LastPass Security Breach History 2026: Should You Still Trust It?

I got the email in December 2022 like millions of other LastPass users. “Incident Notification.” My heart sank a little. A breach where attackers copied encrypted password vaults, plus the customer metadata, is about as bad as it gets for a password manager.

That was three-plus years ago. So here’s the question people still ask me constantly in 2026: is LastPass safe now? Did they actually fix things? And should you move your vault somewhere else?

I used LastPass for six years. I migrated my whole family off it in early 2023, but I kept a test account active so I could watch how the company changed. Here’s the honest breakdown.

Key Takeaways (TL;DR)

LastPass suffered two major breaches in 2022. The second one exposed encrypted vault backups and user metadata (emails, IP addresses, password hint reminders).
The vaults were encrypted, but LastPass uses its own encryption scheme instead of an audited open standard. That weakened trust more than the breach itself.
In 2026, LastPass still operates and has improved security, but I don’t recommend it for most people. Competitors like Bitwarden and 1Password have cleaner security records.
If you stayed with LastPass, you’re probably fine, if you used a strong master password and long iterations. The encryption mostly held.
Best alternative: Bitwarden (free, open source) or 1Password ($2.99/month) if you want polish.

The Full LastPass Breach Timeline

Let’s go through what actually happened, because the details matter when you’re deciding whether to trust a company with every password you own.

August 2022: The First Breach

Attackers got into LastPass’s development environment using a compromised developer laptop. They stole source code and some proprietary technical information.

At the time, LastPass said customer data wasn’t touched. That was technically true and completely beside the point, as we’d learn later.

November-December 2022: The Vault Theft

This is the one that matters. Using information stolen in August, attackers breached a third-party cloud storage service LastPass used for backups. They copied:

Encrypted customer vault backups (username/email, plus the encrypted blob of your data)
Customer metadata: email addresses, names, billing addresses, phone numbers
IP addresses users logged in from
The password reminder hints stored in plaintext

That last one still annoys me. A password company storing plaintext hints next to the encrypted vaults? That’s a design choice that shouldn’t have survived a security review.

The 2024-2025 Aftermath

Here’s something a lot of people missed. Between 2023 and 2025, criminals used that stolen metadata for phishing campaigns. I personally received multiple “your vault is compromised, click here” emails that were actually scams, and I know people who got convincing phone calls using their billing address. The breach had a long tail.

By 2025, LastPass had completed a security overhaul: expanded use of cloud infrastructure hardening, SSO integrations for business, mandatory multi-factor options, and third-party security assessments. No new major breach has been publicly disclosed since. Give them credit for that. But reputation in security is asymmetric. It takes one bad week to lose years of trust, and they spent theirs in 2022.

What LastPass Got Wrong (Beyond the Breach Itself)

To be frank, the hacks weren’t even the worst part. The response was.

Slow, confusing disclosure. LastPass initially described the August incident in vague terms. Then new details kept trickling out over months. Each update made things sound worse than the last statement implied.
The CEO’s own vault was breached. Karim Toubba admitted attackers took encrypted vaults from an earlier period tied to his account. A security CEO’s vault getting popped does not inspire confidence.
Custom encryption instead of proven standards. LastPass uses AES-256 (fine), but wraps it in a proprietary scheme. Competitors like Bitwarden use open-source code that independent researchers can audit. When you can’t verify the code, you’re trusting marketing.
The 100,000 iteration default. LastPass’s key derivation used only 100,000 iterations by default for years, while OWASP recommends 600,000+. Users could raise it, but almost nobody knew that setting existed. If you used a weak master password, your vault was crackable.

Is LastPass Safe to Use in 2026?

Honest answer: probably, with big asterisks.

The case for “yes, you’re okay”:

The stolen vaults were encrypted, and there’s no solid evidence of mass decryption since 2022.
The company has invested heavily in security since. No follow-up breaches in over three years.
Zero-knowledge architecture remains in place.

