LastPass Review

This is an expert-researched assessment, not a claim that TopRatedSoftware ran a controlled password manager laboratory. We compared LastPass's pricing, Plus, VPN, features and security pages, its release notes, and an independent investigation of the 2022 breach by KrebsOnSecurity, as published on October 20, 2026. Features are described as LastPass documents them, not from our own tests.

That distinction matters particularly for password manager reviews. A provider can document its architecture and certifications, but neither proves how well an old vault holds up once an attacker has a copy of it. Our 4.2 rating weighs LastPass's low prices, free plan, features and certifications against the breach and how slowly older accounts were moved to stronger settings. It does not mean the product is risk-free, or that any single password manager can protect against every form of compromise.

LastPass is still adding features. Its October 13, 2026 release notes added AI Monitoring & Protect to SaaS Protect in the business Admin Console, which shows which AI tools a company's staff use and warns them when they paste sensitive data into one. Its new browser extension is out for Chrome, Edge and Safari, with Firefox and Opera listed as coming soon.

LastPass stores passwords and other sensitive information in an encrypted vault, then saves and autofills them across browsers and devices, including Chrome, Firefox, Safari, Android, iPhone and iPad. It generates strong passwords and random usernames, and it creates, stores and manages passkeys alongside passwords. Passwordless vault login lets you open the vault without typing your master password, using options such as fingerprint or face recognition.

A security dashboard flags weak, reused and old passwords with recommendations, and dark web monitoring alerts you if your details turn up there. You can share credentials with family, friends or colleagues and control who sees what and when. Secure notes hold Wi-Fi logins and banking details, emergency access gives a trusted contact one-time access to your vault, and a digital will feature leaves copies of your digital life behind.

LastPass says it uses a zero-knowledge architecture: your vault is encrypted with 256-bit AES, with PBKDF2 hashing and SHA-256 salting, so the master password is the key to it. It autofills credentials only on matching URLs, supports multifactor authentication, and for businesses adds single sign-on and adaptive, risk-based authentication.

The company holds ISO 27001, SOC 2 Type II, SOC 3, BSI C5 and TRUSTe certifications, has trusted security organizations audit and test its service, and runs a bug bounty program for outside researchers. It also maintains a global data privacy program for customer and user data.

Business plans add more control. Admins manage users, accounts and policies from one console, connect existing user directories, offer federated login and extend LastPass multifactor authentication to workstations. Business Max includes SaaS Monitoring & Protect, which finds the apps staff use and sets usage rules, and the new AI Monitoring & Protect, which does the same for AI tools.

In November 2022, LastPass disclosed that attackers had stolen password vaults containing encrypted and plaintext data for more than 25 million users. A stolen encrypted vault can be attacked offline with unlimited guesses, so how safe it is depends on the master password and on the encryption settings the account had at the time.

Those settings varied by when people joined. KrebsOnSecurity reported in 2023 that researcher Wladimir Palant found many older accounts still at 5,000 PBKDF2 iterations, and some between 1 and 500, against 600,000 for recent accounts. LastPass had required 12-character master passwords since 2018 but did not force existing customers to change theirs. Investigators linked crypto thefts from more than 150 people, worth over $35 million, to vaults that had held seed phrases.

The iteration count matters because it sets how fast guesses can be tested. According to the same reporting, a single graphics card would need about a year to crack a password protected by 500 iterations, but about 10 years at 5,000. Experts quoted there advise anyone who kept important passwords in LastPass at the time to change them, and to move crypto holdings to offline hardware wallets.

LastPass has four personal plans. Free stores unlimited passwords but works on one device type only, and includes a 30-day trial of Premium. Premium costs $3.00 a month, billed annually, and adds access on all devices. Families costs $4.00 a month for 6 Premium accounts.

Plus costs $7.00 a month, billed annually, and adds LastPass VPN: unlimited use on up to 10 Windows devices, with no data caps according to LastPass, through a separate app that uses your LastPass login. LastPass describes a network of more than 800 servers; its Plus page puts coverage at 100+ locations in 85+ countries. Versions for other platforms are listed as coming soon, so Plus only makes sense today if you use Windows.

LastPass suits people who want a free plan or a low price: Premium at $3.00 a month and Families at $4.00 for 6 accounts undercut 1Password and Dashlane. Windows users who also want a VPN can get both in Plus, and businesses get new tools for monitoring SaaS and AI use across their staff.

Weigh the breach before you choose it. If you had a LastPass account before 2023, the vault stolen then may have used weak settings, and any passwords stored in it at the time should be treated as exposed. If that history matters more to you than price, the alternatives below take different approaches, such as a Secret Key that is needed alongside your password.