LastPass Review 2023: is it safe and reliable?

LastPass is a great password manager. It has a simple and secure interface, strong encryption, and a host of useful features like password sharing, two-factor authentication, and digital legacy. However, LastPass is not without its drawbacks. For instance, it has been recently hacked, and encrypted user data was acquired by threat actors. Additionally, LastPass does not offer the same level of control over your data as some other password managers, and some users have reported that the service can be slow and unreliable at times.

If you’re looking for a quality password manager that has never been breached, then 1Password might be the better choice for you.

Best alternative to LastPass

Using market-leading AES encryption and following a zero-knowledge architecture, 1Password ensures durable password protection and has no history of security breaches. The provider is compatible and easy to use across multiple platforms, including various browsers.

cybernews® score

4.6 /5

• Great set of features
• User-friendly apps
• 14-days free trial

Try 1Password

In this review, we thoroughly examined LastPass and the features this password manager offers. So, continue reading to learn all there is to know about this product in terms of security, ease of use, pricing, and more.

Best alternatives:

★4.6/5

Visit Provider

★4.9/5

Visit Provider

LastPass review – pros and cons

Visit LastPass to learn more about the features

LastPass security breach

A 2022 LastPass incident happened in August 2022. The company's source code was accessed through a compromised developer account. However, no vault data or master passwords were compromised and users weren't asked to take any further action. This can be seen as a positive – despite the scale of the attack, the overall damage was minimal.

However, not even 5 months later, another LastPass breach occurred. This time, a threat actor used information obtained in the August breach to gain access to internal LastPass systems. User details such as email addresses, telephone numbers, and IP addresses were exposed.

LastPass also disclosed that the hacker also was able to obtain a copy of an encrypted backup of the user passwords, website usernames, and form-filling data. The passwords remain safe unless the hacker can crack the encryption. However, among the exfiltrated information, were unencrypted URLs, which may or may not include sensitive data such as account tokens and API keys and credentials.

And although user passwords remain under encryption – for now – this is the third consecutive LastPass breach. In 2019, a researcher found a LastPass browser extension vulnerability. If exploited, the vulnerability could’ve exposed 16 million users' credentials, including master passwords, email addresses, and password reminder questions.

Is LastPass still safe?

The honest answer is no, LastPass is no longer safe to use after the most recent breach. Although the data acquired by the threat actor is encrypted, including user passwords, notes, and other information, the encryption might not be invincible and could be cracked.

Something that adds to questionable LastPass security practices is that is a closed-source password manager. This means that no one can really inspect the code for vulnerabilities (which have been found in the past). Plus, they never reached out to third-party audit agencies to verify whether they were operating securely. You’ll have to take their word for it for pretty much everything they offer.

As for the more technical side of LastPass security, the service uses military-grade AES-256-bit encryption to lock your secure vault. Only your master password can unlock the vault, and it’s never sent directly to them. According to the privacy policy, LastPass receives only the data that was already pre-encrypted on your local device. What is sent to their servers is only encrypted chunks of data. Even their developers cannot decrypt it at will because of the additional hashing algorithm. It means that everything you store in LastPass is supposedly safe from external intrusions. However, some sources say that the encryption could be quite easy to crack.

All in all, the latest breaches showed that LastPass’s systems are not unbreakable, and user data is at risk.

Should you leave LastPass?

Yes, you should leave LastPass and like many others, move on to safer options. The latest LastPass breach left sensitive user data vulnerable to exploitation. Even though the backup vaults with user passwords and notes are encrypted, it is likely that the encryption could be cracked.

And considering that this is not the first time LastPass has been hacked, it is in your best interest to switch to a more secure password manager, such as 1Password.

