Is LastPass Safe? Permissions, Privacy and Ownership Checked

Is LastPass safe to use in 2026?

Mostly yes, if your master password is long and unique, but LastPass is no longer the password manager we would recommend first. The encryption model is sound; the company's security record between 2022 and 2023 is the problem.

LastPass uses a zero-knowledge design. Your vault is encrypted and decrypted on your own device with a key derived from your master password, and LastPass's servers store only scrambled data. That design is why the 2022 breach did not instantly hand attackers every password. It is also why the breach still matters: the attackers left with copies of encrypted vaults they can try to crack offline, for as long as they like, with no lockout and no rate limit.

That shifts the safety question onto your account. A long, random master password and a high iteration count make offline cracking impractical. A short or reused master password, or an old account whose iteration setting was never raised, is a far softer target.

The sections below cover what was actually taken, what the Chrome extension can see on your machine, who owns the company now, the legal fallout, and the specific settings that close most of the gap. If you are weighing a move, our password manager shortlist ranks the options side by side.

Has LastPass ever been hacked?

Yes. LastPass has disclosed several security incidents, and the 2022 breach is one of the most serious ever to hit a consumer password manager because customer vault data left the company.

The second chapter is what turned a source-code leak into a customer problem. By capturing an engineer's master password on a personal machine, the attacker obtained access that let them copy the stored backups. LastPass has since said it rotated credentials and hardened its environment, but none of that can pull back data already copied.

Security researchers and journalists have since linked a series of cryptocurrency thefts to vaults they believe were cracked from that stolen data, typically where users had stored wallet seed phrases in secure notes. LastPass has not confirmed every case, so treat the link as credible reporting rather than proven fact.

The lasting lesson: the vault copies taken in 2022 are permanent. Changing your master password today protects your live vault, but it does not re-encrypt the old copy an attacker already holds. Only changing the passwords stored inside it does that.

What did the 2022 LastPass breach actually expose?

Your passwords were encrypted in the stolen backups, but the list of websites you saved them for was not. That split explains both why the damage was limited and why it was still real.

Encrypted (needs your master password to read)

Usernames, passwords, secure notes and form-fill data stored in each vault item.

Unencrypted (readable by the attacker as-is)

The website URLs attached to saved items, plus account details LastPass reported as including names, email addresses, billing addresses, phone numbers and the IP addresses customers used.

Not in the vault backups

Your master password itself. LastPass never stores it, which is the core of the zero-knowledge model.

Readable URLs matter because they let an attacker sort vaults by value. A vault with saved logins for a crypto exchange, a brokerage account and a business admin panel is worth far more cracking effort than one full of shopping sites. The attacker can see that before spending a single guess.

The other variable is password iterations: how many times your master password is run through the key-derivation function before it unlocks the vault. More iterations make every cracking guess slower. Current accounts use a much higher default than LastPass used years ago, and some long-standing accounts were found still set to very low values, which made them cheaper to attack.

What permissions does the LastPass Chrome extension ask for?

The extension can read and change every http and https page you visit, which Chrome shows as Read and change all your data on all websites. That is normal for an autofill password manager, but it means you are trusting LastPass's code on every tab.

The current Manifest V3 build (version 4.156.0 at the time of writing) declares these permissions. The purpose notes describe what each permission allows in Chrome and the typical reason a password manager requests it.

Host access to http://*/* and https://*/*

Runs scripts on every site so it can spot login forms and fill them. See what all-sites access really allows.

tabs

Reads the URL and title of your open tabs so it can match the current site to saved logins. Details on the tabs permission.

scripting

Injects code into a page on demand, for example when you pick a login from the toolbar menu.

webNavigation, webRequest, webRequestAuthProvider

Sees page loads and network requests, and can answer the browser's built-in username and password prompts (HTTP authentication) for you.

cookies

Reads and sets cookies, most plausibly to keep your LastPass session signed in. With all-sites host access, it could technically read other sites' cookies too. More on the cookies permission.

declarativeNetRequest

Applies rules that can block or modify network requests without reading their content.

storage, unlimitedStorage, offscreen, alarms

Keeps a local, encrypted copy of your vault, does background work Manifest V3 service workers cannot do alone, and runs timed tasks such as sync or auto-logout.

notifications, contextMenus

Shows desktop alerts and adds LastPass entries to the right-click menu.

Optional: privacy, clipboardWrite

Only granted if you approve them later. Privacy can change Chrome privacy settings (a manager can use this to switch off Chrome's own password prompts); clipboardWrite lets it copy passwords for you.

Nothing in that list is unusual for the category; Bitwarden and other managers ask for very similar access. The question is whether you trust the publisher's code and update process, which brings the breach history back into play.

How do you lock down the LastPass extension in Chrome?

You can restrict where LastPass runs from Chrome's extension settings, at the cost of automatic autofill. For most people, the useful changes are Incognito access and turning off Chrome's competing password prompts.

