LastPass
Capability scores
Methodology →- Authentication
- 3.5
- SSO & Federation
- 4.0
- Authorization
- 3.0
- Lifecycle & Provisioning
- 3.0
- MFA & Passwordless
- 3.5
- Governance & Audit
- 3.5
- Developer Experience
- 3.0
- Deployment Flexibility
- 3.5
- Pricing Transparency
- 4.0
- Support & Ecosystem
- 3.5
Scored 0–5 against a published rubric. Independent analysis, no vendor sponsorship.
Overview
LastPass is a long-established password manager dating to 2008, now operating as a standalone company. It offers consumer and business plans with broad platform coverage, SSO, and admin controls, and retains a large installed base.
What it is good at
Platform breadth is genuine: clients across every major OS and browser, mature SSO and directory integrations on business tiers, and admin policies that scale to mid-market and enterprise. The large user base means abundant documentation and community knowledge, and migration tooling is well-trodden. For organizations that simply need broad coverage and are weighing the risk consciously, the tooling itself remains mature and feature-complete.
Where it falls short
LastPass suffered significant, widely reported security breaches, and many security teams now weigh it cautiously or exclude it outright on that basis. It is closed-source and cloud-only, so buyers cannot independently verify the code, and the breach history makes vault re-encryption and master-password hygiene a real consideration for existing users. Buyers should also note the historical changes to free-tier device limits, which pushed many users to paid plans or competitors.
Pricing
Per-user business subscriptions and consumer tiers. Evaluate the total picture, including migration cost, with the TCO calculator.
Best for, and who should look elsewhere
Choose LastPass mainly for continuity if you are an existing customer comfortable with its security posture. If past breaches are a dealbreaker, consider Bitwarden, NordPass, or Dashlane instead.
Bottom line
A widely used manager carrying breach-history baggage that every buyer should weigh deliberately.
Breaches involving LastPass
Incidents in our sourced breach database where LastPass was the abused surface or the path in. Inclusion is not a judgement on the product: most record stolen credentials, tokens or misconfiguration on the customer side, and each record says which.
- LastPass customer vault backup theft via engineer credentials and trusted device cookie 2022 · Stolen credentials
LastPass comparisons
More Password Management vendors
All Password Management →- 1Password4.5/5
- Bitwarden4.4/5
- Dashlane4.1/5
- NordPass4/5
- Proton Pass4/5
Related on Start with Identity
- Comparisonlastpass-vs-1password
A migration guide, not a verdict on character. What LastPass disclosed in 2022, what it has changed since, and what to do with your vault if you move to 1Passwo
- CVESMB Server Kerberos reflection via Ghost SPNs
October 2025 follow-on to CVE-2025-33073. SMB Server elevation of privilege by combining Kerberos reflection with Ghost SPNs and DNS self-registration.
- CVEWindows SMB Client improper authentication (tampering)
Windows SMB Client improper authentication (CWE-287) that allows tampering. Not an Entra token bug, but it sits in the same Microsoft identity-adjacent patch tr
- CVEWindows SMB Kerberos reflection elevation of privilege
Kerberos authentication reflection on SMB, still abusable via Ghost SPNs after the first fix. High-severity elevation of privilege on Windows.
- Vendor1Password
top_tier
- Comparison1Password vs Bitwarden: 2026 Pricing and Verdict
1Password vs Bitwarden in 2026: Business at 8.99 vs Teams at 4 dollars per user, checked 5 Nov 2026. Polish and dev tooling vs open source and self-hosting.
By SWI Community Team · Last evaluated 2026-06-19
Independent, community-driven analysis. No vendor sponsorship. Compiled from public research and community input and verified on a best-effort basis, so details may be incomplete or out of date. Scores are opinions, not advice. Trademarks belong to their owners; mention does not imply affiliation or endorsement. See the full disclaimer, or send corrections to community@startwithidentity.com.