# LastPass — Password Management

LastPass by LastPass Ireland Limited holds a panel rating of 2.5/5 from 6 AI judges (category median 2/5), as of 2026-10-15. Provenance: Rest of world; sovereignty: not determined.

- Vendor: LastPass Ireland Limited (https://www.lastpass.com)
- Category: [Password Management](https://whats-best.ai/software/password-management.md)
- Provenance (editorial classification): Rest of world
- Canonical page: https://whats-best.ai/software/password-management/lastpass
- Alternatives: https://whats-best.ai/software/password-management/lastpass/alternatives ([markdown](https://whats-best.ai/software/password-management/lastpass/alternatives.md))
- Data as of: 2026-10-21 · evaluated 2026-10-15 · oldest source captured 2026-10-01

**AI-generated.** Every score, rationale and verdict here is written by a panel of AI judges from public evidence — an analysis, not a hands-on test. Every fact quotes the vendor page it was read from. No score can be bought. How scores are made: https://whats-best.ai/methodology

## At a glance

- Vendor: LastPass Ireland Limited
- Headquarters: Not stated on the vendor’s pages as of 13 Oct 2026
- Data hosting: Not stated on the vendor’s pages as of 13 Oct 2026
- Free plan: Not stated on the vendor’s pages as of 13 Oct 2026

## The panel's verdict

LastPass, a password manager from LastPass Ireland Limited of Dublin under a US-based group in Boston, scores best on sharing and access control, identity integration, pricing transparency and audit and policy. Judges credit shared folders with per-user permissions, sharing that never reveals the plaintext password, emergency access with an owner-defined wait time, SCIM provisioning against Entra ID, Okta, OneLogin, Ping and Google Workspace, FIDO2 passwordless unlock, and three tiers priced at €4.42, €6.50 and €10.00 per user per month billed annually. Security architecture scores sit at 4: the zero-knowledge page names AES-256, PBKDF2-SHA-256 at 600,000 iterations and a master password never stored on their servers, but the trust and compliance centers are referenced without a named auditor, dated certification or published report. The weakest ranges are deployment and portability and sovereignty (1-3, the CISO at 1): judges found no public information on a hosting region, a self-hosted option or a documented export path, and the privacy notice relies on the Data Privacy Framework and Standard Contractual Clauses for transfers out of the EEA.

**Speaks for it:**
- Sharing grants access without revealing the plaintext password, with per-user permissions, revocation at any time from a sharing center, emergency access after an owner-defined wait time, and automatic revocation when an end-user leaves.
- SCIM-based real-time provisioning and deprovisioning covers Entra ID, Okta, OneLogin, Ping and Google Workspace, with group sync into shared folders and policies and FIDO2 passwordless vault unlock.
- The zero-knowledge page names AES-256, PBKDF2-SHA-256 at 600,000 iterations, a separate authentication hash, and a master password that is not stored on their servers.
- Teams at €4.42 (up to 50 users), Business at €6.50 and Business Max at €10.00, all per user per month billed annually, with a feature matrix covering policy counts and single sign-on app limits.
- More than 100 configurable policies at individual, group and organization level, with SIEM export to Splunk and Microsoft Sentinel.

**Held against it:**
- The trust and compliance centers are referenced without a named auditor, dated certification or published report.
- We found no public information on how the vault key is derived or released when federated login replaces the master password, or that the vendor cannot derive it.
- We found no public information on a hosting region, a self-hosted option, or a documented product export path.
- Transfers out of the EEA rely on the Data Privacy Framework and Standard Contractual Clauses, and subprocessor details are available only on request rather than published with locations.
- We found no public information on which events the logs record, on log retention, or on who viewed or copied a shared credential.

**Best for:**
- You need to replace ad-hoc credential sharing with shared folders whose access is revoked automatically when someone leaves the organization.
- Your identity stack already runs on Entra ID, Okta, OneLogin, Ping or Google Workspace and you want SCIM provisioning and group sync driving shared folders and policies.
- You want a published per-user price to budget with: Teams at €4.42 (up to 50 users), Business at €6.50 and Business Max at €10.00 per user per month billed annually, with a free trial that requires no credit card.
- You enforce password policy centrally and centralize security reporting in Splunk or Microsoft Sentinel.

