What LastPass is

The extension saves and autofills logins, generates passwords and passphrases, stores cards and secure notes, and supports password sharing and MFA. The free plan works on one device type, computers or mobile; Premium and Families add unlimited device types, more sharing, file storage, and emergency access.

Feature coverage

  • Login autofill and password generator
  • Card, note, and passkey storage
  • Password sharing and MFA options

What stands out

  • Very large public footprint
  • Updated September 2026
  • Usable free tier on one device type

Tradeoffs to know

  • 2022 incident included copied vault backups
  • Free tier limited to one device type
  • Rating trails other managers in this group

Is LastPass safe to use?

LastPass carries a caveat the other managers here do not. Its own 2022 disclosure says an attacker copied customer vault backups; passwords and notes were encrypted with master-password-derived keys, but website URLs were not. Current users should keep a long, unique master password and MFA; new users have options without that history.

Page access Broad

Requests page-content access across sites. Broad access is not itself a red flag — the question is whether the job justifies the reach, and whether the publisher's record earns it.

Autofill needs to read and fill sign-in and payment forms on the sites you visit, which is why LastPass requests broad site access. Setting the extension to on-click in Chrome limits it to pages where you invoke it, which also removes automatic fill prompts on sites you rarely use.

Store-disclosed data

  • Personally identifiable information
  • Authentication information
  • Location
  • User activity
  • Website content

The listing names personally identifiable information, authentication information, location, user activity, and website content. LastPass says vault data is encrypted with AES-256 using a key derived from your master password, which it does not store. Its 2022 disclosure showed that website URLs in vault backups were not encrypted.

Was LastPass breached?

Yes. LastPass disclosed that an attacker who accessed its development environment in August 2022 later used stolen credentials to copy backups of customer vault data from cloud storage. LastPass says usernames, passwords, secure notes, and form-fill data were encrypted with 256-bit AES, while website URLs and some account details were not.

Does LastPass know my master password?

LastPass says the master password is never known to it and is not stored or maintained by the company, and that vaults can only be decrypted on your device with a key derived from it. That is why master-password strength mattered so much after the 2022 incident.

Is LastPass free?

There is a free plan limited to one device type with basic password management. Premium and Families plans add unlimited device types and more sharing, each with a 30-day free trial.

How we judge this: our extension safety guide · how we rate

Pricing

Free plan limited to one device type; paid Premium and Families with a 30-day trial. Pricing and plan limits change more often than store metadata, so use the linked developer page as the final check before subscribing.

Alternatives

AlternativeBitwardenAlternativeProton PassAlternativeKeeper Password Manager

Head-to-head comparisons

ComparisonBitwarden vs LastPass

Sources

We used the official Chrome Web Store listing and first-party developer material. Public metrics can change after the fact-check date.

  1. Chrome Web Store listing

    Rating, rating count, public users, version, update date, and publisher disclosures verified 2026-10-12.

  2. LastPass product documentation

    First-party product, feature, support, or project documentation used for workflow context.

  3. Extension Reviewer methodology

    How public claims, permissions, evidence, and tradeoffs are reviewed.

View in Chrome Web Store Developer site
Read nextDashlaneRead nextRoboFormRead next1Password

More in Privacy & security

See the privacy & security guide