Most secure password manager

1Password guarantees lasting security for your passwords and other sensitive data once you store it in an encrypted vault. The password manager applies industry-leading encryption, Multi-Factor Authentication and follows a zero-knowledge architecture module, resulting in no security breaches over the years.

cybernews® score

4.6 /5

• Advanced encryption
• Unlimited password vault
• 14-days free trial

Get 1Password

LastPass features overview

LastPass has features to offer that cover all essential password manager’s needs. It lets you keep usernames, passwords, and other sensitive data well protected. Take a quick look at what includes the security and privacy suite of it.

• 2FA, Multi-factor authentication, and LastPass Authenticator
• One-Time Passwords (OTPs)
• Password generator
• Country restriction
• Password vault
• Credit monitoring
• Security challenge

The list seems promising, right? To enlighten you even more, we have reviewed each feature separately. So, scroll down and find out what’s so good about each security tool that LastPass provides you with.

2FA, Multi-factor authentication, and LastPass Authenticator

To make the data even safer, LastPass supports 2-factor authentication (2FA) and multi-factor authentication (MFA).

2FA is designed to keep your most sensitive information safe by making you take additional steps before accessing the LastPass vault where your passwords and usernames are kept. There are many options you can choose for your second factor, including their very own LastPass Authenticator and:

• Smartphone apps (Google Authenticator, Microsoft Authenticator, Symantec VIP, etc.)
• Software-based services (LastPass Grid, LastPass Sesame, others)
• Hardware tokens (YubiKey, RSA SecurID)

You can get the LastPass Authenticator app for free on the Google Play, Apple Store, and Windows Store.

MFA allows you to combine even more factors for authentication and secures your logins to online services other than LastPass. You can choose which services to apply MFA to, which devices to trust, etc.

Due to its usefulness for managing permissions, security levels, and high level of customizability, LastPass MFA (which is a separate app) is a B2B-oriented feature available with the MFA, Teams, Enterprise, and Identity plans. However, advanced multi-factor authentication options are available for individual Premium users as well.

You can manage LastPass 2FA and MFA through the Multifactor Options section of your online dashboard.

One-Time Passwords (OTPs)

If you’re accessing your web vault from a device that doesn’t belong to you, you might be walking into a trap. You can’t know whether the device has a keylogger or other software that could be capturing your keystrokes. LastPass has a potential solution there with their one-time passcodes feature. That way, you can log in without revealing your master password.

You can generate LastPass one-time passcodes after you’ve logged in to your account. You can use them afterward, and each passcode will expire after use. It means that it’s impossible to log in to an account twice with the same passcode. Plus, you can print them or store them in other methods to use later or in emergency recovery.

LastPass password generator

One of the best features that LastPass offers is its password generator. This will help you create strong passwords for your most visited websites and apps.

What a password generator does is it creates passwords for you. Therefore, you don’t have to worry about qwerty or 123456789 not being strong enough to protect your privacy online. With a password generator, you’ll get unique passwords that have a variety of numbers, symbols, capital and lowercase letters.

What’s great about LastPass password generator is that you can control how strong your password will be.

For example, you can choose to include or skip numbers and symbols, select the length of your password, or make it easy to read and say.

However, note that the password in the screenshot above is not particularly strong – I would advise you to increase the length and add both numbers and symbols to the password. After all, using LastPass means you don’t have to memorize your passwords.

While we always recommend to go for the long and hard when it comes to passwords, having an option to customize them is a huge advantage.

LastPass country restriction

When you create your LastPass account, LastPass restricts you to the country you're in. However, if you travel regularly, you can add additional countries.

To do that, follow these steps:

1. Go to your LastPass Vault.
2. On the left, click Account Settings.
3. Click the General tab, and then click Show Advanced Settings.
4. Enable Only allow login from selected countries checkbox.
5. Choose the countries you wish to add to your list.
6. To save, click Update.
7. If asked, provide your Master Password.
8. Click Confirm.

That’s all there is – now you are no longer restricted to one country.

One thing to remember is that you can change your virtual location by using a Virtual Private Network (VPN). Thus, you can bypass the country restriction altogether.

