The verdict, up front
LastPass is a competent password manager with a trust problem it has not fully outrun. The 2022 breach was serious: encrypted vaults were stolen, and anyone with a weak master password was genuinely exposed. LastPass has since rebuilt its architecture and hardened defaults. It works well and the free tier is usable — but if you are choosing fresh today, Bitwarden and 1Password are the safer recommendations.
I am not going to bury the headline. In 2022 LastPass suffered a breach in which attackers obtained backup copies of customer vaults. The vaults were encrypted — but encryption only protects you if your master password is strong, because the attackers could brute-force offline, indefinitely, with no rate limiting.
That matters for this review because a password manager sells exactly one thing: trust. So the question is whether LastPass in 2026 has earned it back.
What actually changed after the breach
| Area | Before 2022 | Now |
|---|---|---|
| Password iterations (PBKDF2) | 100,100 (many older accounts far lower) | 600,000 |
| Master password minimum | 8 characters | 12 characters |
| URLs in vault | Stored unencrypted | Encrypted |
| Infrastructure | Legacy shared systems | Rebuilt, isolated |
| Dark-web monitoring | Premium only | Premium only |
Those are real, meaningful fixes. The unencrypted-URL issue in particular was a genuine design flaw — it leaked which sites a person had accounts on even when passwords stayed safe.
1. LastPass in daily use
Setting aside history, the product is good. Autofill is reliable across browsers, the password generator is solid, secure notes and card storage work as expected, and the emergency-access feature — granting a trusted contact vault access after a waiting period — is genuinely well designed and something several competitors handle worse.
The free tier restricts you to one device type: either computers or mobile, not both. In practice that makes free LastPass impractical for most people, which is clearly the intent.
Pros
- Reliable autofill and browser extensions
- Excellent emergency access feature
- 600,000 PBKDF2 iterations by default now
- Straightforward, familiar interface
- Free tier exists (with limits)
Cons
- 2022 breach exposed encrypted vaults
- Free tier limited to one device type
- Trust deficit versus competitors
- Older accounts may still sit on weak iteration counts
| Best for | Existing users who have already rotated credentials |
| Free tier | One device type only |
| Premium | ~$3/mo billed annually |
2. LastPass vs Bitwarden vs 1Password
| Factor | LastPass | Bitwarden | 1Password |
|---|---|---|---|
| Free tier | One device type | Unlimited devices | None |
| Premium price | ~$3/mo | ~$1/mo | ~$3/mo |
| Open source | No | Yes | No |
| Major breach history | 2022 vault theft | None | None |
| Ease of use | Very good | Good | Excellent |
| Family plan value | Good | Best | Good |
The honest summary: Bitwarden does what LastPass does, costs less, is open source, and has not lost anyone’s vault. 1Password is the most polished if you will pay for it. LastPass’s remaining advantage is familiarity.
3. If you use LastPass right now, do this today
- Change your master password to a long passphrase — four or more random words, 16+ characters.
- Check your iteration count in Account Settings. If it is below 600,000, raise it.
- Rotate high-value credentials — banking, email, and anything holding payment details.
- Turn on two-factor authentication everywhere it is offered, especially email.
- Assume old vault contents were seen if your pre-2022 master password was short.
That advice applies whether you stay or leave. Stolen encrypted vaults do not expire — an attacker can keep cracking at leisure.
Final verdict
LastPass works well and has fixed the specific flaws that made 2022 so damaging. But a password manager is a trust product, and competitors offer equal or better security at lower cost with no comparable incident. Using a password manager — any password manager — still beats reusing passwords by an enormous margin.
Compare password managers before deciding
If you want the strongest recommendation rather than the most familiar name, read our full comparison first.
Frequently asked questions
Is LastPass safe to use in 2026?
Safer than it was. Iterations, master-password minimums, and URL encryption have all been fixed. It is still safer than reusing passwords — but Bitwarden and 1Password carry less baggage.
Was my vault stolen in the 2022 breach?
Assume yes if you had an account before late 2022. Whether it was cracked depends on your master password strength and iteration count at the time.
What is the best free password manager?
Bitwarden. Its free tier allows unlimited devices, which LastPass’s does not.
How do I move from LastPass to Bitwarden?
Export your LastPass vault to CSV, import it into Bitwarden, verify everything transferred, then delete the CSV securely and close the LastPass account.
Disclosure: this page contains affiliate links. If you purchase through them we may earn a commission at no extra cost to you. Our verdict here is deliberately cautious regardless of commission.