1Password vs LastPass: Which Password Manager Extension Is Safer?

Which is safer, 1Password or LastPass?

1Password wins on security design and track record; LastPass wins only on having a free plan. Both extensions do the everyday job of saving and filling passwords in Chrome well enough, so the decision comes down to trust and budget.

If neither fits, Bitwarden sits between them: open source, with a genuinely usable free plan. Our password manager shortlist ranks all the serious options, and the head-to-head on Bitwarden vs 1Password covers that pairing in detail.

What happened in the LastPass breach, and does it still matter?

In 2022 attackers first breached LastPass's development environment, then used what they took to copy customer vault backups from cloud storage. Passwords inside were encrypted, but some fields, such as saved website URLs, were not.

Encrypted vaults cannot be opened without the master password, but a stolen copy can be attacked offline forever. People with short or reused master passwords, or older accounts with weaker key-derivation settings, faced the greatest risk. Reports have since linked some cryptocurrency thefts to cracked vaults from that breach.

LastPass has since strengthened defaults and security controls, and it remains a functioning, supported product. The breach still matters for two reasons: stolen backups do not expire, and it showed that too much vault metadata was stored unencrypted.

For the full list of replacements and how they compare, see our page on LastPass alternatives.

Has 1Password ever been hacked?

No customer vault data has been reported stolen from 1Password. Its best-known incident came in 2023, when attackers who breached Okta's support system tried to use access to 1Password's Okta setup; 1Password said it detected the activity and no user data was accessed.

The bigger safety point is structural. 1Password derives your encryption key from both your master password and a Secret Key generated on your device and never sent to 1Password. Even if someone copied 1Password's servers, they would also need each user's Secret Key before they could begin guessing master passwords.

That design has a cost: you must keep the Secret Key safe. 1Password gives you an Emergency Kit PDF at sign-up containing it; print it or store it somewhere offline.

• Strength: a server breach alone does not expose vaults to offline cracking.
• Strength: Watchtower flags weak, reused and breached passwords.
• Downside: lose both your devices and your Emergency Kit and account recovery gets hard.
• Downside: there is no free plan, and 1Password is subscription-only.

How do the Chrome extensions compare on permissions?

Both need to read and change data on all websites, because a password manager must detect login forms and fill them anywhere. That is a normal permission for this category, not a sign of either being worse.

The difference lies in how each one connects. The 1Password extension works on its own or pairs with the 1Password desktop app, letting you unlock with the same system biometrics. LastPass runs its vault directly in the extension, with the web vault as a backup interface.

Read and change data on all websites

Detects username and password fields and fills them. Required by every autofill password manager.

Display notifications

Save and update prompts after you log in with a new password.

Communicate with cooperating native applications

1Password uses this to talk to the desktop app for unlocking; you see it only if you pair them.

Modify data you copy and paste

Lets the manager clear copied passwords from the clipboard after a delay.

Our Chrome permissions explainer translates every warning you might see at install time.

How do 1Password and LastPass compare on price?

LastPass is cheaper to start because it has a free plan; 1Password costs money from day one after its trial. Both sell individual, family and business plans, and prices change, so check the official pages at 1password.com and lastpass.com before buying.

The LastPass free plan is limited to one device type: either computers or mobile, not both. For many people that limit is the real reason they end up paying anyway, which narrows the price gap.

For businesses, both support admin policies, user provisioning and shared vaults. 1Password's business pitch leans on its Secret Key design; LastPass's leans on familiarity and existing deployments. If budget is the deciding factor, compare both against Bitwarden's plans in our Bitwarden vs LastPass comparison.

Which one autofills better day to day?

Both handle standard username and password forms reliably. Differences show on awkward logins: split username-then-password pages, logins inside iframes, and sites that change field names often.

1Password shows an inline menu inside the field and a keyboard shortcut to open the extension; it also fills one-time codes if you store them in the item. LastPass puts its icon inside fields and offers a match list. Both let you save multiple logins per site and pick the right one.

• Multi-step logins: fill the username, submit, then trigger fill again on the password page.
• Wrong account filled: edit the item's website field so it matches the exact login URL.
• Nothing appears: check the extension has site access in chrome://extensions > Details.
• Passkeys: both can store passkeys and will offer them when a site asks.
• Forms and addresses: both fill identities and cards; RoboForm is stronger if form filling is your main need.

Keep only one password extension enabled at a time. If you trial several, a manager for toggling extensions helps; see our guide to extension managers that switch extensions in one click.

How do you move from LastPass to 1Password?

1Password has a built-in LastPass importer, so the move takes minutes. Export from LastPass, import on 1Password.com, check the results, then delete the export file.

1. Create your 1Password account and save the Emergency Kit with your Secret Key.
2. Sign in at 1Password.com in Chrome, click your name, then choose Import.
3. Select LastPass and follow the prompts; 1Password's LastPass import guide shows the current screens.
4. If asked for a file, export from LastPass: open the LastPass extension or web vault, go to Advanced options > Export, and confirm with your master password.
5. Check a sample of logins, secure notes and shared folders in 1Password.
6. Securely delete the exported CSV file, which contains every password in plain text, and empty your trash.
7. Remove the LastPass extension in chrome://extensions and install 1Password.
8. Change passwords for your most important accounts, starting with email.

What about Bitwarden and other alternatives?

If you want free, pick Bitwarden; if you want privacy extras like email aliases, look at Proton Pass. Several other managers are credible if 1Password's price or LastPass's history puts you off.

Google Password Manager, built into Chrome, is also an option if you only use Chrome and Android. It is convenient but less capable for sharing, secure notes and cross-browser use than a dedicated manager.

Should you switch from LastPass to 1Password?

Switch if you can pay and you care most about security design. Stay only if you rely on LastPass's free plan and have already changed your critical passwords since 2022, or consider Bitwarden as the free alternative.

• Pick 1Password if you share a household vault, travel with sensitive data, or want the strongest protection against server-side breaches.
• Stay on LastPass only if your employer mandates it or you need its free plan on one device type.
• Pick Bitwarden if you want free syncing on every device and open-source code.
• Businesses already on LastPass should weigh migration cost against breach risk and review admin policies either way.

Whatever you choose, turn on two-factor authentication for the manager itself and use a long, unique master password. The manager is only as strong as the one password protecting it.