Lastpass Password Manager Review

However, other password managers have narrowed the gap with LastPass, especially since LastPass killed off its more unique features, tripled its prices and restricted its free tier to one device type. Keeper and 1Password now cost roughly the same as LastPass and have similar features, and Bitwarden’s free plan comes with the unlimited syncing that LastPass’s free tier once had. Still, LastPass’ simple and consistent interface, strong feature set and inexpensive Family plan contribute to this password manager’s value, making it first among equals when it comes to the best password managers. Read on for the rest of our LastPass review.

LastPass: Costs and what’s covered

LastPass has three plans: Free, Premium (individual) and Family. At $36 per year for an individual, the premium personal tier is in line with other similarly featured password managers, while the $48-per-year family plan (up to six users) is cheaper than those of many competitors. You can save on your plans with our LastPass coupon codes, where you can also see the latest promotions & info on free trials. For many years, LastPass’ free tier was a steal, with most of the basic features you’d want in a password manager, including unlimited syncing across all your devices. However, the company in early 2021 limited syncing to a single device type: Users on the free plan can access their vaults on mobile or on desktop, but not both. With other password managers on the market offering unlimited free syncing (Bitwarden and Myki, for example), LastPass may no longer be the top free choice. That said, LastPass Free users still get to have an unlimited number of passwords, one-to-one sharing, secure notes, limited multi-factor authentication and the LastPass Authenticator app. An upgrade to LastPass Premium ($36 annually) unlocks unlimited device syncing, one-to-many sharing, advanced MFA, 1GB of file storage, emergency access, 1-to-1 support and a host of security-monitoring features. LastPass does offer a 30-day free trial so you can test out the premium features. The LastPass Family plan ($48 annually) has all the same features as Premium with unlimited shared folders for up to six users. To run the LastPass browser extensions, you must have Windows 8.1 and later or one of the most recent two versions of macOS, Linux or Chrome OS. There are browser extensions for Chrome, Firefox, Safari, Edge and Opera, desktop apps for Windows and macOS, and mobile apps for iOS (13.0 or later) and Android (5 or later). For LastPass testing, I used a 2020 MacBook Air running macOS 10.15.7 Catalina and an iPhone XR with browser testing on Google Chrome.

LastPass: Setup

To set up LastPass, start by creating an account on LastPass.com with your email address and a strong (and memorable) master password. You can also enter a password hint, although this step may be unnecessary and perhaps risky since there’s also an account recovery option. Next, you’ll be prompted to install the browser extension, though you can access your web vault without doing so. There are basic extensions for major browsers, as well as universal installers for Windows and Linux, which will add full-featured “binary component” extensions to all of your browsers at once. Mac users can grab this via the “full version” Chrome extension. These “binary” extensions, which will share your login state across browsers and automatically log you in, among other things, may be helpful if you use multiple browsers on your machine. Once you’re logged into your web vault, you can add individual items or import them from a very long list of other password managers by uploading an exported file or basic CSV. The import tool can be found under Advanced Options at the bottom of the menu bar. LastPass has a wide range of built-in item types for passwords and payments as well as health-insurance plans, Wi-Fi credentials and instant-messenger accounts, plus completely customizable templates. On mobile, download the LastPass app and log in with your email address and master password. On iOS, you’ll be asked to enable Face ID right away (or Face Unlock on a Google Pixel ) for easier access to your app, or you can turn on biometrics later (Settings > Security) if they’re supported on your device. My vault synced automatically between the web and my mobile app. There are also desktop apps available for both Mac and Windows. You can get the former from LastPass’ download page, while the latter is available in the Microsoft store. Both are basically app versions of the web vault. LastPass has said it is no longer developing the stand-alone Windows app, but that may change now that LastPass’ owner has decided to spin the password manager off into its own company. Note that I found LastPass’ help articles less straightforward and more difficult to navigate than competitors’ support sites. If you’re new to password management, this may be frustrating.