**Avoid if:**
- You must present a wholly European data chain: the provider is LastPass Ireland Limited of Dublin, but the group is US-based in Boston, the Data Protection Officer's postal address is in Boston, and transfers out of the EEA rely on the Data Privacy Framework and Standard Contractual Clauses.
- You need a renewal invoice you can pin down before signing — ask the vendor: the public pages we read do not show it
- You need a documented exit path or your own infrastructure to run the vault on — deployment and portability scored 2-4, with the captured pages stating only browser, desktop and mobile clients plus an offline mode.

## Scores by judge and criterion

Scores out of 5, each judge scoring independently against the published rubric (v1). "n/r" = not rated: the vendor publishes no price.

| Criterion | The CISO | The Identity Engineer | The Compliance Auditor | The SME Owner | The DevOps Engineer | The Skeptic |
| --- | --- | --- | --- | --- | --- | --- |
| Encryption model & independent audits | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 |
| Sharing, roles & recovery | 3/5 | 2.5/5 | 3/5 | 3/5 | 3/5 | 3/5 |
| SSO, directory sync & provisioning | 3/5 | 3/5 | 3/5 | 3/5 | 3.5/5 | 3/5 |
| Audit logs, policies & reporting | 3/5 | 3/5 | 2.5/5 | 3/5 | 3/5 | 3/5 |
| Hosting choice, offline access & export | 1.5/5 | 2/5 | 1/5 | 1.5/5 | 1/5 | 1.5/5 |
| European sovereignty | 0.5/5 | 1.5/5 | 1.5/5 | 1.5/5 | 1/5 | 1.5/5 |
| Pricing transparency | 3/5 | 3/5 | 2.5/5 | 3/5 | 3/5 | 3/5 |
| **Weighted verdict** | **2.5/5** | **2.5/5** | **2/5** | **2.5/5** | **2/5** | **2.5/5** |

### The judges

- **The CISO** (v1.0): Answers to the board for the day the vault vendor is breached. Wants a whitepaper that says which fields are encrypted and which are not, audits by named firms with dates, a bug bounty, and an incident history written down rather than discovered in the press.
- **The Identity Engineer** (v1.0): Runs Entra ID for two thousand staff and owns the joiner-mover-leaver process. Wants SCIM that suspends a leaver's vault the moment the account is disabled, an SSO unlock whose key model is documented, and FIDO2 keys and passkeys supported for the vault itself.
- **The Compliance Auditor** (v1.0): Prepares the ISO 27001 and NIS2 evidence and has to show who could see the firewall admin password last March. Wants event logs that cover views and copies, export to the SIEM, enforceable policies, and the contracting entity, hosting and subprocessors named.
- **The SME Owner** (v1.0): Runs a forty-person company where the shared passwords currently live in an Excel file. Wants shared vaults the team actually uses, a way back in when someone forgets the master password, credentials handed over when someone leaves, and a per-user price with SSO not hidden two tiers up.
- **The DevOps Engineer** (v1.0): Would rather run the vault in the company's own data centre than trust another SaaS with root credentials. Wants a documented self-hosted deployment with backup and high availability, open-source code to read, a CLI and API for pipelines, and an export that loses nothing.
- **The Skeptic** (v1.0): Has read the breach post-mortems. Reads "zero knowledge" next to unencrypted URLs and item names, "independently audited" with no report, "SSO unlock" where the vendor holds half the key, and "admin recovery" that means the vendor can decrypt — and treats a missing incident history as an answer.

## European sovereignty — proven facts

Built only from facts on the vendor's own pages; a dimension we could not prove is left open, never scored as zero. Headline: not determined.

| Dimension | Finding | Points | Source |
|---|---|---|---|
| Legal entity | Not determined | — | — |
| Ownership | Not determined | — | — |
| Data residency | Not determined | — | — |
| Subprocessors | Not determined | — | — |

## Key facts

Each fact is the vendor's own statement, cited to the source page it was read from ([S*n*] → Sources).

