitive information with my team quickly, including any possible updates.
Provisioning accounts through azure active directory ease of use and security for the users..
Setup with users who already have accounts caused issues with provisioning accounts and conversion did not work.
Single sign-on using office 365 credentials instead of individual user passwords.
Makes it easy to generate good passwords, and identify and fix past bad practices. The availability across many platforms, and integration with browsers and apps, makes passwords easily available when needed.
It is sometimes a bit balky on Android phones, particularly older versions of Android. And there are occasional cases where it is confused by the form and doesn't fill on or swaps username and password fields when filling in.
LastPass helps me maintain good security across many accounts, and makes it easy to access the passwords across the many machines I use. It encourages best practices.
I like how easy it is to select the correct login and have the password default to sites I access using multiple user IDs.
Some fields in some of the browser-based applications I use will have the LastPass icon link when they shouldn't. This can cause problems when using these applications.
I access many sites throughout the day with unique user IDs and passwords and LastPass allows me to work more quickly and efficiently as I am not scrambling and searching for user ID and password to the varying sites.
Easy to use, It secures my all password Option to save multiple credentials for one tool Option for shared folder and acess
sometimes logged out in to use autofill.
Now, I don't need to remember multiple passwords. In my organisation, i have multiple tool to use and it's difficult to remember all the passwords.
I LOVE that I no longer have to write down and store my passwords. I LOVE that I can install the application on multiple devices, which always allows me access to important websites.
On occasion, LastPass does not automatically launch the website with the user name and password pre-populated.
LastPass prevents password vulnerability and eliminates a user from using the same password for multiple websites.
I like being able to manage 100's of DIFFERENT passwords in one place and being able to share those passwords securely with my team
That if you lose your master password you are 100% screwed
centralized password management and secure sharing of those passwords.
My partner and I have multiple accounts and memberships that we share but are in only one of our names. Last Pass Families makes it super easy to share login information for these accounts. Also, I like the peace of mind knowing that should something happen to one of us, the other is able to access account information easily. Plus it has made it incredibly easy to create very intricate passwords that are much more secure.
The Android app (on tablets specifically) isn't as reliable and does not consistently prompt to autofill login info on Chrome
Managing passwords; creating very difficult passwords to improve security.
When using the business plan, you can share passwords with colleagues.
When I needed to add a license recently, the new checkout page was not user-friendly and I had to go back to the old UI.
Adding security to every external service which requires passwords.
I like the seamless syncing across devices. The one-click password generator. The prompt to save new / updated passwords, and the proactive warning if an account is compromised.
It occasionally stops auto-filling on my Android devices, but I suspect that this is caused by Android updates, and not LastPass.
It allows me and my users to employ complex and unique passwords without having to worry about remembering them.
It's extremely useful to have all of your passwords in an encrypted platform like LastPass, so that you can access them wherever you are and that not only saves time but gives you peace of mind.
I don't have any dislike of LastPass yet.
Having all the passwords that I need for my business in one place and knowing that they are safe and secure.
I've been using Lastpass since 2010 when I started to work in IT while finishing my BS in Engineering. I've been using it since to have a single, secure, and simple system to store my passwords. Now it helps me generate passwords, lowering the number of decisions I need to make, while being able to move between Apple, Windows, and Chrome ecosystems while teaching.
The only thing I don't like about Lastpass is that it reminds me to change passwords that have been in leaks. Honestly it's another strength. I just get annoyed because I don't have time to change a bunch of passwords when I'm trying to load a site.
Now that passwords need to be frequently changed across platforms, it allows me to have multiple passwords instead of one across sites. I feel more secure in my digital presence.
The best thing I find about Lastpass is the cross-platform integration and ease of use on all platforms. Regardless of if I'm on iOS, Windows, or Mac, the Lastpass software works seamlessly and allows me to easily log into the sites I need to while making sure I'm secure.
The biggest issue I have is the variable nature of how LastPass remembers sites. I'm pretty sure it's a website issue, but sometimes LastPass gets confused about which login screen to show. Other than that the product is quite user friendly and easy to use.
They solve the problem of complex passwords and the problem I have remembering them. I don't want to reuse passwords as we all know that's an issue from a security perspective, but remembering all of them is a huge challenge.
I can not only work from anywhere, but can technically use any computer while maintaining the security of my client/personal files.
Sometimes, when I keep the browser open overnight, the quick link option doesn't work. Meaning I have to copy & paste website link and password to log in. Also, it would nice if when sharing a password, i can allow the other person to update the password and have that reflect in my LastPass account as well. To be clear, I would like this option, I'm suggesting that it was a permanent/singular feature. Websites require password updates every so often and it would be convenient due to this.
Easy to share passwords with our office staff. Easy to generate different types of passwords. Easy to store passwords and access.
