LastPass Review 2026
Affiliate disclosure: This article contains affiliate links. If you click a link and make a purchase, we may earn a commission at no extra cost to you. Our editorial recommendations are never influenced by commissions — read our full disclosure policy.
LastPass
LastPass still works, and the vault data stolen in 2022 stayed encrypted — but the theft exposed unencrypted website URLs and put weak master passwords at risk. Existing users can stay safely with a strong master password, a high iteration setting and MFA; new users have rivals with cleaner records at similar prices.
Best for
Existing users who are comfortable with the platform and its improved security measures
Not for
Users who prioritize security track record and trust above convenience
Prices verified April 2026. Always confirm directly with provider.
NordPass
NordPass — XChaCha20 encryption, passkey support, email masking, and a breach scanner — is a password manager you can subscribe to right now. It does not change our editorial assessment on this page.
Visit NordPassPros
- Encrypted vault fields stayed encrypted in the 2022 incident
- 12-character minimum master password since 2018, per LastPass
- Sharing and emergency access
- Free plan with a 30-day Premium trial
- Families plan for up to six people
Cons
- 2022 incident copied vault backups including unencrypted website URLs
- Free plan limited to one device type
- Trust deficit compared with rivals
- Pricing page did not display amounts when checked
LastPass Review 2026: Is It Safe After the 2022 Breaches?
LastPass works, and its encryption design means the vault data stolen in 2022 stayed encrypted — but the incident exposed unencrypted website addresses and put users with weak master passwords at real risk. If you already use LastPass, you can stay safely by following the checklist below. If you are choosing a password manager today, rivals with cleaner track records cost a similar amount, so LastPass is hard to recommend first. Facts below come from LastPass's own incident notice and pricing page, checked on 16 October 2026.
What happened in 2022, in LastPass's own words
LastPass's notice (update of 22 December 2022) says an attacker "copied information from backup that contained basic customer account information and related metadata" and was able to "copy a backup of customer vault data". That vault backup contained "both unencrypted data, such as website URLs" and "fully-encrypted sensitive fields such as website usernames and passwords, secure notes, and form-filled data".
| What was taken | State | What it means for you |
|---|---|---|
| Website URLs in your vault | Unencrypted | An attacker can see which sites you have accounts on — useful for targeted phishing |
| Usernames, passwords, secure notes, form data | Encrypted | Protected only as well as your master password resists offline guessing |
| Basic account information and metadata | From a backup | Expect convincing phishing that references LastPass |
The notice says LastPass has required a 12-character minimum master password since 2018 and described its key derivation as "100,100 iterations of the Password-Based Key Derivation Function (PBKDF2)" at the time. Accounts created earlier, or never updated, could have weaker settings.
If you still use LastPass: the checklist
1. Change your master password to a long random passphrase — see how to create a master password. 2. Check your account's password-iteration setting in LastPass's security settings and raise it if it is low. 3. Change the passwords for your most important accounts (email, banking, cloud storage), because the stolen vault copy predates today. 4. Move any crypto wallet seed phrases or recovery codes out of secure notes and change them. 5. Turn on multi-factor authentication for the vault. 6. Treat any email "from LastPass" asking you to log in through a link as suspicious.
Plans today
LastPass's pricing page lists a Free plan "limited to 1 device type" (mobile or computer) with a 30-day Premium trial, Premium for one user across all devices, Families for up to six people, and Teams and Business plans for organisations, all billed annually. Price amounts did not display when we checked, so confirm them on LastPass's site.
Features
The core features are familiar: password generation and autofill, secure notes, sharing, emergency access, a security dashboard and passwordless login options. None of them changes the decision above, which is about trust and track record rather than features.
Alternatives to consider
If you are moving, export your vault, import it into the new manager, then change your important passwords. Options we cover include NordPass, Proton Pass, and the open-source Bitwarden — compared in 1Password vs Bitwarden and Dashlane vs LastPass.
Frequently asked questions
Is LastPass safe to use in 2026?
It can be used safely with a strong master password, a high iteration setting and MFA. But its 2022 incident exposed unencrypted website URLs and encrypted vault copies, so new users may prefer a manager with a cleaner record.
What did the LastPass breach expose?
According to LastPass, a backup of customer vault data containing unencrypted website URLs and encrypted usernames, passwords, notes and form data, plus basic account information.
Is LastPass Free still usable?
It is limited to one device type — mobile or computer, not both — according to LastPass's pricing page.
Should I change my passwords if I used LastPass in 2022?
Yes, for important accounts. The stolen vault copies are encrypted, but anyone with a weak master password at the time is at risk, and changed passwords make the old copy useless.
Checked 16 October 2026: LastPass, "Notice of Recent Security Incident" (update of 22 December 2022); lastpass.com/pricing (amounts not displayed).
Reviewed by NorwegianSpark Editorial — written with AI assistance and reviewed by the NorwegianSpark SA editorial team · How we review
