# lastpass-vs-1password Source: https://startwithidentity.com/compare/lastpass-vs-1password/ Last updated: 2026-07-24 License: content by Start with Identity. Cite the source URL. --- ## The honest comparison Most people reading this page are already on [LastPass](https://startwithidentity.com/vendors/password-management/lastpass/) and deciding whether to move. So this is a migration guide, and it starts with what LastPass published itself rather than with adjectives. In August 2022, LastPass disclosed that a threat actor had accessed its development environment and taken source code and technical information. In November and December 2022 it disclosed a second, linked incident: using information from the first, the actor reached a third-party cloud storage service and took basic customer account data along with a backup of customer vaults. In LastPass's own [notice of the security incident](https://blog.lastpass.com/posts/notice-of-recent-security-incident), that backup contained unencrypted fields such as website URLs alongside encrypted fields including usernames, passwords, secure notes, and form-fill data, each protected by a key derived from the user's master password. LastPass cited 100,100 rounds of PBKDF2 at the time; researcher Wladimir Palant [documented in December 2022](https://palant.info/2022/12/28/lastpass-breach-the-significance-of-these-password-iterations/) that many older accounts had been left on far lower counts, commonly 5,000 and in some cases 500 or 1, because the 2018 increase in the default was not applied retroactively. Its published security model now states 600,000 rounds. What changed since is also on the record. LastPass rebuilt the development environment, rotated credentials and certificates, added logging, alerting, and endpoint detection, separated development from production, and [completed its separation from GoTo](https://www.lastpass.com/company/newsroom/b948ad48-3268-4c9e-8b45-0d6d02d0b4e7) on 1 May 2024 to run as an independent company. Our scores are not close: LastPass 3.4 overall against [1Password](https://startwithidentity.com/vendors/password-management/1password/) at 4.5, with 1Password ahead on six of the ten dimensions we grade. LastPass is not beaten everywhere, though. It edges 1Password on deployment flexibility, reflecting client coverage across every major operating system and browser, and the two tie on three dimensions: federation, authorization, and pricing transparency. ## When LastPass wins - You are an existing tenant, the credential rotation is already done, and the migration cost is real work you would rather not repeat - Admin policies, directory integration, and SSO are configured and running across a mid-market estate - Client and browser coverage is the binding requirement, which is the one dimension where it out-scores 1Password - Your risk assessment has been done deliberately and signed off, rather than assumed by inertia ## When 1Password wins - You are making a fresh decision and have no switching cost to defend - Your security team wants a vendor with no customer-vault exfiltration in its history, and that is a hard filter - Developer secrets, a command line tool, an SSH agent, and device trust at sign-in are on the requirement list - You want the higher score on authentication, governance, support, and developer experience, which is most of the matrix ## Pricing Both publish prices and both score 4.0 on pricing transparency, so the decision is not made here. LastPass sells per-user business subscriptions and consumer tiers; 1Password sells per-user tiers with no permanent free option. The cost that actually matters in a migration is not the subscription. Exporting a vault takes an afternoon; re-issuing the credentials that were in it does not. Budget that rotation work explicitly, and model seats in the [TCO calculator](https://startwithidentity.com/tools/tco-calculator/). ## Verdict If you are choosing from scratch, [1Password](https://startwithidentity.com/vendors/password-management/1password/) is the stronger product on nearly every axis we grade, and the recommendation is not close. If you are an existing [LastPass](https://startwithidentity.com/vendors/password-management/lastpass/) customer, the honest answer is more measured: the tooling is mature, the company has published what it changed, and a planned migration with credential rotation beats a panicked one. What is not defensible is staying without rotating, because the 2022 vault copy is outside everyone's control permanently. For the open-source and self-hosted alternative see [1Password vs Bitwarden](https://startwithidentity.com/compare/1password-vs-bitwarden/), and for how stolen credentials get used afterwards see our teardown on [infostealers and session hijacking](https://startwithidentity.com/breaches/infostealer-session-hijacking/).