LastPass

Is LastPass safe?

LastPass is safe enough for a new user with a strong master password, and risky for anyone whose vault existed in 2022. That year attackers copied encrypted backups of customer vaults, which they can try to crack offline for as long as they like. US federal agents believe they have done exactly that to steal cryptocurrency. We score LastPass 56/100, far below Bitwarden (88) and 1Password (86), because of security.

The vault design itself is standard today: AES-256 encryption on your device, with a key derived from your master password through 600,000 rounds of PBKDF2-SHA256. LastPass says it never stores or knows your master password.

What happened in the 2022 LastPass breach?

The ICO's penalty notice gives the clearest account. In August 2022 an attacker compromised a developer's work laptop and took 14 of about 200 source code repositories, including encrypted credentials and the key protecting LastPass's backup storage. The next day the attacker hit the home computer of a senior DevOps engineer, one of four people who could decrypt that key, through a known flaw in Plex media software. A keylogger captured the engineer's master password, and a trusted-device cookie got past multi-factor login.

The engineer's personal and work vaults were linked under one master password, a common practice among LastPass staff that the company did not ban until May 2023. That gave the attacker the keys to the backup database. Amazon's cloud alerts about the unusual activity on 15 October went to a mailing list whose only LastPass member was one director, the rest being staff of former parent GoTo, and the security team did not hear of them until 2 November.

What was taken: names, email addresses, billing addresses, phone numbers and IP addresses, plus vault backups. In the vaults, usernames, passwords, secure notes and form data were encrypted, but the website URLs were not. LastPass's December 2022 notice told most users there were "no recommended actions" to take.

Are the crypto thefts linked to LastPass?

US investigators think so. In September 2023 security researchers Nick Bax and Taylor Monahan found that many six-figure crypto thefts had one thing in common: the victims had stored seed phrasesSeed phraseA list of 12 to 24 words that can restore a crypto wallet and all its funds. Anyone who has it controls the wallet.More in the glossary in LastPass Secure Notes before 2022. In a March 2025 forfeiture filing over a $150 million theft in January 2024, whose victim researcher ZachXBT identified as Ripple co-founder Chris Larsen, a US Secret Service agent wrote that there was probable cause to believe the same attackers used a password from the victim's password manager account. About $24 million was seized.

LastPass says law enforcement has not shown it "any conclusive evidence" connecting crypto thefts to its incident. Researchers told KrebsOnSecurity that victims tended to be long-standing customers with weaker master passwords, whose accounts often still used far fewer PBKDF2 iterations than newer ones, making them faster to crack.

Fines and lawsuits

In December 2025 the UK Information Commissioner's Office fined LastPass UK Ltd £1.2 million. The ICO said the breach affected up to 1.6 million UK users and that LastPass "failed to implement sufficiently robust technical and security measures". It also said there was no evidence customer passwords were decrypted.

In the US, a consolidated class action in federal court in Massachusetts produced a settlement with an $8.2 million fund for ordinary and extraordinary losses and a separate crypto pool capped at $16.25 million, with up to $900,000 per validated claim. The claims were settled, not decided by a court. The final approval hearing was set for 14 July 2026; we could not confirm the outcome.

LastPass also appeared in a 2026 study by ETH Zurich and USI researchers that tested password managers against a fully malicious server. It found 7 attacks against LastPass, compared with 12 for Bitwarden and 6 for 1Password.

What to do if you use LastPass

1. If you had a LastPass vault in 2022, change the passwords for email, banking and other important accounts that were in it, starting with any that still match.
2. Move any crypto whose seed phraseSeed phraseA list of 12 to 24 words that can restore a crypto wallet and all its funds. Anyone who has it controls the wallet.More in the glossary or private key was ever stored in LastPass to a new wallet with a fresh seed phrase. Changing the LastPass master password does not protect secrets copied in 2022.
3. Check the password iterations value in your account settings shows 600,000.
4. Use a master password of 16 or more characters, or a passphrase of five or more random words, that you use nowhere else, and turn on multi-factor login.
5. Never use the same master password for a personal and a work vault.

How we scored it

Security (30) is LastPass's weakest factor: a breach that exposed encrypted vaults to offline cracking, a regulator finding of inadequate measures, and a federal filing linking it to a $150 million theft. The regulatory record (55) reflects the £1.2 million ICO fine and the US settlement. Scams and harmful content (80) and privacy (68) are its strongest factors, since the app has no social features and does not track you across other apps.