LastPass Review

Password manager with an unlimited free vault and apps for every major platform. Our review looks closely at its 2022 vault breach.

LastPass was, for many years, the default recommendation in the password-manager category. The 2022 breach changed that. In November of that year, LastPass disclosed that attackers had exfiltrated encrypted customer vault backups alongside plaintext website URLs, names, billing addresses and email addresses.

Over one million UK residents were among those affected. The UK Information Commissioner's Office later found that LastPass had not implemented the technical and organizational measures expected of a service of its size. The failings included allowing employees to access business systems from personal devices and permitting accounts to be linked under a single master password.

Krebs on Security has since traced roughly $150 million in cryptocurrency thefts to the stolen vaults, with researchers documenting between two and five six-figure heists per month as weaker master passwords are brute-forced offline. The company has tightened its baseline in response. Encryption is still AES-256 with PBKDF2-SHA-256 key derivation, but the default iteration count was raised to 600,000 rounds.

By early 2024 a 12-character master password was enforced for all customers. Multi-factor support is broad, covering TOTP authenticator apps, FIDO2 / U2F hardware keys and biometric login through Touch ID, Face ID, Windows Hello and Android fingerprint. Platform reach is among the widest in the category: Windows, macOS, Linux, iOS, Android, watches and VR, plus extensions for Chrome, Firefox, Safari, Edge, Brave and Opera.

Pricing is competitive. LastPass Premium costs roughly £2.30 / $3 a month billed annually. A Families tier covers six accounts for $48 a year.

The free tier still includes zero-knowledge AES-256 encryption, an unlimited vault, 2FA and password generation. Since March 2021, though, it has been restricted to a single device class. You pick computers or mobile at first login and lose the other unless you upgrade.

Capterra's aggregate rating across more than 2,700 reviews is 4.6 out of 5, with reviewers citing fast setup and the folder system as everyday strengths. The security record is now the first thing to weigh. Trustpilot reviewers also report billing and cancellation problems, with some accounts charged years after deletion attempts.

Digital Trends's editorial verdict is that the poor security track record overshadows the strengths. We'd weigh those facts before treating LastPass as the obvious choice.