Source

Encryption model & independent audits — found from sitemap — LastPass

Checked for LastPass on 13 Oct 2026

Technical details

type: page
http status: 200
content hash: sha256:36a41453f2d799eff579e690fbd2fd6c0aec32a3d61fb7f2583a814659dd62d7
permission: robots_ok
screenshot: Screenshot on file (internal exhibit, not published)

Cited by

Zero knowledge Report an error

“Even as your solution provider, LastPass has zero knowledge of your encrypted vault data, and hackers don't either.”
Encryption standard Report an error

“Your vault data is protected using AES-256 encryption and 600,000 rounds of PBKDF2-SHA-256 hashing plus salting.”
Master password local only Report an error

“Only your plaintext Master Password – which is not stored on our servers – will unlock the data within your vault.”
Local encryption Report an error

“a user’s data is first encrypted locally on the end user’s device using a unique encryption key known only to the user, before it is sent to the service provider to be stored in an already encrypted state.”
Key derivation Report an error

“LastPass uses PBKDF2-SHA256 with 600,000 iterations to derive an encryption key.”
Authentication hash Report an error

“Then we perform one more iteration and use this as a separate authentication construct.”
Business trial Report an error

“Free 14-day LastPass Business trial. No credit card required.”