LastPass Review 2026

What is LastPass?

LastPass is one of the oldest names in password management, and in 2026 it is still a sensible pick for some people and a poor fit for others. This review sets out the lastpass free plan limits and alternatives, what each paid tier costs, what actually happened in the 2022 security incidents, and how the service compares with Bitwarden, 1Password and Proton Pass on price. Feature details, the free-plan rules and the breach facts come from LastPass's own pages and incident notices, and rival prices from each competitor's pricing page, all checked in October 2026. LastPass's prices are the exception, as explained below.

What LastPass is and who runs it

LastPass stores your logins, secure notes, card details and passkeys in an encrypted vault, then fills them in through browser extensions and mobile apps. It has been around since 2008. LogMeIn announced a $110 million cash deal for the company in October 2015, and LogMeIn later renamed itself GoTo. That GoTo acquisition era ended on 1 May 2024, when LastPass completed its separation and became an independent company headquartered at 125 High Street in Boston. The company says it serves 100,000 businesses and millions of individual users.

Apps are available for Chrome, Firefox, Edge, Opera and Safari, desktop apps for Windows and macOS, and mobile apps for iPhone, iPad, Apple Watch and Android. The Chrome extension alone lists around 8 million users on the Chrome Web Store.

Who should use it, and who should skip it

LastPass suits people who already have a vault there, families who want shared folders and a simple family manager view, and small companies that want an admin console without a long rollout. It is less suited to anyone who wants a free plan that works on both a laptop and a phone, or to readers who simply cannot trust a vendor after the 2022 breach. Both views are reasonable, and the sections below give you the facts to decide.

A useful test: count your devices. If you only ever log in from one laptop, Free covers you. If you switch between a phone and a work PC every day, budget for Premium here or choose a rival whose free tier syncs everywhere. Agencies managing client logins should look at shared folders and admin policies rather than personal plans.

Key features in practice

• Vault and autofill: unlimited password storage on every plan, including Free, with autofill in the browser and on mobile.
• Passkeys: Premium and above can store passkeys alongside regular passwords.
• Sharing: Free allows sharing one item with one person at a time. Families and business plans add shared folders, managed from the sharing centre in the vault.
• Dark web monitoring: included even on Free, so you get alerts when an email address in your vault shows up in known breach data.
• Multi-factor login: Free users can use popular authenticator apps, and passwordless login works only through the LastPass Authenticator app. Paid plans add FIDO2 biometric and hardware authenticators. On hardware keys such as YubiKey the pricing page contradicts itself (its FAQ says Premium, its table says Families), so test this in the trial if you rely on one.
• Family manager: the Families plan gives one person a dashboard to add or remove members and organise shared folders, which helps when a parent sets things up for older relatives.
• Emergency access: a trusted contact can request entry to your vault after a waiting period you choose (Premium and Families).
• Plus plan: Premium bundled with LastPass VPN for up to 10 devices. The VPN runs on Windows only for now; LastPass lists macOS, iOS and Android as coming soon.

LastPass Premium price India and plan costs

Every paid plan is billed annually, with the cost shown as a monthly figure. One caution first: when we checked in October 2026, lastpass.com/pricing showed template placeholders instead of numbers, and we could not find the figures on any other LastPass page. The dollar amounts below are as reported by price trackers (usecarly, July 2026, and PricingSaaS, September 2026), which agree on them. Check LastPass checkout for the price you will actually pay, because promotions come and go: one tracker logged a 30% discount on Premium and Families in August 2026, and another recorded a higher Premium renewal rate after an introductory year.

There is no separate rupee price list. Indian buyers pay the dollar amount converted by their bank, so the final figure depends on the exchange rate on the day plus any forex markup on your card, and taxes are added at checkout. Premium and Families come with a 30-day trial, Teams and Business with a 14-day trial, and none of them asks for a card up front. The service works normally from India; the apps are on the Indian Play Store and App Store like anywhere else.

For a team, the Business tier adds groups, advanced reporting, SIEM and directory integrations, and five extra Families licences for staff. Business Max sits above it with unlimited SSO apps, workstation MFA, and monitoring of SaaS, AI tool and website use. If you are comparing LastPass Business with rivals, ask for a quote at your seat count, since promotional discounts appear often.

