LastPass offers a genuinely capable password management utility with solid autofill, secure sharing, and dark web monitoring, but its past security incidents mean it now has to work harder than most competitors to earn users’ trust. Judged purely on features, it’s strong; judged on trust history, it’s a more cautious recommendation.
★★★☆☆ 3.6 / 5 — Reviewed by Foremy Team
Password managers are one of the more sensitive categories of utility software, since you’re trusting a single vault to hold the keys to nearly every account you own. LastPass has long been one of the most recognizable names in the space, but a series of publicized security incidents in recent years has made “should I still trust LastPass?” a genuinely common question. This review looks at both the feature set and the trust question honestly.
What Is LastPass?
LastPass is a password management utility that stores login credentials, payment card details, and secure notes in an encrypted vault, then autofills them across browsers and mobile apps. Beyond basic password storage, it includes a password generator, security dashboard that flags weak or reused passwords, dark web monitoring, and secure sharing for families or teams.
As one of the earliest mainstream password managers, LastPass helped popularize the idea that ordinary users — not just security professionals — should be using unique, randomly generated passwords for every account rather than reusing a handful of memorable ones across dozens of sites. That popularization matters when evaluating the current product, because it means LastPass is competing against a market it helped create, now populated with competitors that, in some cases, were built more recently with fewer legacy security concerns to account for.
Key Features
- Vault & Autofill: Stores logins, cards, and notes, and autofills them across desktop browsers and mobile apps.
- Password Generator: Creates strong, random passwords with adjustable length and character rules.
- Security Dashboard: Scores your overall password health and flags weak, reused, or old credentials.
- Dark Web Monitoring: Alerts you if an email address tied to your vault turns up in a known data breach.
- Secure Sharing: Share individual logins with family members or teammates without revealing the plaintext password.
- Multi-Factor Authentication: Supports authenticator apps and hardware security keys for vault access.
Hands-On Testing
Setup was straightforward: importing passwords from a browser’s built-in manager took only a few minutes, and the browser extension correctly detected and offered to save new logins during everyday browsing across the sites we tested. Autofill accuracy was solid, correctly matching stored entries to their corresponding login forms even on sites with non-standard form layouts.
The security dashboard’s password health scoring was useful and actionable, clearly highlighting reused and weak passwords with one-click prompts to generate stronger replacements. Secure sharing worked as expected when tested between two accounts, delivering the credential without ever exposing the raw password in an email or message.
On the trust side, it’s worth being direct: LastPass experienced significant, well-documented security incidents in the past that exposed encrypted vault data to attackers. The company has since made changes to its encryption and security practices in response, and no widespread evidence of successfully cracked vaults from those incidents has emerged publicly. Still, for a password manager specifically, past incidents like these matter more than they would for almost any other utility category, and it’s a factor every prospective user should weigh for themselves rather than take lightly.
Tips for Getting the Most Out of LastPass
Set a strong, unique master password that you don’t reuse anywhere else, and enable multi-factor authentication on the account itself — since the master password is the single point of failure for the entire vault, it deserves more care than any individual stored password.
Run the security dashboard’s password health check shortly after importing your existing logins, and work through the reused and weak password list a few at a time rather than all at once — replacing dozens of passwords in one sitting is a common reason people abandon the process halfway through.
Take advantage of secure notes for sensitive information beyond passwords, such as software license keys or important account recovery codes, rather than storing them in plain text files or unencrypted notes apps elsewhere on your device.
If you decide to move away from LastPass at any point, most competing password managers offer a straightforward import tool for LastPass-exported vaults, which makes switching providers considerably less painful than manually re-entering every credential by hand.
Pricing & Plans
| Plan | Best For | Key Additions |
|---|---|---|
| Free | Single device basic use | Vault, autofill, password generator |
| Premium | Multi-device individual use | Cross-device sync, dark web monitoring, priority support |
| Families / Teams | Households or small organizations | Multiple licenses, shared folders, admin controls |
Pros and Cons
Pros
|
Cons
|
Who Should Use LastPass?
LastPass still works well for users who prioritize a polished, easy-to-use interface and are comfortable with the company’s post-incident security changes. Families and small teams may also appreciate the sharing and multi-license options. That said, highly security-conscious users, or anyone specifically shopping for a password manager with a completely clean incident history, may prefer to weigh alternatives before committing their entire credential vault to any single provider.
Existing long-time users who already have a large vault built up also face a practical consideration beyond pure feature comparison: migrating hundreds of saved logins to a different provider takes real time and effort, which is part of why many current users choose to stay, provided they’ve made peace with the platform’s history, rather than start the process over elsewhere.
How It Compares to Alternatives
Against newer password managers built with a security-first reputation from day one, LastPass’s feature set is genuinely competitive — the autofill accuracy, security dashboard, and sharing tools tested well in our hands-on use. The differentiator for many users comes down entirely to the trust question: competitors without a publicized breach history start the comparison with an advantage that LastPass has to work to offset through its feature depth and free-tier availability.
Compared to browser-built-in password managers, LastPass offers meaningfully more functionality: cross-browser syncing, a dedicated security health dashboard, dark web monitoring, and secure sharing options that most built-in browser tools still lack. The trade-off is trusting a third-party vault rather than relying on your browser vendor’s more limited but narrower-scope tool.
Against open-source, self-hosted password manager options, LastPass is considerably easier to set up and use, with no server maintenance required on the user’s part. Users who prioritize full control over where their encrypted vault is hosted may still prefer a self-hosted approach despite the added setup complexity.
Frequently Asked Questions
Is it safe to use LastPass after its past security incidents?
The company has made changes to its encryption and security architecture since those incidents, and no widespread evidence of successfully decrypted vaults has surfaced publicly. That said, it remains a personal risk decision each user should make with the history in mind.
What happens if I forget my master password?
Because your vault is encrypted with your master password, losing it typically means losing access to your stored data — LastPass cannot recover it for you, which is standard across zero-knowledge password managers.
Does the free tier still sync across devices?
Recent free-tier changes have restricted syncing to a single device type at a time; multi-device syncing now requires a paid plan.
How does dark web monitoring work?
LastPass checks email addresses tied to your vault against known breach databases and alerts you if a match turns up, prompting you to change the affected password.
Can I share passwords with family members securely?
Yes, the secure sharing feature lets you share individual logins without ever exposing the plaintext password to the recipient directly.
Does LastPass work across different browsers and devices?
Yes, the browser extension and mobile apps sync through the encrypted vault, so credentials saved on one device become available on others, provided you’re on a plan that includes multi-device sync.
What’s the difference between the security dashboard score and dark web monitoring?
The security dashboard evaluates the passwords already stored in your vault for weakness and reuse, while dark web monitoring separately checks whether your email addresses have appeared in known third-party data breaches.
Final Verdict
On features alone, LastPass remains a capable, well-rounded password management utility with strong autofill, a genuinely useful security dashboard, and flexible sharing options. The asterisk on this review is trust: password managers live and die on the confidence users place in them, and LastPass’s past incidents mean it now has to earn that confidence back rather than assume it. We’d recommend it primarily to users who’ve made an informed decision about that history, rather than as a default first choice.
| Category | Score |
|---|---|
| Features | ★★★★★ |
| Ease of Use | ★★★★☆ |
| Trust & Security History | ★★☆☆☆ |
| Value for Money | ★★★★☆ |
| Overall | 3.6 / 5 |