LastPass

LastPass was once the default password manager recommendation on tech blogs. In 2026 it is a cautionary review: the product still works as a vault, but past security incidents, a constrained free tier, and stronger rivals mean most individuals choosing fresh should pick Bitwarden, 1Password, or Keeper instead. This piece is still fair to people who must use LastPass at work, and to anyone mid-migration who needs a clear exit plan rather than panic.

Quick verdict

LastPass earns 3.7 / 5. Competent enough as mandated workplace software; a poor default for new personal security setups in 2026. If you are on LastPass Free and hitting device limits, migrate rather than grudgingly upgrading out of inertia. If your employer requires LastPass Business, use it professionally—strong unique master password, MFA, no password reuse—while keeping a personal vault elsewhere for non-work life.

STA score context: feature checklist is fine; trust and competitive value are why the score sits in the high-3s instead of the mid-4s.

What is LastPass?

LastPass is a cloud-synced password manager with browser extensions, desktop apps, and mobile clients. It stores encrypted credentials, form-fill data, secure notes, and (on paid tiers) extras such as emergency access and advanced MFA options. LastPass Free still exists but is intentionally limited compared with Bitwarden’s free tier—historically including a split between computer-type and mobile-type device access that frustrates people who live on a laptop and a phone.

Business and enterprise SKUs add admin consoles, policies, SSO integrations, and shared folders for teams that standardized on LastPass years ago. That install base is why LastPass remains relevant: migration is a project, not a weekend toggle, for large orgs.

What LastPass is not in 2026: the clear consumer leader, our editors’ choice, or a brand we lead with when a friend asks “what should I install tonight?”

The trust problem (why this review is cautious)

Security products are bought on features and kept on trust. LastPass’s public incident history—including the well-known 2022 breach chain and related disclosures about stolen vault data backups and subsequent credential-stuffing risk for customers with weak master passwords—changed the market. Even if you believe current engineering is improved (and vendors will argue exactly that), many practitioners permanently re-ranked LastPass below Bitwarden, 1Password, and Keeper for personal recommendations.

Honest framing:

• Encrypted vault theft is not the same as plaintext password publication—but offline cracking risk against weak master passwords is real.
• If you stayed on LastPass after those events, you should have already used a long, unique master password, enabled MFA, and rotated high-value credentials. If you did not, do that before anything else—or migrate and rotate.
• New users have no obligation to “give them another chance” when alternatives are excellent.

We are not claiming LastPass is unusable malware. We are saying trust debt is a product attribute, and it correctly lowers the score.

Core features that matter (fair coverage)

1. Vault, generator, and autofill

Day to day, LastPass still does the job: generate strong passwords, save logins, autofill in browsers, and sync to mobile. Autofill quality is acceptable on mainstream sites and occasionally clumsy on custom SSO pages—the same industry tax everyone pays. If you only evaluated the fill button on a calm Tuesday, you would think the category was fine. The competitive gap appears in pricing fairness, free-tier honesty, and brand confidence.

2. Free tier limits

LastPass Free is the opposite of Bitwarden Free’s generosity. Device-type restrictions and feature gates are designed to upsell Premium. That is a valid business model; it is a bad model if you are trying to improve security for a relative who will not pay. For those users, Bitwarden Free is the ethical default.

3. Premium, Families, and emergency access

Paid personal tiers restore multi-device freedom and unlock extras such as emergency access, advanced MFA options, and priority support packaging (confirm the live matrix). Families plans cover household sharing. None of this is unique anymore—1Password and Bitwarden Families compete directly, often with clearer trust narratives.

4. Sharing and business admin

Shared folders and granular permissions exist. Business admins can enforce MFA, manage deployments, and run the usual onboarding/offboarding plays. If your company already pays for LastPass and has policy hooks into it, ripping it out requires change management. That is a reason to operate LastPass carefully—not a reason for a household to choose it over Bitwarden.

5. Dark web monitoring and security dashboard

Like rivals, LastPass surfaces weak/reused passwords and offers monitoring-style features on certain plans. Use the dashboard as a chore list. Do not treat a green score as absolution if your master password is short or MFA is off.

6. Passkeys and modern auth

LastPass continues to ship passkey-related capabilities as the web moves beyond passwords. Treat passkeys as additive hygiene, keep recovery codes, and do not assume every bank RP behaves identically across managers.

