LastPass alternatives, after the breaches

Short answer

Yes, LastPass was breached. In August 2022 attackers took source code, and later in 2022 they used what they learned to copy customers' encrypted vault backups from cloud storage. Because the vaults were encrypted with keys derived from each customer's master password, how exposed you are depends mostly on how strong that password was and which settings your account used.

If you want to leave, good options include Bitwarden (open source, free tier), KeePassXC (fully local), 1Password and Proton Pass. Secure It Password Manager is a smaller option for people who want their encrypted vault in their own Google Drive instead of on a vendor's servers. We wrote this page, so we say plainly where the others are the better choice.

LastPass breach timeline

Everything below comes from LastPass's own notices or from named reporting. Dates are as published, checked 15 Oct 2026.

Two details matter most:

• What was encrypted. LastPass says website usernames, passwords, secure notes and form-fill data were encrypted with 256-bit AES, using keys derived from your master password, which LastPass does not store. Website URLs were not encrypted. Its March 2023 update adds file paths to installed software and certain email use cases to the unencrypted list.
• What the ICO found. It found no evidence that attackers decrypted customer passwords. It also described how the attack worked: malware on an employee's personal laptop captured that employee's master password.

What it means for you

The stolen backups can be attacked offline, with no rate limits, for as long as the attacker likes. That makes your master password and your key derivation settings the whole story.

• Default settings, long unique master password. LastPass has required at least 12 characters since 2018 and uses 100,100 PBKDF2 iterations for accounts on current defaults. On that basis it told default-settings users no action was needed. Independent researcher Wladimir Palant disagreed with some of this reasoning, so weigh it yourself.
• Older accounts. Palant reports that LastPass raised its default in 2018 but did not migrate existing accounts. Some were left at 5,000 iterations, a few at 500 or even 1. If your account is old, check your iteration count in your LastPass settings. His GPU estimates are his own benchmarks, not an audit.
• Short or reused master password. Treat the vault as exposed. LastPass itself advised people with non-default settings to consider changing the passwords stored in their vault.
• Crypto seed phrases. Reporting on the thefts has repeatedly found victims had stored seed phrases in LastPass. If you did, move the funds to a new wallet with a new seed.

Checklist

1. Change your master password to a long, unique one. A passphrase of four or more random words works well.
2. Rotate the most valuable passwords first: email, banking, cloud accounts, domain registrars, anything with recovery rights over other accounts.
3. Rotate every account where the URL in your vault would tell an attacker something useful.
4. Replace any crypto seed phrase stored in the vault.
5. Turn on app-based two-factor authentication or passkeys on your key accounts.
6. Be suspicious of any email or text that appears to come from LastPass. It says it will never ask you to click a link to verify information.

What to look for in an alternative

• Zero-knowledge design. The vault is encrypted on your device before it is stored anywhere.
• Key derivation. Argon2id is the modern memory-hard choice. PBKDF2 is acceptable if the iteration count is high. Bitwarden's help page lists 600,000 as its PBKDF2 default and offers Argon2id as an option.
• Open source or published audits. You want something outsiders can check.
• Export. You should always be able to leave, in a standard format.
• Where the vault lives. A vendor's servers are an attractive target, because one breach can reach millions of vaults. A file on your own device or in your own cloud account is a smaller target.
• Price model. Subscription, free tier or one-time purchase.

The options

Prices are from the vendors' own pages as of 15 Oct 2026 and can change.

Choose them if…

• Bitwarden: you want the safest mainstream default. It is open source and has a solid free plan, and the paid tier is cheap. For most people leaving LastPass, it is the easiest answer.
• 1Password: you want a polished experience for a family or team and don't mind a subscription.
• KeePassXC: you want complete local control and are happy to handle syncing yourself.
• Proton Pass: you already use Proton for email or VPN, or want a generous free plan from a privacy-focused company.
• Google Password Manager: you live in Chrome and Android and want zero setup. Its trade-off is that your passwords sit inside your Google account.

Choose Secure It if…

Secure It is a zero-knowledge password manager that stores your encrypted vault in your own Google Drive: no company servers, not even ours. Vault encryption is AES-256-GCM, with the key derived from your master password using Argon2id, and all of it happens on your device. There is a 12-word recovery phrase and an Emergency Kit PDF. The app is in 12 languages.

It suits you if you want your vault in storage you already control, you want to pay once instead of subscribing, and you use Android, Windows and Chrome. Pricing is a one-time purchase of US$4.99, and the Windows app and browser extension are unlocked by that purchase. See pricing and download for the current state.

Its limits are real:

• No independent security audit yet.
• Sync needs a Google account. The vault file is encrypted, but it lives in your Drive.
• Android is in closed testing, so it isn't on general sale yet. The Edge listing is pending (Edge users can use the Chrome Web Store listing).
• No iOS app.
• A small, independent developer, not a large security company.

If you need iOS, an audit trail or team features today, choose Bitwarden or 1Password. See /security/ for the technical details and /facts/ for a dated summary.

How to move

1. Export from LastPass. In the web vault, open Advanced Options, choose Export, confirm via the email link, and save the CSV. The exact menus change between LastPass versions, so check LastPass's current support article if you can't find the option. The file is plain text, so do this on a trusted computer.
2. Import into the new manager. Bitwarden has an importer tool, and Proton Pass, 1Password and KeePassXC all read LastPass CSV files. A Secure It import guide is planned.
3. Check the import. Open a handful of entries, including ones with notes and multiple URLs.
4. Delete the CSV and empty your recycle bin.
5. Rotate the critical passwords from the checklist above, starting with email.
6. Delete your LastPass account once you're sure everything is moved. Deleting the account only removes it going forward. It cannot recall backups already stolen, which is why rotation matters more than deletion.

Do not reuse your old LastPass master password for the new vault.