LastPass Review

LastPass is the password manager a security lead opens when finance wants a number on the page and the free tier has to be real enough to pilot. The buying question is which seat actually includes directory sync and SSO, because the cheap business plan stops at 50 users and leaves both controls off. Get that wrong and the fix is a new annual order.

This review prices every LastPass tier, then sets it next to 1Password, Bitwarden, Dashlane, Keeper, and Proton Pass.

The wider field is our password manager comparison.

Toolradar data: the September 2026 password-manager ranking evaluated 37 products, and LastPass is the overall pick on that list.

That ranking rewards a free tier and a low rate. This review still prices the 2022 incident from LastPass's own notices, because a top rank still leaves the vault copy for you to defend.

How we compared: rates below come from LastPass's pricing page and its purchase catalog on September 24, 2026. The catalog stores an annual license price, and the page divides it by 12. Competitor rates were read the same day on each vendor's pricing page or plan catalog.

Keeper's business rates are from its plan guide updated July 15, 2026. No vendor paid for a place in this review.

LastPass is a password manager from LastPass US LP, founded in 2008 and headquartered in Boston. Its about page says LogMeIn, now GoTo, acquired the product in 2015, and that LastPass formally separated from GoTo in 2024, so a new order should name LastPass US LP.

The product stores passwords, passkeys, notes, and cards in a vault the company describes as zero knowledge. Current vaults use AES-256, and the key is derived with PBKDF2-SHA-256 at 600,000 iterations plus salting, on LastPass's encryption page.

The master password is not stored on LastPass servers, which is the design claim to put in a questionnaire. It is not a finding from an audit we ran, so file it beside the 2022 notice.

Paid plans add a security dashboard, dark web monitoring, and emergency access on the personal tiers. Business adds an admin console plus directory integrations for Active Directory, Entra ID, Google Workspace, OneLogin, and Okta, federated login, and SIEM export to Splunk or Microsoft Sentinel. That is how joiners, leavers, and the log leave a spreadsheet.

Business Max adds SaaS monitoring and SaaS Protect, a separate control from the vault. Pipeline secrets are a different purchase, covered in our secrets management tools guide, because this catalog has no separate secrets-manager seat.

A personal account starts on the free plan, which includes a 30-day Premium trial. The free vault keeps unlimited passwords, autofill, dark web monitoring, and basic sharing, and it is limited to one device type. LastPass defines the two types as computer, meaning browsers on desktops and laptops, or mobile, meaning phones, watches, and tablets.

A laptop and a phone together are already a paid problem, so budget a paid seat if the pilot has to cover both. Day to day, the extension offers to save and fill logins, and the generator can replace a reused password on the site where you notice it.

Passkeys can live in the vault on paid plans. The Authenticator app can approve vault login, but codes for other sites start on Teams, so a personal paid user should keep a separate authenticator app.

For a company, an admin buys Teams, Business, or Business Max after a 14-day trial, shorter than the personal trial. Teams is shared folders, 25 policies, basic reporting, and an admin console, which is enough when the company only shares logins.

Directory sync, groups, federated login, and SSO are Business, and SSO on that seat covers 3 apps. A pilot that later needs Entra provisioning has to change plans, and that change is a new annual bill.

Dark web alerts are on the free card too, and they are not a monitoring program. If alerting is the requirement, start with dark web monitoring tools.

LastPass prints an annual license price and shows it as a monthly equivalent, so a budget meeting can cite a number without a sales call. Taxes are added at checkout, and the page warns that promotional pricing may not apply to current customers, so a renewal can differ from a new buyer's number.

Premium is one user on every device, with 1 GB of secure-note storage, dark web monitoring, and emergency access. That is the seat once one device type is not enough.

Families is six Premium accounts for $48 a year, and LastPass describes that plan as $1 more a month than Premium, with shared folders and a family dashboard. Hardware security keys are on Families, not on Premium, so a key requires Families.

The jump that matters is Teams to Business. Five Teams seats are 5 times $51, or $255 for the year, and twenty seats are $1,020. Those seats still have no directory sync and no SSO, so you paid for shared folders and an admin console.

Five Business seats are 5 times $84, or $420 for the year, and twenty are $1,680. A 51st user cannot stay on Teams, because the grid caps that plan at 50, so the company changes plans to add that person.

Business Max is the unlimited-SSO seat, at $132 per user per year. Buying it for five people is $660 for the year, which is the bill once SSO for 3 apps is not enough. LastPass does not publish a monthly web plan in this catalog. The only recurring web term on these SKUs is annual, paid up front.

The same check against 1Password, Bitwarden, Dashlane, Proton Pass, and Keeper is in the table. 1Password's low personal rate is a first-year promotion for new customers on 1Password.com, so budget the renewal year.

Bitwarden still has a free plan with unlimited devices, the answer if the device cap is your objection.

Dashlane's detection seat does not include a vault, so the cheaper line is alerts without stored passwords. Proton's figure is the 12-month Pass Plus price in its USD catalog. Keeper's business rates are the July 15, 2026 plan guide, which tells you to confirm the live pricing page.

LastPass fits a buyer who needs the price in the spreadsheet this week, including someone who can stay on one device type without paying. A household of six is Families, with separate vaults on one annual bill. A company that can live without directory sync is a Teams buyer, inside the user cap on the grid.

Move to Business when joiners and leavers have to come from Entra, Okta, Google Workspace, OneLogin, or Active Directory, or when you need groups or SIEM. Move to Business Max when SSO has to cover more than 3 apps, or when SaaS monitoring is the control.

Those are different annual rates, so the seat you pick is the renewal bill.

Skip LastPass when the incident file is the decision. If an auditor needs a shorter account than LastPass's own 2023 update, pay for 1Password or Bitwarden.

Bitwarden is also the pick when a phone and a laptop have to work before anyone enters a card. Phishing resistance still sits outside the vault, because a lookalike page can still collect the password: see how to prevent phishing attacks.

The Cyberpresso brief is the short version of this control call. Subscribe free if you want the next pricing note in the inbox.