1. Open chrome://extensions and click Details on the LastPass card.
2. Under Site access, choose between On click, On specific sites and On all sites. On click means LastPass only touches a page after you click its toolbar icon, which is the tightest setting but stops automatic fill suggestions.
3. Leave Allow in Incognito switched off unless you rely on LastPass in private windows.
4. Scroll to Permissions and compare it with the list above. If a future update adds a permission with a new warning, Chrome disables the extension until you approve it, so read that prompt rather than clicking through.
5. To avoid two password managers fighting over the same form, open chrome://password-manager/settings and turn off Offer to save passwords.
6. Click the puzzle-piece icon in the toolbar and pin LastPass so you always use the real extension icon, not a look-alike prompt on a web page.

On specific sites is a reasonable middle ground if you only need LastPass on a handful of work tools: add each domain and the extension stays out of everything else. The catch is maintenance, since every new site needs adding by hand.

On a Chromebook these steps are identical. On Android and iPhone there is no Chrome extension; LastPass works through the system autofill service instead, so you control it from the phone's own password and autofill settings.

Who owns LastPass, and does ownership affect safety?

LastPass is now a standalone company backed by private equity investors, after years inside LogMeIn and its successor GoTo. Ownership matters because it shapes how much gets spent on security and how quickly problems are disclosed.

• 2008: LastPass launches as an independent password manager.
• 2015: LogMeIn buys LastPass.
• 2020: LogMeIn is taken private by Francisco Partners and Evergreen Coast Capital, an affiliate of Elliott Management. LogMeIn later rebrands as GoTo.
• Late 2022: GoTo announces plans to spin LastPass out as a separate company, in the same period as the breach disclosures.
• 2024: The separation completes and LastPass operates as its own business.

Critics of the LogMeIn years pointed to features moving behind the paywall, including the 2021 change that limited free accounts to either computers or mobile devices, not both. Whether cost pressure contributed to the security failures is debated, and there is no public finding that settles it.

What you can judge is transparency. LastPass's first breach notices were criticised for understating what was taken; the full picture arrived over several months. If fast, complete disclosure is a priority for you, weigh that history against the company's newer security commitments, which it publishes on its own security page.

Is there a lawsuit against LastPass?

Yes. Class-action lawsuits were filed in US federal court after the December 2022 disclosure, arguing that LastPass failed to protect customer data and was slow to explain the risk.

Several plaintiffs tied their claims to cryptocurrency losses they attributed to cracked vaults. Cases like these are often consolidated, settled or narrowed over time, so check a current court record or reputable news source for the latest status rather than relying on older articles.

For your own security the outcome does not change the to-do list. A settlement will not un-leak a vault backup; rotating the passwords that were inside it will. If you believe you lost money because of the breach, keep records of the dates you changed passwords and any fraudulent transactions, since that evidence matters for any claim.

How do you make LastPass safer if you keep using it?

Change the master password, confirm a high iteration count, add app-based two-factor authentication and rotate your highest-value passwords. Those four steps cover most of the residual risk from the breach.

1. Change your master password to a long passphrase you have never used anywhere else. Do this from Account Settings in the web vault.
2. Check password iterations. In Account Settings, open the advanced settings and find Password Iterations. If the value is low, raise it to the current recommended default shown there. Menu labels have moved between vault redesigns, so search LastPass's help centre if you cannot find it.
3. Turn on multifactor authentication with an authenticator app rather than SMS. LastPass offers its own authenticator, and any standard TOTP app works.
4. Rotate the logins that matter most if they were saved before the end of 2022: primary email, banking, brokerage, crypto exchanges, work admin accounts and anything that can reset other passwords.
5. Set auto-logout. In the extension's account options or preferences, choose to log out when the browser closes and after a period of inactivity.
6. Run the Security Dashboard in the vault to find reused, weak and old passwords, and fix the ones on high-value sites first.
7. Review trusted devices and sessions in account settings and remove any you do not recognise.

One nuance on two-factor codes: keeping your TOTP secrets in a separate app from your passwords means a cracked vault alone is not enough to sign in. Browser-based options such as Authenticator exist, but a phone app keeps the second factor on a different device, which is the stronger setup.

What is the safest password manager instead of LastPass?

For most people, Bitwarden is the safest straightforward replacement: open-source, independently scrutinised and free for unlimited devices. 1Password is the strongest paid choice, largely because its Secret Key means a stolen vault cannot be cracked with the master password alone.

Chrome's built-in Google Password Manager is also safer than no manager and needs no extension, though it is tied to your Google account and lacks some sharing and vault features. For a head-to-head, read Bitwarden vs LastPass or browse every LastPass alternative we list. To switch, export from the LastPass vault via Advanced Options then Export, import the file into the new manager, and delete the export file right after, since it holds every password in plain text.