LastPass

LastPass is a password manager that stores credentials, secure notes, payment information, and other sensitive data in an encrypted vault accessible across devices. Founded in 2008 by Alex Simons and Marvasol Inc., LastPass was acquired by LogMeIn in 2015 for $110 million and later spun off as an independent company in 2022. It has over 33 million users and 100,000 business customers. LastPass was once the most popular password manager in the world, known for its generous free tier and browser-first approach. However, its reputation suffered significantly after two major security breaches in 2022 that compromised encrypted vault data and source code, leading many users and security experts to reconsider their trust in the platform.

Vault and Password Management

LastPass stores passwords, credit cards, bank accounts, secure notes, addresses, and custom item types in an AES-256 encrypted vault. The master password is used to derive the encryption key locally via PBKDF2 with 600,000 iterations (increased from 100,100 after the 2022 breaches). The browser extension auto-detects login forms, offers to save new credentials, and generates strong passwords during registration. The vault organizes items into folders and supports tagging for quick search. The Security Dashboard analyzes stored passwords for weakness, reuse, and presence in known data breaches, providing a security score and actionable recommendations.

Cross-Platform Access

LastPass is available as browser extensions for Chrome, Firefox, Safari, Edge, and Opera, with native apps for Windows, macOS, iOS, and Android. The web vault provides full access from any browser without installing software. Unlike some competitors that require a desktop app for full functionality, LastPass operates primarily through its browser extension and web vault, making it accessible on devices where you cannot install native applications. Autofill works across browsers and mobile apps using accessibility services on Android and the AutoFill framework on iOS.

Sharing and Emergency Access

LastPass allows sharing individual passwords or folders with other LastPass users. Shared items can be configured to allow or hide the actual password (the recipient can use the credential for autofill without seeing the password). Emergency Access lets you designate trusted contacts who can request access to your vault after a configurable waiting period (immediately to 30 days). If you do not deny the request within the waiting period, access is granted — providing a dead man's switch for estate planning and emergency scenarios.

LastPass Business

LastPass Business plans provide centralized administration, shared folders with fine-grained permissions, security policies, SSO integration via SAML 2.0, directory integration (Active Directory, Azure AD, Okta, Google Workspace), and reporting dashboards. Administrators can enforce password policies, require MFA, and monitor employee security scores. The admin console provides visibility into how many employees are using weak or reused passwords without exposing the actual credentials. LastPass Business also includes a free Families account for each employee, which helps drive adoption by extending the tool to personal use.

Security History and Current State

LastPass's security track record is a significant concern. In August 2022, an attacker gained access to LastPass's development environment via a compromised developer account. In a follow-up breach, the attacker accessed cloud storage backups containing encrypted customer vault data along with unencrypted metadata (website URLs, company names). While the vault data itself remains AES-256 encrypted, users with weak master passwords or low PBKDF2 iterations (pre-2023 defaults) are at elevated risk. LastPass has since increased PBKDF2 iterations to 600,000, mandated master password requirements, and engaged security firms for ongoing assessment. However, the breaches fundamentally damaged trust, and security researchers generally recommend alternatives like 1Password or Bitwarden for new users.