Free vs paid: the one device type rule

The biggest catch on Free is that it works on one device type only. You pick either Computer or Mobile as your active type. According to LastPass's FAQ, Computer covers Windows, macOS and Linux machines plus Windows tablets, and Chromebooks running the extension (a Chromebook using the Android app counts as Mobile). Mobile covers phones, smartwatches, iPads and Android tablets. You get three chances to switch the active type, and switching never deletes vault data. So a Free user cannot fill passwords on a laptop and a phone at the same time. That single rule is why many people either upgrade or move.

LastPass breach: what to do and what was taken

LastPass disclosed the incidents on 22 December 2022 and published a fuller account on 1 March 2023. In the first incident an engineer's laptop was compromised, and the attacker took code from 14 of 200 software repositories plus internal scripts and documents; LastPass says no customer vault data was taken then. In the second, the attacker went after a senior DevOps engineer through vulnerable third-party software, installed malware and reached cloud backup storage.

According to the two notices, the attacker copied basic account data (names, billing addresses, contact details and IP addresses), backups of all customer vaults, and a backup of the MFA and federation database, which held LastPass Authenticator seeds and MFA phone numbers. Usernames, passwords, secure notes and form-fill data inside the vaults were encrypted with 256-bit AES under a key derived from each user's master password, which LastPass never stores. Website URLs were not encrypted at the time. The company says it saw no attacker activity after 26 October 2022.

LastPass's own guidance was that a strong, unique master password with default settings would take a very long time to crack, but that users with weaker settings should change the passwords for sites saved in the vault. If you held a vault in 2022, a sensible checklist based on what was taken is:

• Change your master password if it is old, short or reused anywhere else.
• Check your password iterations in account settings; LastPass now uses at least 600,000 PBKDF2 rounds for new and updated accounts.
• Rotate passwords for email, banking, UPI-linked and work accounts first.
• Reset any TOTP codes stored in the LastPass Authenticator and re-enrol MFA.
• Move crypto wallet seed phrases kept in secure notes to new wallets.

Security changes since 2022

The company rotated secrets and certificates and rebuilt its development environment. In an October 2024 post, its CEO added that LastPass had hired a dedicated security team, moved to a new cloud platform and issued new company-managed devices to all staff. As of September 2025 it finished encrypting URL fields and related autofill data such as URL rules and never-URL lists, which closes the gap that left website addresses readable in 2022. Its Trust Center page lists further work on stricter master password rules and a move to Argon2. The same CEO post says it kept SOC 2 Type II and ISO 27001 and added SOC 3 and BSI C5, and the Trust Center confirms a bug bounty on Bugcrowd. None of this undoes the breach, but the specific weaknesses it exposed have been addressed.

LastPass emergency access setup

Open the vault, go to the Emergency Access tab and add a trusted contact. That person needs their own LastPass account, because the feature works by generating encryption keys between the two accounts without LastPass seeing your data. You set how long the waiting period lasts after they request entry, and you can decline a request during that window. Change the contact or the delay at any time.

How to export your vault

Vault export runs only from the browser extension. Log in, click the LastPass icon, go to Account, then Fix a problem yourself, Export vault items, and Export data for use anywhere. Re-enter your master password and a CSV file downloads (Safari opens it in a tab to save). Attachments, TOTP codes, custom fields and custom item types do not export, and a business admin can block export by policy. Delete the CSV once you have imported it elsewhere, since it holds plain-text passwords.

LastPass vs Bitwarden and other alternatives

On a straight comparison, Bitwarden wins on cost and on its free tier, which syncs across every device. Its Teams plan is $4 per user per month and Enterprise is $6. 1Password has no free tier but is a polished paid option for households. Proton Pass suits people who want email aliases with their passwords. LastPass is competitive on Families pricing and on a familiar interface, and it has the larger business policy set.

Lastpass free plan limits and alternatives: our take

Stay if you already pay for Premium or Families, use a long unique master password, and have done the post-breach clean-up. Switch if you only want a free manager that syncs to your phone and laptop, because Bitwarden and Proton Pass both allow unlimited devices at no cost. To get started, install the browser extension, create a master password of at least 12 characters (longer is better), turn on MFA, import passwords from your browser, and add an emergency contact if you are on a paid plan.