Password vault

LastPass keeps your passwords in an online vault. You can access it on your desktop, web, or mobile device. As the vault is encrypted, your usernames and passwords are well protected against prying eyes.

One good thing about LastPass is that you can access its online storage (or vault) offline as well. If you want to log into your vault when offline, just make sure you've logged into your vault at least once with an Internet connection. This way, your device caches a local version of your encrypted data to the device.

LastPass credit monitoring

LastPass users from the US can take advantage of a free credit monitoring alert feature.

With it, you get real-time protection, as you're notified if your credit report suddenly changes. The credit monitoring feature enables users to better monitor their credit report and protect themselves against identity theft.

To enable this feature, follow these steps:

1. Log in to your LastPass account.
2. On the left menu, click More Options.
3. Click Advanced > Credit Monitoring.
4. Select Enable Credit Monitoring.

After completing these steps you will be asked to create new Form Fill Profile or select an existing one.

To enable credit monitoring feature from an existing profile, find your profile on the left and click Enable Credit Monitoring. If you need, you can also edit form-fill, and enable the credit monitoring feature afterward:

LastPass security challenge

When you’re storing in a password vault, one of the most appealing points of a password manager is that there’s everything in one place. It also means that it’s possible to evaluate whether the password is secure. You can do it by hand, or you could use the LastPass security challenge.

LastPass security challenge is a simple analytical tool that goes through all of your stored passwords and evaluates their complexity. If you’re reusing passwords with little to none uniqueness, you’ll immediately notice low-security challenge scores indicated in red. The good thing is that it also evaluates your master password’s complexity. So, you’ll not only reinforce the passwords that you use on other accounts but will be able to switch to a stronger master password.

Ease of use and setup

Using LastPass is an intuitive and easygoing experience.

For example, to import passwords to LastPass, follow these steps:

1. Open your browser
2. Click on the inactive LastPass icon in your toolbar
3. Enter your username and your master password
4. Click Log In
5. In your web browser toolbar, click the LastPass icon
6. Click Import

If you ever need to export your passwords from the vault, here’s what you need to do:

1. Go to your LastPass vault
2. On the left, select More Options
3. Go to Advanced > Export
4. If asked, provide your master password
5. Click Continue
6. Select More Options in the left navigation
7. Go to Advanced > Export

LastPass web client

LastPass web client is the place where users keep their usernames and passwords. What is more, using it, you can manage your account’s settings and the information stored in the vault.

For the sake of comfort, your web vault is organized similarly to your desktop (or local) vault. The best part is that it's OS-neutral. You will be able to use this version with pretty much all web-enabled devices.

LastPass browser extensions

One great thing about LastPass is that it offers extensions for the most popular browsers. That includes Chrome, Firefox, Opera, Safari, and Edge. You can get your browser extension after creating your account.

Installing LastPass browser extensions is easy – simply confirm the installation when prompted after you create your LastPass account, or download the app to your device.

With the LastPass extension, you’ll forget about your passwords altogether – LastPass will remember your logins and automatically fill them in for you when needed.

Mobile apps

LastPass offers apps for both Android and iOS. You can get them on Google Play and the Apple Store, respectively. Both apps are easy-to-use and designed to be as user-friendly as possible.

After you get your mobile app, feel free to explore its settings:

For example, you can choose AutoFill feature for LastPass to fill in the website forms for you:

You can also create passwords with the Password Generator feature on your mobile device:

Naturally, you won't have as many options for generating passwords on your mobile device, but it still does the job.

After downloading one of the mobile apps, users also get the Authenticator app, which is one of the MFA elements created to add an extra layer of security on your most sensitive information.

But it's worth mentioning that the Android client has seven trackers that you can't opt-out of and which collect information about your online activities. These include AppsFlyer, Google Analytics, Google CrashLytics, Google Firebase Analytics, Google Tag Manager, MixPanel, and Segment.

All of these trackers, except for the latter two, are common for other password managers as well. They are used for analytics and crash reporting to optimize and improve the products.