LastPass: Desktop

The main way to use LastPass on the desktop is as a web vault and browser-extension combination. The online vault has a left-justified collapsible menu bar with a Home button for viewing all items, as well as tabs for passwords, notes, addresses, payment cards and bank accounts. As noted above, though, you can create a range of different item types as well as customized templates. To create a new record, tap the plus sign in the lower-right corner. If you hover over the icon, you’ll also see an option to create a new folder. Further down the main menu bar are options to view your security dashboard, shared items, emergency access, account settings and advanced options (import, export, account history, deleted items and one-time passwords). The security dashboard shows you a password-health report as well as dark-web monitoring of email addresses found in your LastPass account. Once you activate web monitoring, LastPass sets you up to receive an email alert if any of your information is found in a data breach. This service is always scanning in the background and does not need to be requested manually. The sharing and emergency-access screens show you whom you’ve granted access to your individual records as well as your entire vault. Even for individual users, the Sharing Center oddly defaults to the shared-folder window, which is available only with a family plan. Emergency access can be activated immediately or up to 30 days after a trusted contact has requested it without a response from you. The account settings are the clunkiest part of an otherwise straightforward (if somewhat outdated) interface. This is where you can update security preferences, enable multi-factor authentication and view connected mobile devices. The browser extension has most of the functionality of the web vault. You can view, edit and launch all of your items, add new records, generate and fill passwords and see recently used credentials. To autofill in your browser, tap the LastPass icon in the form field and select the correct login. When you need to change a password, LastPass will pop up its password generator in the form field and then ask if you want to add the updated credential to LastPass, all seamlessly. If you do download the desktop apps, you can access quick functions using the LastPass icon in your main taskbar. In the Windows app, you can also save and autofill passwords for other desktop apps.

LastPass: Mobile apps

Like the web and desktop interface, the LastPass mobile app is also simple. The main navigation at the bottom of the screen is for your main vault, your security tools and your account settings. Under the vault tab, you can view all items or tap to open specific record categories. You can also search for individual items or tap Add in the upper-right corner to create a new record using any of the same item types available on desktop. Plus, you can add attachments like photos, files and even audio recordings to a record. In the security section, you’ll find the password generator, emergency access settings, your password-strength report and the option to switch vaults (if you have multiple identities set up). Note that while there is an option to tap and view your security dashboard, the mobile app does not actually create that report and instead tells you to go to your web vault to view it. Finally, the settings tab is where you’ll adjust security and login options, such as enabling biometrics, auto logout and account recovery. There is a “Remember Master Password” setting, which when toggled on would autofill and log you into your vault, though even LastPass notes that this is not recommended. To enable autofill, go to your phone settings and select LastPass as your password manager. LastPass popped up automatically when I tapped the Passwords option above my keyboard in my browser so I could select the correct credentials. You can also launch sites directly from individual records or by tapping on an item in your main vault, and LastPass will ask if you want to autofill with stored credentials. However, LastPass had a difficult time detecting and filling credit-card fields in multiple mobile browsers.

LastPass: Security

LastPass operates using AES-256 encryption, which protects your data locally on your device and on the company’s servers (and in between). LastPass does not have access to your master password or your vault content. LastPass is also SOC 2 Type 2 compliant according to the Association of International Certified Professional Accountants (AICPA), which means it can be trusted to securely handle consumer data, and the company undergoes regular security audits. All LastPass plans include two-factor authentication options for vault access. Free users can enable 2FA with apps like LastPass Authenticator, Google Authenticator, Microsoft Authenticator, Duo and more. Premium subscribers can also use hardware keys like YubiKey as well as fingerprint and smart-card readers. Finally, LastPass offers account recovery if your master password is lost. The best option is to use a one-time password on a device you’ve previously used with LastPass. These are generated automatically and stored locally on any device on which you’ve logged into the extension or web vault and are used as part of the email verification to recover your account. Alternatively, you can recover your account via SMS or using a password hint previously set up, but neither of these processes are very secure. On mobile, you can toggle the option to use biometrics for account recovery, though anyone with a biometric profile on your device will be able to access your vault.