LastPass Review: Is It Worth Using After the 2022 Incident?

LastPass can still manage passwords, AutoFill, and family sharing, but we would choose Bitwarden first for a new personal vault because LastPass’s 2022 vault-backup theft remains a material trust issue. An existing LastPass user should review their master-password strength, high-value credentials, current plan, and recovery setup before deciding to stay or move. This LastPass review separates documented incident facts from current product features, then gives a way to use or leave it safely. It does not claim a fresh hands-on rating or invent customer testimonials.

1. The security history you should know first

LastPass disclosed that an attacker obtained a backup of customer vault data during its 2022 incident. Its notice described encrypted sensitive fields, including usernames and passwords, alongside some unencrypted information such as website URLs. The company later published an incident update with recommended actions and has described subsequent security changes. An encrypted stolen vault is not the same as a plaintext dump, but it is also not an event a password-manager buyer should ignore.

The LastPass incident also highlights why encrypted vault data and readable passwords are not the same thing. Our guide explaining what zero-knowledge encryption means covers client-side encryption, key protection, server breaches, and the limits of encryption when an attacker obtains a vault backup.

Why the master password matters here

The risk of an attacker guessing an encrypted vault depends in part on how strong and unique the master password was and on the vault’s specific configuration at the time. An online second-factor prompt does not prevent offline attempts against a copied encrypted backup. Review LastPass’s official incident guidance and any account-specific communication. Prioritize a long, unique master passphrase and consider changing sensitive service credentials according to your exposure assessment.

A strong master password is especially important when an attacker may have a copy of encrypted vault data and can attempt password guesses offline. Our guide on how to create a strong master password explains how to build a long, unique passphrase and avoid predictable patterns or reused credentials.

Avoid two false conclusions

“Every LastPass password was exposed in plaintext” overstates the company’s disclosure. “Encryption means there is nothing to consider” understates a long-lived risk. You may also need to review unencrypted metadata, secure notes, or secrets that were not ordinary website passwords. If your vault held API keys, recovery codes, or other critical information, treat those as separate rotation tasks at their issuing services.

2. What LastPass still does well

LastPass offers a familiar browser-based vault, password generation, AutoFill, secure sharing, emergency-access options, and family plans with separate member vaults, depending on the plan. For a long-time user, the most immediate benefit is that saved logins already exist and work on known devices. A costly migration can introduce mistakes if rushed. The decision to stay can be reasonable if you understand the incident, take the recommended steps, and find the current service fits your needs.

Everyday save and fill

The core workflow is straightforward: install the official extension or app, save a site’s login, generate a unique password for a new account, and fill it on return. Test the current version on your main browser and phone. If the browser’s own manager is also saving credentials, choose one primary destination for new changes. A stale duplicate is a practical risk even when both products are functioning correctly.

Whether you use LastPass or another password manager, the most important everyday habits are saving the correct login, generating unique passwords, and testing AutoFill on your devices. Our guide on how to use a password manager walks through these steps and explains how to avoid duplicate or outdated vault entries.

Family and emergency options

LastPass Families describes individual private vaults and sharing between members. Emergency access can let a trusted person obtain access under configured conditions on eligible plans. This is valuable only when you set it up before an emergency and understand its scope. A shared streaming credential should not require revealing a parent’s entire vault or master password.

3. The limitations that affect a new buyer

LastPass’s free-versus-premium material describes access across device types as a Premium benefit. A signup may start with a premium trial, so evaluate what remains after it ends. Current terms can change. We would not select a permanent password vault from the first 30 days of a trial without checking its lasting capabilities.

A current user may face a different calculation. Their entire family already knows the sharing system, recovery contacts are configured, and switching may take hours of verification. Remaining on LastPass after an informed assessment is not the same as ignoring the incident. Conversely, sunk effort is not a reason to keep a product that no longer meets your trust or plan requirements. Write down the concrete reason to stay and the concrete reason to move, then test the alternative before any irreversible cleanup.

4. LastPass pros and cons in context

Pros

An established vault and browser workflow can reduce the effort of starting. The product provides password generation, AutoFill, and plan-based sharing and emergency options. A household already using Families may have a coherent private/shared setup. These are real conveniences; migrating merely to make a symbolic statement can distract from changing reused or sensitive service passwords.

Cons

The incident creates a distinct trust burden and possible credential-rotation work for affected users. Free device-type restrictions may be inconvenient for a new phone-and-laptop user. Recovery and plan boundaries need careful reading. Some users will reasonably prefer a different provider even after LastPass’s changes; trust is part of a security product’s usability because it affects whether you will keep using it consistently.

The service’s breadth can also obscure where a family item lives: private vault, shared folder, or another member’s account. During a trial, ask a second person to find and fill one low-risk shared item while confirming they cannot see your private email. If that fails, simplify permissions. A family feature only improves security when members stop falling back to messages and screenshots.

Who it suits

An existing customer with a well-protected account, completed incident response, and a plan that meets their family or business needs may decide to stay. A new individual user seeking a free independent vault across phone and desktop has a stronger first trial in Bitwarden. A user who wants a local file with no service account should consider KeePassXC instead.