MixPanel and Segment, on the other hand, are used for user profiling and marketing purposes. However, LastPass representatives have assured that no personally identifiable data or vault activity can be passed through these trackers.

Plans and pricing

LastPass is sometimes called a freemium password manager. It means that the product is offered for free, but those who wish to explore more of its features have to pay.

To see what you get when opting for one of the three plans – Free, Premium, and Families – let’s discuss them one by one.

Before I do that, however, let’s get one thing out of the way: payment options only include credit cards, which is a bummer.

Password managers' price comparison

Also, there are other great password managers out there. Here is a of their subscription prices for you to compare with that LastPass is offering:

	Brand	Rating	Price
1Password		4.6 ★ ★ ★ ★ ★	from $2.99/month
NordPass		4.9 ★ ★ ★ ★ ★	from $1.72/month
RoboForm		4.7 ★ ★ ★ ★ ★	from $0.99/month
LastPass		3.8 ★ ★ ★ ★ ☆	from $3.00/month

Winner

Get 1Password, now 50% OFF

Free plan

LastPass free option offers the essentials that you’d expect from a password manager. However, you will be restricted to the device type. It means that if you download the desktop app, you’ll be able to use it only on desktop clients. The same with mobile apps, so there are no cross-device type capabilities.

You can get 30 days of Premium to see how their unlocked version feels like. Otherwise, with the free version, you get:

• Secure password vault
• Access on all devices
• Autofill feature
• Password generator
• Security dashboard
• Multi-factor authentication (only the basic options)
• LastPass Authenticator
• Secure notes

The free version on its own is pretty restrictive, so it does make sense to opt-in for paid plans.

Premium plan

To see what is the difference between LastPass Free and LastPass Premium, let’s look at what additional features the Premium plan offers for $3.00/month, billed annually.

• File sharing with many people
• Cross-device capabilities
• Dark web monitoring feature
• Emergency access
• Priority tech support
• LastPass for applications
• 1GB encrypted file storage
• Advanced multi-factor authentication options

You can find the comparison of all the features you get with each plan you opt for on LastPass website.

Families plan

When it comes to the Families plan, you get all the features Free and Premium users do, as well as:

• Family manager dashboard
• Unlimited shared folders

Families plan can be used by 6 users for $4.00/month, billed annually, so it should be more than enough for many households.

LastPass video review

Customer support

When a problem arises, LastPass users can count on the customer support. They can go to the LastPass Support page and type in an issue they're encountering in the search bar:

For example, I wrote autofill and instantly got the articles that you see in the picture above. After clicking on one of them, you'll find an answer and detailed instructions, if needed.

Account and password recovery

LastPass Password recovery is not as self-explanatory as it may sound. Actually, LastPass doesn’t know your master password, therefore it cannot send it to you. While this may cause difficulties accessing your vault, the main purpose of keeping your password completely private is protecting you against online fraudsters.

When facing problems accessing your account, try the following steps:

1. Take advantage of a password hint that you set up when creating your account. The hint is not the password itself, but it can help you remember your master password. Even though creating a hint is not mandatory, we highly recommend doing so as it may help to recover your LastPass account.
2. Go to LastPass Account Recovery page on their website. Here you can activate your local One Time Password. With it, account recovery may be possible. Something to keep in mind is that recovering your account with a one time password is only possible on desktop devices.
3. Try accessing your account through the LastPass website and through the browser add-on. If you can login via only one of them, the LastPass browser add-on may be the one to blame. In such a case, clear your browser cache, and contact LastPass customer support.

If the above-mentioned tips don’t work for you, you may have lost access to your LastPass account for good. Recovering the password is not an easy task with this password manager.

Most common LastPass issues

So, what are some of LastPass' shortcomings and how can you fix them?

While some users have trouble configuring multi-factor authentication or importing their passwords from browsers and other password managers, there are two most common issues that LastPass users run into.

