LastPass has been in the news quite a bit over the past decade. Following some data breaches and security incidents, you may be wondering if it’s now safe to use the well-known password manager — whether you’re a previous, current, or potential LastPass user.
Let’s take a look at LastPass’ current features and security measures along with the previous incidents.
LastPass is a password management application available on the web, desktop, and mobile, as well as with browser extensions. It offers multifactor authentication, biometric login, autofill, a password generator, and dark web monitoring to go along with its basic password management features.
As for security, LastPass uses AES-256 data encryption, PBKDF2 hashing with SHA-256 salting, and a zero-knowledge model. LastPass also holds several security certifications including ISO 27001, TRUSTe, SOC3, and others.
Currently, LastPass has over 33 million users and an estimated annual revenue of $143.7 million.
This all sounds terrific, right? So, what’s the problem?
There’s a reason people are asking if LastPass is safe to use. Security breaches, along with the theft of information over the years, are certainly cause for concern. To understand more about these incidents, let’s look at a brief timeline of what occurred.
LastPass found an irregularity in its network traffic along with one to match in one of its databases. Even though it didn’t find a specific breach, LastPass asked its users to change their master passwords for fear that some of its data may have been hacked.
LastPass notified its community that it “discovered and blocked suspicious activity” on its network. The notification stated that email addresses, password reminders, server per user salts, and authentication hashes were compromised. However, it didn’t find evidence that user vault data was stolen and stated that user accounts were not accessed.
A LastPass user discovered several third-party trackers in the Android mobile app. While similar password managers also contained these types of trackers, the point was made that LastPass had the most between it, 1Password, Bitwarden, and Dashlane.
“No sensitive personally identifiable user data or vault activity could be passed through these trackers. These trackers collect limited aggregated statistical data about how you use LastPass,which is used to help us improve and optimize the product,” said the statement provided to The Register by a LastPass representative.
Later in 2021, it was reported that LastPass users were notified via email that their master passwords were compromised and login attempts with those passwords were blocked. However, a LastPass representative stated that the company investigated these reports and “determined the activity is related to fairly common bot-related activity …”
Probably the most memorable security incident occurred when a hacker stole a copy of the LastPass customer database, along with password vaults and data including names, email and billing addresses, partial credit card numbers, and URLs. There was a mix of encrypted and unencrypted data involved.
The LastPass security incident report starts with the above August 2022 occurrence. It then with updates through the next few months, explaining its investigation into unusual activity in a shared third-party cloud storage service used to house backups along with other data.
Later in 2022, LastPass stated that data obtained in the original August incident was used to gain access to customer information, but that passwords remained encrypted.
The person or entity was able to obtain source code and technical information to later target a LastPass employee. They obtained credentials and keys in order to access and decrypt storage volumes within that cloud service. They then then copied information from a backup containing company names, usernames, email and billing addresses, phone numbers, and IP addresses.
In September 2023, a link was found between the 2022 data theft incident and more than $35 million in cryptocurrency being stolen from over 150 victims since the previous December.
As mentioned earlier, LastPass uses the industry standard for encryption, PBKDF2 hashing with salting, and a zero-knowledge method for protecting your data.
It also undergoes routine audits and testing of its service and infrastructure, and provides users access to its security team for reporting possible weaknesses. LastPass also uses what’s called a Bug Bounty Program where white-hat hackers can submit bugs they find.
With the current security measures, a good feature set, and millions of users, it sounds reasonable to use LastPass as your go-to password manager — if you can look past the security incidents spanning over a decade.
But that’s really what it comes down to. Can you look past the incidents? Would you feel that your data is safe? How much trust are you willing to put in LastPass?
There are many companies out there with password management products that haven’t made headlines or had incidents like LastPass. And, it certainly seems like LastPass has a permanent target on its back from hackers and thieves. Hopefully, the company is taking the necessary measures to fix the problems, but right now, you’ll have to decide whether it’s worth the risk.
Speech-to-text apps have flooded the App Store, making it easier than ever to type on our Macs with just our voice. I have previously covered one such app called TypeWhisper. However, there has been a dearth of good text-to-speech models, and most of the good ones are locked behind a subscription.
Ollama, an open-source app that lets you run local AI models on your computer, wants to change that. It works on macOS, Windows, and Linux, and your prompts are never stored or used for training.
Did you think hitting delete on your AI chatbot conversation actually makes it disappear? Georgia Tech researchers just proved that's not entirely true. They have built a forensic tool called ORISA that can dig deleted conversations from your phone and even rebuild them into a working chatbot session you can keep talking to.
How can ORISA bring deleted AI conversations back?
Touchscreen laptops have been around for years. You can get them in all sizes and shapes. Just not from Apple. For years, the Cupertino giant has treated the idea of a touchscreen MacBook the way I treat a meeting that could have been an email: with open contempt. However, Wednesday looks like the day the company could finally change its mind.
The latest Apple invite puts the “Pro and Tell” showcase in Los Angeles at 10 a.m. PT (1 p.m. ET) on October 28, 2026. Instead of a regular live-streamed keynote, it is an invitation-only, hands-on event for a handful of press and creators (similar to what the company did for the MacBook Neo earlier this year).