LastPass integrates nicely across mobile and desktop platforms. I have had zero issues with saving and maintaining and generating new passwords. This has helped me be more secure online without having to duplicate or remember passwords and login credentials.
The only knock I'll give LastPass is the slowness on my Apple device. Rather than being fully integrated into the web browser, it transfers me to the LastPass app. However, we're talking a couple seconds. It's a small trade off for the convenience of highly secure logins.
LastPass solves my issues reusing old, unsecure passwords. It delivers complex passwords and remembers them at the moment I need the info. I also do most of my shopping online so LastPass manages all my payment cards in an easily accessible manner.
The ability to share passwords with differnt members of the family, while keeping some private or between me and my wife.
Certain apps don't work with LastPass or apps that worked in the past stop working. There is no easy to find way to get them working again. Sometimes they start to work again after some time. I'm sure that this is a moving target for LastPass, as other developers are always improving security of their apps, but it is an occasional frustration.
My important personal and business accounts now use much more sophisticated passwords because I use LastPass. Also, I no longer duplicate passwords across sites/apps, so if one is compromised, the others are still safe. That's great peace of mind.
I love that I can take LastPass just about anywhere I need to (mobile, desktop, etc.). I am never without my passwords and the safety that brings. I've used other apps but none compare to LastPass.
I haven't found anything so far that I dislike. The ability to choose more secure passwords is maybe the best feature of the app. I do get annoyed sometimes at having to login securely, but that is what makes the app so perfect. The security is top-notch.
I have so many passwords to remember, and without LastPass, I'd be stuck with pieces of paper or some other very insecure product. My performance has increased because I don't need to hunt for a password. LastPass remembers it for me.
I love the easy access to all my passwords and knowing that if something happens my information will be accessible by who I choose. The fact that I can randomize all my passwords and not have to remember them or write them down is so amazing.
Sometimes the app popping up and keeps coming up when when you try to close it.
The struggle in the office is that the owner has passwords for all the different accounts and suppliers and we don't want to constantly pull up a password list from the front each time we need a password. With Lastpass we can set it up on each computer and access the passwords we need right away without the headache.
Thank goodness for Last Pass. I must admit I was reluctant to set up an account for years but now I am so glad I did it. There were just so many passwords for different things and passwords that had to be updated regularly, I was starting to lose the reason! I love that every password I have now is secure, unguessable and different from the others. The chrome extension is brilliant and it all just works.
I have found it a little tricky to share passwords with my suppliers, such as web developer. I might be doing something wrong, but that didn't always work. Also the Last Pass Authentication app doesn't work for me.
Security, safety, time, hassle.
I love the integration across all my devices and the ease of use to add and update user IDs and passwords. I also appreciate the security features that guard my accounts and notify me of duplicate or exposed passwords.
Not much to dislike about Lastpass other than possibly the sharing feature is cumbersome for those who do not have LastPass accounts and have to set one up before seeing the shared information.
In my position, I have well over 300+ user IDs and passwords to keep track of, and LastPass does this for me very well. It also lets me know when information is found in the darkweb if passwords are stale, too easy, and so much more.
I've used LastPass both personally and professionally. It is very secure, user friendly, and the support has been great. You can keep things well organized and I love using the app.
An update a while ago made it difficult to use the browser plugin. I did have to restart my personal account and wished there was a better way to recover my passwords, but I'm also glad it was difficult (or impossible) to easily get that information.
Keeping my personal information secure and organized.n Also, it makes logging into apps and websites fast. I appreciate the secure passwords it also generates and the knowledge I've gained from their articles.
It's incredibly fast & intuitive to create and save new passwords. Autofill works well across mobile and desktop.
The transition from free to paid was a little rough - plenty of warning time, but it was an unplanned expense. Thankfully it's once a year!
I don't remember any passwords, and therefore would always use the same few across accounts (not secure!). LastPass eliminated that issue for me.
Cannot live without it in this age of required unique and hard-to-remember passwords for dozens of sites! I appreciate the password monitoring features and the reminders to improve repeated passwords as well. Makes me so much more secure!
Recently began suggesting form fields that do not need suggestions (and I do not know how to turn off), but the overall pros far outweigh the minor inconvenience.
Cannot live without it in this age of required unique and hard-to-remember passwords for dozens of sites! I appreciate the password monitoring features and the reminders to improve repeated passwords as well. Makes me so much more secure!
It's easy to use and has extensions for all major browsers for a more seamless experience.
Overall, there is not much I dislike, sometimes the autofill feature will not work, but that is rare.
I have many passwords and it helps me keep track of them and audit them to make them more secure.
LastPass keeps me accountable on having secure password.
The length of time LastPass is available on mobile app
Being able to have over 100 passwords
