LastPass
Capability scores
Methodology →- Authentication
- 3.5
- SSO & Federation
- 4.0
- Authorization
- 3.0
- Lifecycle & Provisioning
- 3.0
- MFA & Passwordless
- 3.5
- Governance & Audit
- 3.5
- Developer Experience
- 3.0
- Deployment Flexibility
- 3.5
- Pricing Transparency
- 4.0
- Support & Ecosystem
- 3.5
Scored 0–5 against a published rubric. Independent analysis, no vendor sponsorship.
Overview
LastPass is a long-established password manager dating to 2008, now operating as a standalone company. It offers consumer and business plans with broad platform coverage, SSO, and admin controls, and retains a large installed base.
What it is good at
Platform breadth is genuine: clients across every major OS and browser, mature SSO and directory integrations on business tiers, and admin policies that scale to mid-market and enterprise. The large user base means abundant documentation and community knowledge, and migration tooling is well-trodden. For organizations that simply need broad coverage and are weighing the risk consciously, the tooling itself remains mature and feature-complete.
Where it falls short
LastPass suffered significant, widely reported security breaches, and many security teams now weigh it cautiously or exclude it outright on that basis. It is closed-source and cloud-only, so buyers cannot independently verify the code, and the breach history makes vault re-encryption and master-password hygiene a real consideration for existing users. Buyers should also note the historical changes to free-tier device limits, which pushed many users to paid plans or competitors.
Pricing
Per-user business subscriptions and consumer tiers. Evaluate the total picture, including migration cost, with the TCO calculator.
Best for, and who should look elsewhere
Choose LastPass mainly for continuity if you are an existing customer comfortable with its security posture. If past breaches are a dealbreaker, consider Bitwarden, NordPass, or Dashlane instead.
Bottom line
A widely used manager carrying breach-history baggage that every buyer should weigh deliberately.
LastPass comparisons
More Password Management vendors
All Password Management →- 1Password4.5/5
- Bitwarden4.4/5
- Dashlane4.1/5
- NordPass4/5
- Proton Pass4/5
Related on Start with Identity
- Comparisonlastpass-vs-1password
A migration guide, not a verdict on character. What LastPass disclosed in 2022, what it has changed since, and what to do with your vault if you move to 1Passwo
- CVESMB Server Kerberos reflection via Ghost SPNs
October 2025 follow-on to CVE-2025-33073. SMB Server elevation of privilege by combining Kerberos reflection with Ghost SPNs and DNS self-registration.
- CVEWindows SMB Client improper authentication (tampering)
Windows SMB Client improper authentication (CWE-287) that allows tampering. Not an Entra token bug, but it sits in the same Microsoft identity-adjacent patch tr
- CVEWindows SMB Kerberos reflection elevation of privilege
Kerberos authentication reflection on SMB, still abusable via Ghost SPNs after the first fix. High-severity elevation of privilege on Windows.
- Vendor1Password
top_tier
- Comparison1password-vs-bitwarden
Both sit at the top of password management. The decision is polish, developer tooling, and device trust against open source, self-hosting, and a real free tier.
By SWI Community Team · Last evaluated 2026-06-19
Independent, community-driven analysis. No vendor sponsorship. Compiled from public research and community input and verified on a best-effort basis, so details may be incomplete or out of date. Scores are opinions, not advice. Trademarks belong to their owners; mention does not imply affiliation or endorsement. See the full disclaimer, or send corrections to [email protected].