Hands-on / lab notes

Task	Result
Daily autofill on major sites	Works; occasional site-specific friction
Free tier as phone + laptop daily driver	Frustrating under modern free limits—migration trigger
Export vault	Available; protect the export file like cash
Import into Bitwarden / 1Password / Keeper	Straightforward; budget cleanup time
Business-shared folders	Fine operationally; review membership quarterly
MFA on LastPass account	Mandatory in our book—security keys preferred where supported
Post-incident hygiene	Rotate email/IdP/bank first if you never did after past events

If work forces LastPass: create work-only habits. Do not store personal banking in the corporate vault if policy and practical separation allow a personal manager. Use SSO where the company provides it. Never share your master password with a coworker “just this once.”

If you are leaving LastPass personally: export → import to destination → enable MFA on the new vault → rotate crown jewels (email, Apple/Google/Microsoft, bank, government) → only then delete browser copies and close the old account. Keep the LastPass account open read-only for a week in case a rare login was missed.

Pricing and editions

Plan	Role in 2026	STA note
Free	Limited personal use	Prefer Bitwarden Free instead for new users
Premium	Multi-device personal unlock	Compare total cost to Bitwarden Premium (~$10/year class) before renewing
Families	Household sharing	Bitwarden/1Password Families usually compete hard
Business / Enterprise	Mandated work vaults	Operate well; evaluate migration programs separately

Price alone never redeemed trust issues. If Premium is “only a few dollars more than Bitwarden,” still prefer Bitwarden unless you have a specific LastPass-only constraint.

Who should use it?

Use LastPass if you:

• Are required to by employer or school and cannot choose the vault
• Are mid-migration and need continuity for another sprint
• Already paid annually and will migrate at renewal (set a calendar reminder)

Do not choose LastPass as a fresh personal vault if you:

• Want maximum trust + value → Bitwarden (editors’ choice)
• Want premium consumer polish → 1Password
• Want business-ready proprietary vault without LastPass history → Keeper
• Need a truly usable free multi-device manager → Bitwarden Free

Alternatives to consider (migration targets)

Alternative	Best when
Bitwarden	Default recommendation for most US/UK individuals and families
1Password	You want polished UX and will pay for it
Keeper	Business controls and commercial security packaging matter
Dashlane	You prefer that suite’s paid extras and accept higher cost
Browser-only (Chrome/iCloud)	Temporary bridge only—not a long-term security strategy

Migration playbook (personal)

Evening 1: Pick Bitwarden, 1Password, or Keeper. Create the account; turn on MFA before import.
Evening 2: Export from LastPass; import; spot-check 20 important sites.
Evening 3: Change passwords for email + Microsoft/Google/Apple + banking + payroll.
Evening 4: Install mobile autofill; disable LastPass autofill to stop dual-prompt hell.
Weekend: Cancel LastPass auto-renew if you will not need it; keep export encrypted offline until you are confident. Wipe the export from Downloads when done.

Companies need a longer program: SSO inventory, shared folder owners, contractor access, and helpdesk scripts. Do not “surprise migrate” 400 employees on a Friday.

Final score: 3.7 / 5

LastPass remains a functional password manager with broad platform coverage and real business deployments. It is no longer a product we recommend for greenfield personal security. Past incidents, free-tier friction, and better-priced trusted rivals put it in “use if you must, migrate if you can” territory. If you are still on a weak master password inside LastPass, fix that today—whether you stay for work or leave for Bitwarden tonight.

FAQ

Is LastPass safe to use in 2026?
It can be operated safely with a long unique master password and MFA, especially under business mandate. For optional personal use, we recommend migrating to Bitwarden, 1Password, or Keeper because trust and competition moved on.

Why is your rating only 3.7?
Features are adequate; trust history and free-tier/value positioning versus Bitwarden drag the score. We score products for readers making a choice—not for nostalgia.

Is LastPass Free worth it?
Usually no, if you need phone + computer every day under restrictive free rules. Bitwarden Free is the better free vault.

Should I change passwords after past LastPass incidents?
If you never rotated high-value credentials after those events—or if your master password was short/reused—yes. Prioritize email and financial accounts.

Can I export my LastPass vault?
Yes. Guard the export file; delete it securely after a successful migration.

LastPass vs Bitwarden?
Bitwarden wins for most personal users on trust narrative, open source, and price. LastPass wins only when an organization forces it.

LastPass vs 1Password or Keeper?
Prefer 1Password or Keeper over LastPass for new paid personal or many business greenfield evaluations—run a pilot, but start from the stronger trust baselines unless LastPass is already entrenched.