**Compliance**
- Apec cbpr: yes · yes [S3]
- Automated decision making: no [S3]
- Center realtime: Compliance Center monitors security, certifications and policies in real time [S12]
- Dispute resolution: yes · TRUSTe [S3]
- Documentation: Documentation on technical, organizational, and compliance measures [S12]
- Dpf certified: yes · yes · yes [S3]
- Privacy program: Global privacy program [S12]
- Security assessment: yes [S3]
- Standards alignment: LastPass aligns with top-tier industry standards and certifications [S12]

**Data**
- No sale: no [S3]
- Privacy email: privacy@lastpass.com [S4]
- Retention: no longer than needed for business purpose or legal obligation [S3]
- Rights: access · export · rectification · deletion · restriction · objection · opt_out_sale_sharing · appeal [S3]
- Subprocessor requests: yes [S3]
- Vault access: no [S3]

**Hosting**
- Transfer mechanisms: Data Privacy Framework · Standard Contractual Clauses [S3]

**Integrations**
- Delivery: browser extension · desktop app · mobile app [S1]
- Managed companies admin users endpoint: GET /v1/managed-companies-reports/admin-users [S13]
- Managed companies billing cycles endpoint: GET /v1/managed-companies-reports/billing-cycles [S13]
- Managed companies billing reports endpoint: GET /v1/managed-companies-reports/billing-reports [S13]
- Siem: SIEM integrations: Splunk, Microsoft Sentinel [S2]
- Siem: Splunk · Microsoft Sentinel (Azure) [S2]

**Legal**
- Authorized representative: Patrick Murphy · General Counsel [S4]
- Childrens privacy: yes · no [S3]
- Contracting entities URL: https://www.lastpass.com/legal-center/contracting-entities [S5]
- Controller entity: LastPass US LP · United States of America [S3]
- Eea controller: EEA · Switzerland · LastPass Ireland Limited · Ella House, 41.2 Merrion Square, Dublin 2 D02 NP96, Ireland [S3]
- Entity: LastPass US LP [S12]
- Joint controllers: LastPass Ireland Limited · LastPass UK Ltd · LastPass US LP [S3]
- Registration number: 909570 · Commercial Register in Ireland [S4]
- Service provider: LastPass Ireland Limited · Ella House 41.2, Merrion Square, Dublin 2 D02 NP96, Ireland [S4]
- Site operator: LastPass US LP [S4]
- UK controller: UK · LastPass UK Ltd · 5 New Street Square, London EC4A 3TW, United Kingdom [S3]
- VAT number: IE3727972WH [S4]

**Pricing**
- Business: Business · 14 · annual · 6.5 [S1]
- Business: 6.5 [S2]
- Business features: >100 Sicherheitsrichtlinien, LastPass Families für Mitarbeiter, Benutzer- und Gruppenverwaltung [S1]
- Business max: Business Max · 14 · annual · 10 [S1]
- Business max: 10 [S2]
- Business max features: AI Monitoring & Protect, SaaS Monitoring & Protect, Web Monitoring & Protect, unbegrenzte SSO-Apps, Advanced MFA [S1]
- Business max price: USD · 11 [S10]
- Business max price: annually · 10 [S2]
- Business price: Business · USD · 7 [S8]
- Business price: annually · 6.5 [S2]
- Business trial: Business · 14 · no [S6]
- Business trial: yes · Business · 14 · yes [S12]
- Free trial: yes · no [S1]
- Free trial terms: yes · no [S9]
- No credit card: no [S2]
- No credit card: no [S2]
- Non card purchase order threshold: purchase order for non-credit-card transactions · 25000 [S5]
- Premium personal trial: 30 [S1]
- Price changes: end of current subscription term · website · email · quote · invoice [S5]
- Promo terms: Promotional pricing subject to separate terms; may not apply to current customers or partners [S2]
- Promotional terms: promotional pricing subject to separate terms, may not apply to current customers or partners [S2]
- Taxes: applicable taxes applied at checkout [S2]
- Teams: Teams · 14 · annual · 4.42 [S1]
- Teams: 4.42 [S2]
- Teams features: Admin-Konsole, freigegebene Ordner, Basis-Sicherheitsrichtlinien [S1]
- Teams price: annually · 4.42 [S2]
- Teams trial: 14 [S2]
- Teams user limit: up to 50 users · unlimited · unlimited [S2]
- Trial: yes · no [S8]
- Trial: 14 · no [S11]
- Trial no card: 14 · no [S3]
- Trial terms: 14 · no [S4]
- Trial terms: 14 · yes · no [S10]
- VAT: yes [S1]
- VAT note: yes [S2]

