LastPass
The veteran password manager with 33 million users, still carrying its 2022 breach history.
About
LastPass is one of the longest-running password managers, claiming over 33 million users. Vaults use AES-256 encryption with a zero-knowledge design, and the feature set is complete: unlimited password storage, dark-web monitoring, MFA, a password generator, and passkeys on supported platforms. Paid plans start at $3 per month for Premium, $4 per month for Families (six users), and $4 per user per month for Teams, with a 30-day Premium trial. The free plan is restricted to one device type, desktop or mobile, which is a demo more than a usable tier.
The trust story dominates any LastPass evaluation. Two breaches in 2022 exposed encrypted vault backups, and unencrypted metadata such as URLs was included, which regulators were still pricing in through 2025 and 2026, including an ICO fine. LastPass reports that it has since hardened its infrastructure and maintains SOC 2 Type II attestation, audited by RSM US LLP, and a 2026 comparison put its G2 rating at 4.5 out of 5 across roughly 2,090 reviews. Reviewers still rate it well on features and price, but the breach history is the deciding factor for most buyers choosing between LastPass and its rivals.
What it can do
- AES-256 zero-knowledge encrypted vault
- Unlimited password storage on all plans
- Dark-web monitoring and security dashboard
- Multifactor authentication options
- Passkey support on supported platforms
- Password generator and autofill
- Emergency access for trusted contacts
- SOC 2 Type II attested, audited by RSM US LLP
Setup
Create a free account at lastpass.com, install the browser extension and mobile apps, and import from your browser or another manager. Upgrade to Premium for cross-device sync, dark-web monitoring, and emergency access.
Prerequisites
A paid plan for syncing across device types; the free plan is limited to one device type.
Use cases
Works with
Trust score — 6/10
Scored 6/10 (metrics tier, metrics-v1). Evidence: multiple 2026 reviews confirm 33M+ users, $3 Premium / $4 Families / $4 Teams pricing, the device-type-restricted free plan, AES-256 zero-knowledge design, SOC 2 Type II attestation, and the 2022 breaches plus the ICO fine and June 2026 third-party Klue exposure noted in a 2026 comparison. Strengths: full feature set at a low price, huge installed base, familiar UX. Docked for: (1) the 2022 breaches exposed encrypted vaults and unencrypted metadata, and regulatory fallout continued into 2026; (2) the free tier is crippled by device-type limits; (3) passkey support is described as limited versus rivals. License: proprietary.
How the trust score is built
Full methodology →- Adoption · stars/downloads, log-scaled vs peers
- 10.0/10
- Maintenance · recency, releases, issue load
- 8.0/10
- Openness · license + docs
- 3.0/10
- Manual review · sanity read + red-flag check
- 6.0/10
- · 33M+ users claimed (provider-stated); G2 4.5/5 across ~2,090 reviews (Sept 2026); owned by LMI Parent, L.P. (Francisco Partners / Elliott Management)
- · 2022 breaches exposed encrypted vault backups and unencrypted metadata; ICO fine and June 2026 third-party Klue exposure noted in 2026 comparisons
- · Premium $3/mo; Families $4/mo (6 users); Teams $4/user/mo; free plan limited to one device type; SOC 2 Type II attested (auditor RSM US LLP)
Sources
Every fact above was checked against these sources. Where a claim comes from the provider and couldn't be independently verified, the text says so.