5. How to use LastPass carefully today

Protect the vault account

Use a long master passphrase that is not a variation of another password. Enable the available multifactor method and store its recovery material separately. Check trusted devices, account email, and recovery options through the official site or app rather than a link in an unexpected message. LastPass has warned about phishing attempts requesting master passwords; support will not need you to disclose yours in an email.

Your LastPass account’s recovery email is also part of your security setup. If someone gains unauthorized access to that inbox, they may be able to interfere with account notifications or recovery workflows. Our guide on how to secure your email account explains how to strengthen sign-ins, review recovery settings, and detect suspicious activity.

Save and verify a new credential

Open a low-risk service through a trusted bookmark. Generate a unique password using LastPass, submit it, confirm the vault saved the correct URL and username, then sign out and fill it again. Try the installed phone app as well as a browser tab. If AutoFill does not appear, check the active provider and matching rather than pasting into an unfamiliar page.

Review high-value entries

Identify primary email, cloud account, financial services, domains, and any account whose recovery can unlock others. Check for reuse, outdated credentials, and old recovery methods. If rotation is needed, change each password at the service and verify the new one in the vault. Updating a vault entry alone does not change the account’s actual password.

Prioritize by what an account can control rather than by how often you use it. A rarely visited domain registrar, phone carrier, or cloud backup may reset other services. Check active sessions after a sensitive change because a password reset does not always invalidate every logged-in device. Keep a list of account names and completion status, not the new secrets. This makes a thoughtful response possible without creating another plaintext password file.

6. If you decide to migrate

Plan the move before canceling. Follow LastPass’s official export instructions and the destination provider’s importer. A CSV export may contain readable passwords; use a trusted device and remove the file after verifying. Keep the source vault available until the destination can sign into important services. Notes, attachments, passkeys, one-time-code seeds, and sharing permissions need individual checks.

A safe order

First, trial the new manager with a few low-risk records. Second, import the collection and inspect duplicates. Third, verify primary email and recovery accounts. Fourth, rotate any sensitive service password your incident assessment flags, saving the new value in the new vault. Finally, secure the new manager, rehearse access on a second device, and end the old plan after you no longer depend on it.

What moving cannot undo

An export into a new provider does not erase any historical stolen encrypted backup, nor does it change a password at a website. It can improve future fit and trust. For past exposure, changing the underlying credentials, revoking sessions where appropriate, and replacing other secrets may be needed.

7. How to interpret LastPass user reviews

Ratings from before 2022 reflect a different trust context; a single recent review may be about a browser bug or a plan change on one device. Neither should substitute for the company’s incident notices and your own trial. Look for current reports from people with the same operating system and plan, then try the exact tasks they discuss. User sentiment can reveal friction, but it cannot establish whether an encrypted vault was safe for your historical master password.

If the most important complaint for you is repeated AutoFill failure, compare that workflow with an alternative using a low-risk account. If it is the security history, review official disclosures, your own vault age, and the passwords you have rotated. The decision should end in a set of actions, not a star rating.

8. Better alternatives for specific needs

Bitwarden is our general alternative for a new individual user. The others solve narrower needs. Do not replace one trust problem with an untested recovery problem: run the new manager on your actual devices before committing.

9. Second factors and phishing remain relevant

Use passkeys or security keys for important services when available; they can resist phishing better than a password plus typed one-time code. TOTP codes still provide a useful extra barrier if a service supports them, with backup codes for device loss. An authenticator app has a different job from LastPass’s password vault. Authenticator App’s setup information is at and its supplied iPhone listing is . Do not claim it can import a LastPass vault.

10. Frequently Asked Questions

Is LastPass safe to use in 2026?

It remains a functioning password manager with security controls, but the 2022 incident warrants an individual trust and exposure review. We recommend a new personal user trial Bitwarden first. Existing users should follow current LastPass guidance and protect underlying accounts.

Were LastPass vaults stolen?

LastPass disclosed theft of a backup of customer vault data. It described encrypted sensitive fields and some unencrypted metadata, including website URLs. Read the official incident notice and later update for context.

Is LastPass Free worth it?

Check current device-type access and which features remain after any premium trial. For a person needing both phone and computer without payment, Bitwarden’s current free personal offering is a clearer starting point.

Should I immediately delete LastPass?

Do not delete the only working copy of your logins. Inventory sensitive accounts, plan a verified migration if desired, rotate credentials where needed, and secure recovery first.

Can support retrieve my master password?

Do not assume so. Review LastPass’s current recovery options and prerequisites while you still have access. A zero-knowledge model has different implications from a routine website password reset.

11. Final Thoughts

LastPass has useful vault, AutoFill, and sharing features, but its 2022 incident materially changes how a buyer should assess it. For a new individual, Bitwarden is our first recommendation. For an existing user, take the concrete steps that protect underlying accounts, then decide whether the plan and trust relationship still fit.

Make that decision reviewable for yourself: note which important passwords you changed, which recovery routes work, which plan features you use, and how a replacement device would regain access. If you choose to leave, keep the old vault until the new one passes those same checks. A careful response is more effective than a hurried deletion or a reassuring slogan.

Recheck the decision after major product or household changes. A new phone, new family member, or changed subscription can alter which manager fits. Keep unique passwords at the underlying services regardless of which vault holds them.