The first one involves setting up the Chrome extension and the other is about making autofill work. Below are the solutions to these two LastPass problems.

LastPass Chrome extension not working

There are a few options to try if your LastPass Chrome extension is not working:

1. Reinstall or update your Chrome extension. To do that, go to the LastPass website, and download the latest version of Chrome extension.
2. If the extension is listed, but not enabled, enable it. To do that, go to chrome://extensions in your Chrome address bar.
3. If LastPass is hidden from your browser, reveal it. To do that, click the Customize Toolbar icon, then right-click the LastPass icon, and select Show in toolbar.

LastPass autofill not working

If your LastPass autofill is not working, you may need to enable it in your Preferences. To do that, follow these steps:

1. Go to your browser, and click on the inactive LastPass icon.
2. Provide your username and master password.
3. Click Log In. You should now see an enabled LastPass icon that is now in red.
4. Go to Account Options > Extension Preferences.
5. Enable Automatically Fill Login Information.
6. To confirm, click Save.

Best alternatives to LastPass

Overall, LastPass is a go-to password manager when you need a high-quality product that is free. However, if for some reason it doesn’t tick all the right boxes for you, find some reliable alternatives to this product.

1Password

1Password is a user-friendly password management tool emphasizing on security and comfortable cross-platform use. The provider offers intuitive apps for all popular operating systems, browser extensions for Chrome, Firefox, Edge, Brave, and Safari, as well as a browser version.

Apart from flexible compatibility, this password manager ensures unbreakable protection using the AES-256 encryption cipher, MFA, and Security Keys feature that creates the primary layer of security for your vault. If you store any susceptible items, you can hide them in selected countries with the Travel Mode feature. At the same time, the Privacy cards feature will help you get into your banking accounts safely.

Read more: 1Password review

Try 1Password

NordPass

Whether you're looking for a service to securely store or sync your credentials across devices, NordPass ticks all the boxes. Your vault is protected with military-grade encryption, so no one will be able to just sift through your passwords. Yet, the versatility of this tool means that you'll be able to access the same vault on any device of your choice. Leave iOS-macOS limitations behind.

There are more nice extras like OCR scanning for IDs, so you won't have to type in that data on your browser. Then, there's a Data Breach scanner that alerts you if your password ends up in a leak. This is a full suite aimed at protecting your credentials and everything in-between.

Read more: NordPass review

Try NordPass

RoboForm

If you want a safe and secure password manager that is also easy to use, RoboForm is for you. It is equipped with both industry-standard, super-secure AES-256 encryption, and multi-factor authentication to keep all your credentials inaccessible to anyone but you. It also includes features such as a password generator, secure sharing, and dark web monitoring, making navigating the online space more manageable and safer. One of the best things about RoboForm is that it is really affordable, too.

Read more: RoboForm review

Try RoboForm

Bottom line

LastPass is one of the most widely used password managers available on the market today. Security is one of its main appeals. The tool uses AES-256 encryption, the golden standard of the industry. It also offers two-factor authentication and multi-factor authentication, which makes the app as secure as you want it to be.

There are also out-of-the-box features that include One-Time Passwords and the possibility to restrict the app’s usage in different countries. Meanwhile, Credit Monitoring will let you know if your credit report suddenly changes. These and other features will let you feel completely safe.

Even if you decide to stick with a free version, you get more than enough features to keep your usernames and passwords well protected. If you decide to upgrade, your options expand even further, as described in this LastPass review.

Best password manager deals this week:

4.9 /5

★ ★ ★ ★ ★

Special deal

-42% OFF

Get special deal

4.8 /5

★ ★ ★ ★ ★

Special deal

-50% OFF

Get special deal

4.6 /5

★ ★ ★ ★ ★

Special deal

-50% OFF

Get special deal

More password manager reviews from CyberNews

Zoho Vault review: great password management solution for multiple users

1Password vs. LastPass: how do these password managers compare?

Bitwarden review: password manager both for personal use and organizations

FAQ