**Product**
- Access revocation: automatic update/revocation of access [S8]
- Active directory integration: lightweight client · yes [S11]
- Admin dashboard: directory integration · users · policies · reporting [S11]
- AI monitoring: shadow AI discovery, coming soon flag on first feature · yes [S2]
- Authentication hash: yes [S6]
- Business customer count: 100000+ [S7]
- Business features: Business adds 100+ policies, Families for employees, group user management [S2]
- Business features: everything in Teams · 100+ security policies · LastPass Families for employees · group user management · most admin controls [S2]
- Business max features: Business Max adds AI/SaaS/Web Monitoring & Protect, unlimited SSO apps, advanced MFA [S2]
- Business max features: AI Monitoring & Protect · SaaS Monitoring & Protect · Web Monitoring & Protect · unlimited SSO apps · advanced MFA [S2]
- Compliance center: yes [S7]
- Conditional access: High-risk region logins blocked, phishing-resistant MFA via hardware tokens [S7]
- Custom API: yes [S11]
- Customer scale: millions [S7]
- Customer scale: 100,000+ · Millions [S8]
- Dark web monitoring: yes [S2]
- Dark web monitoring: yes [S3]
- Dark web monitoring: 24/7 dark web / data breach monitoring [S8]
- Device encryption: All corporate devices encrypted with BitLocker or FileVault [S7]
- Dlp program: Data loss prevention program with blocking, detection and response analytics [S7]
- Emergency access capability: yes · Grant trusted LastPass users access to your vault, immediately or after a defined wait time [S9]
- Emergency access mechanism: invite by email, wait-time window, access granted if not denied [S9]
- Emergency access scope: Access covers passwords, accounts, and secure notes [S9]
- Encrypted vault: encrypted vault with unlimited passwords and notes [S2]
- Encrypted vault sharing: encrypted vault-to-vault sharing [S8]
- Encryption standard: PBKDF2-SHA-256 · yes · AES-256 · 600000 [S6]
- Endpoint protection edr: yes · yes [S7]
- Entra federated login: yes [S11]
- Entra group sync: yes · yes · yes [S11]
- Entra SCIM API: SCIM API [S11]
- Entra SCIM provisioning: yes · yes [S11]
- Every plan features: encrypted password vault · save and autofill · secure password sharing · password generator · dark web monitoring · security dashboard · multifactor authentication · AES-256 encryption [S2]
- External risk monitoring: Continuous monitoring for leaked credentials, impersonation, phishing disruption, customer alerts [S7]
- Families included: free LastPass Families account for every employee [S8]
- Families licenses: Families for employees: personal account plus 5 additional licenses [S2]
- Federated login: yes [S2]
- Federated login: yes [S2]
- Fido2: yes [S2]
- Fido2 passwordless: yes [S2]
- Free tier personal: Free LastPass offering advertised [S9]
- Google workspace integration: yes [S11]
- Granular access control: individual · group · organization [S10]
- Identity suite: SSO · EPM · MFA [S10]
- Key derivation: PBKDF2-SHA256 · 600000 [S6]
- Local encryption: yes [S6]
- Managed companies reports description: Access billing cycles, billing reports, and admin user reports across managed companies. [S13]
- Master password exception SSO: yes [S3]
- Master password local only: no [S6]
- MFA: yes [S2]
- MFA: multifactor authentication including biometrics [S8]
- MFA support: yes · yes [S11]
- MFA vpn coverage: cloud apps · legacy apps · VPN · workstations [S10]
- Network access sase: SASE solution with micro-segmentation and posture-validated conditional access [S7]
- Offline mode: yes [S2]
- Okta integration: SCIM API [S11]
- Onboarding automation: automated onboarding · offboarding · device setup · account deprovisioning [S10]
- Onelogin integration: SCIM API [S11]
- Password generation autofill: secure storage, password generation, autofill [S1]
- Password generator: built-in password generator [S8]
- Patching: Patching cycles prioritize high-risk applications [S7]
- Personal sharing encrypted: share passwords without revealing plain text password [S8]
- Ping integration: yes [S11]
- Policies: individual · group · organization · 100 [S10]
- Privileged access management: Privileged access elevations require documented business justification [S7]
- Related features: password_generator · security_dashboard · save_and_autofill [S9]
- Reporting: basic · advanced · advanced [S2]
- Reporting: basic · advanced · advanced [S2]
- Role based segmentation: Backend access segmented by user role [S7]
- Saas monitoring: yes [S2]
- Secure notes health info: Secure notes can store health information for emergency access [S9]
- Secure notes storage: 1 · secure notes file storage same across plans [S2]
- Secure notes storage: 1 [S2]
- Security encryption: zero-knowledge architecture, AES-256 local encryption [S2]
- Security policies: 25 · 100+ · 100+ [S2]
- Security policies limits: 25 · 100+ · 100+ [S2]
- Share item types: WiFi info · banking details · tax documents · credit cards · secure notes [S8]
- Shared folders: group shared passwords into folders [S8]
- Sharing center revoke: sharing center with share and revoke at any time [S8]
- Sms recovery: yes · yes [S3]
- SOC monitoring: 24/7 · 300+ [S7]
- SSO: yes [S11]
- SSO app catalog: SSO app catalog · custom APIs [S10]
- SSO limits: limited to 3 apps · unlimited [S2]

