LastPass

Who owns it

LastPass (LastPass US L.P., independent of GoTo since 2024) has a longer security record than any product here, and it is why the score is what it is. In August 2022 an attacker used a compromised developer account to take source code from the development environment. Between November and December 2022 the same attacker used that material to reach third-party cloud storage and copy customer account details and encrypted vault backups, in which website URLs were stored unencrypted; LastPass confirmed the vault theft in a blog post on 22 December 2022, three weeks after a notice that had described only cloud-storage access. In March 2023 it disclosed that the way in had been a senior DevOps engineer's computer, compromised through vulnerable third-party software, which yielded a decryption key. The vaults were only as strong as their master passwords and the key-stretching behind them: the default was 5,000 rounds of PBKDF2 from 2018, and old accounts were found with as few as one to five hundred, against the million that RoboForm and Keeper use. Krebs on Security reported in September 2023 that researchers had linked more than $35 million of cryptocurrency theft to cracked vaults; TRM Labs put the figure at about $35 million again in a report published in January 2026, tracing the proceeds to Russia-based operators, and the US Secret Service seized $23 million of it in 2025. On 11 December 2025 the UK Information Commissioner fined LastPass £1.2 million over the 2022 breach, which affected up to 1.6 million UK users; the Commissioner said customers "had a reasonable expectation that their personal information would be protected". And on 23 June 2026 LastPass confirmed that an extortion group had used OAuth tokens stolen from a third-party vendor, Klue, to read customer names, addresses, phone numbers and support cases from its Salesforce system; vaults were not involved.

What to know

LastPass has changed a good deal since. Master passwords must now be twelve characters (January 2024), URLs in vaults are encrypted (May 2024), the company built a new cloud platform and internal security teams, and it lists ISO 27001, ISO 27701, SOC 2 Type II, SOC 3 and BSI C5. The current product is competent: passkeys and a built-in authenticator on every plan, shared folders and an admin console from Teams, directory integration with Entra ID, Google Workspace, Okta and OneLogin from Business, SaaS monitoring on Business Max, a legacy open-source CLI, an admin API and no MCP server. Prices in pounds before VAT on 8 September 2026, all billed annually: Free for one device type, Premium £2.60 a month, Families £3.40 for six, Teams £3.83 a user a month for up to fifty users, Business £5.50 with SSO limited to three applications and unlimited users, and Business Max £8.50 with unlimited SSO applications and advanced MFA; business trials run fourteen days without a card. Support is 24/7 and multilingual; a data-residency choice was not found.

What you get and what to watch

Trustpilot is 1.4 on 930 unprompted reviews, 80% one-star, with lockouts without a recovery path, support that free users cannot reach and charges after cancellation the themes. Our position is the one a reader would expect: the breach was four years ago and the fixes are real, but the disclosure pattern, the weak defaults left on old accounts, the regulator's finding and a further customer-data breach in 2026 mean we cannot put it above any provider on this page. Every other product here does the job without that history. Saaskly has no commercial relationship with LastPass.