The case against:

LastPass suffered eight security incidents between 2011 and 2022. That’s not bad luck. That’s a pattern.
Their Enterprise MSSP program launched in 2023 was meant to rebuild business trust, and adoption has been slow. IT managers remember.
You can’t independently verify their code the way you can with Bitwarden.

My take: LastPass in 2026 is likely a competent product. But “likely safe” isn’t the bar for a password manager. The whole point is that you don’t have to think about it. When I open my vault, I don’t want a nagging memory of a breach email. Plenty of people feel the same, and that’s why LastPass bled users for two straight years after the incident.

What LastPass Costs in 2026

Pricing has crept up:

Free: One device type only (mobile OR desktop). Useless for most people.
Premium: $3.00/month, adds syncing across devices.
Families: $4.00/month for 6 users.
Business: around $4.00/user/month.

Compare that to Bitwarden Premium at $10/year total. The value math is rough for LastPass.

Better Alternatives I Actually Use

Bitwarden (Best Overall)

I moved here in 2023 and haven’t looked back. Open source, regularly audited, and the free tier is genuinely generous with unlimited devices and unlimited passwords. Premium is $10/year if you want features like encrypted file attachments and 2FA via hardware keys. Check Bitwarden’s current pricing here, it’s almost embarrassingly cheap.

The apps are slightly less polished than 1Password, and the browser extension occasionally needs a refresh to detect login fields. Minor gripes.

1Password (Best for Families and Teams)

$2.99/month individual, $4.99/month for Families (5 members). Beautiful apps, great travel mode, and they’ve never had a known vault breach. My parents use it because they never have to think about it.

Proton Pass (Best Privacy Focus)

Newer option from the Proton team. Good if you already live in their ecosystem. Free tier exists; paid is around $2-3/month.

How to Migrate Off LastPass Safely

If you’re done with LastPass, do this:

Install your new password manager first. Don’t delete anything yet.
Export from LastPass via Settings > Advanced Options > Export. You’ll get a CSV with all your passwords in plaintext.
Import the CSV into Bitwarden or 1Password. Both handle LastPass CSVs natively.
Delete the CSV file immediately and empty your trash. That file is a burglar’s dream.
Change your most critical passwords (email, banking) over the next few weeks, since your email address and password hints may have leaked in the breach.
Delete your LastPass account once you’ve confirmed everything transferred.

The whole process took me about 90 minutes for a family of four. Worth every minute.

Bottom Line / Our Verdict

LastPass hasn’t had a breach since 2022, and their encryption apparently held up under real-world attack. But the 2022 incident revealed sloppy decisions (plaintext hints, weak iteration defaults, custom crypto) and a disclosure process that eroded trust week after week. Combine that with rising prices and free competitors that are more secure on paper, and I can’t recommend LastPass in 2026.

My picks:

Best free option: Bitwarden. Open source, audited, $10/year premium. Try Bitwarden here.
Best paid experience: 1Password. Clean apps, spotless track record. Check 1Password pricing.

If you’re a longtime LastPass user with a strong master password and high iterations, you’re probably not in danger. But “probably fine” is a low bar when better options cost less.

FAQ

Was my LastPass vault actually decrypted by hackers?
There’s no confirmed evidence of mass vault decryption from the 2022 theft. Encrypted vaults with strong master passwords and long iteration counts remain effectively uncrackable. The bigger real-world risk was phishing using stolen metadata.

Is LastPass safe to use in 2026?
Likely yes, technically. No new breaches since 2022 and the company has hardened its infrastructure. But I still don’t recommend it, because competitors offer stronger transparency and better value.

What’s the best LastPass alternative?
Bitwarden if you want free and open source. 1Password if you’ll pay for the best user experience. Both have cleaner security histories.

Did the LastPass breach affect free users too?
Yes. The stolen backups included both free and paid customer vaults, which is partly why the fallout was so widespread.

How do I check if my LastPass iteration count was high enough?
If you still use LastPass: Account Settings > Advanced Settings > Password Iterations. Anything at 600,000 or above with a strong master password puts you in decent shape. If yours is still at the old default of 100,000, change it today or migrate.

LastPass Security Breach History 2026: Should You Still Trust It? An Honest Review