**Support**
- Customer success manager: account based, inquire with sales [S2]
- Customer success manager: account based (Business and Business Max), inquire with sales [S2]
- Personal: yes [S2]
- Portal: https://support.lastpass.com [S4]
- Privacy contact: privacy@lastpass.com · 125 High Street, Suite 220, Boston, MA 02210 [S3]
- Rights response time: 30 [S3]
- Self service: 24/7 Support Center, LastPass Community [S2]
- Self service: yes [S2]
- Support center: Support Center · yes [S8]

19 more facts on the canonical page: https://whats-best.ai/software/password-management/lastpass

## Questions

### Is LastPass European?

No. whats-best.ai classifies LastPass as Rest of world.

### Where does LastPass store data?

Not stated on the vendor’s pages as of 13 Oct 2026.

### Does LastPass have a free plan?

Not stated on the vendor’s pages as of 13 Oct 2026.

### What are the best alternatives to LastPass?

As of 21 Oct 2026, the panel rates [Password Depot (3.5/5)](https://whats-best.ai/software/password-management/password-depot), [Keeper (3/5)](https://whats-best.ai/software/password-management/keeper) and [Passbolt (3/5)](https://whats-best.ai/software/password-management/passbolt) highest among the other 18 Password Management products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is [Password Depot](https://whats-best.ai/software/password-management/password-depot) (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: [how scores are made](https://whats-best.ai/methodology#ordering). The full list, with European products first: [LastPass alternatives](https://whats-best.ai/software/password-management/lastpass/alternatives).

## What this page leaves out

- 18 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 12 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 11 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 5 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 3 support facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 1 data fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 1 hosting fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 2 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown.
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement.

## Sources

- [S1] Vendor homepage: https://www.lastpass.com/de (checked 2026-10-13)
- [S2] Pricing page: https://www.lastpass.com/pricing (checked 2026-10-13)
- [S3] Privacy policy: https://www.lastpass.com/legal-center/privacy-notice (checked 2026-10-13)
- [S4] Legal notice: https://www.lastpass.com/legal-center/impressum (checked 2026-10-13)
- [S5] Terms of service: https://www.lastpass.com/legal-center/terms-of-service/business (checked 2026-10-13)
- [S6] Encryption model & independent audits — found from sitemap: https://www.lastpass.com/security/zero-knowledge-security (checked 2026-10-13)
- [S7] Encryption model & independent audits — found from sitemap: https://www.lastpass.com/security/how-we-secure-lastpass (checked 2026-10-13)
- [S8] Sharing, roles & recovery — found from sitemap: https://www.lastpass.com/features/shared-folders (checked 2026-10-13)
- [S9] Sharing, roles & recovery — found from sitemap: https://www.lastpass.com/features/emergency-access (checked 2026-10-13)
- [S10] SSO, directory sync & provisioning — found from sitemap: https://www.lastpass.com/products/sso (checked 2026-10-13)
- [S11] SSO, directory sync & provisioning — found from sitemap: https://www.lastpass.com/features/federated-login/microsoft-entra (checked 2026-10-13)
- [S12] Audit logs, policies & reporting — found from sitemap: https://www.lastpass.com/trust-center/compliance (checked 2026-10-13)
- [S13] Audit logs, policies & reporting — found from sitemap: https://developer.lastpass.com/business/docs/managed-companies-reports.md (checked 2026-10-13)

---

Cite as: whats-best.ai, "LastPass — Password Management", AI panel analysis, as of 2026-10-21. https://whats-best.ai/software/password-management/lastpass

Corrections: https://whats-best.ai/correct/674?target=page