- Who owns LastPass and who makes it
- How LastPass says it protects your passwords
- The LastPass breach: what the company said happened
- What regulators and courts did after the breach
- Checking your own LastPass vault
- Habits that matter beyond LastPass
- Fake LastPass emails and downloads
- Where I land on LastPass
- Frequently asked questions
LastPass is a real, long-running password manager from Boston that says it uses zero-knowledge encryption, so it can't read your vault. The big caveat is its 2022 breach: LastPass says an attacker copied backups of customer vault data, with some fields such as website addresses left unencrypted. Your master password matters a lot.
Searching this question makes sense, because LastPass is it's the password manager that had a very public breach. So I don't think a yes or no helps you much. I've read LastPass's own security pages, its breach notice and what Wikipedia records about the aftermath, so you can judge it with the facts in front of you.
Who owns LastPass and who makes it
According to Wikipedia, LastPass was founded in 2008 by four developers and is headquartered in Boston, Massachusetts. LogMeIn, later renamed GoTo, acquired it in 2015. A spin-off from GoTo was completed in 2024, and Wikipedia says LastPass is now directly controlled by the private equity firms Francisco Partners and Elliott Investment Management. Karim Toubba has been CEO since 2022.
So this isn't a dodgy app from nowhere. It's an established company with named leadership and owners, which is why the breach got so much coverage.
How LastPass says it protects your passwords
LastPass says your vault data is protected using AES-256 encryption and 600,000 rounds of PBKDF2-SHA-256 hashing plus salting. It describes a zero-knowledge model: even as the provider, it says, LastPass has zero knowledge of your encrypted vault data. Only your plaintext master password, which it says isn't stored on its servers, will open what's inside.
That design is good in theory, but it also means one thing: the strength of your master password is the main lock on your vault. A short or reused master password is the weak link, whatever the encryption standard.
The LastPass breach: what the company said happened
This is the part to read slowly. LastPass said an attacker used information from the 2022 incident to reach a cloud storage environment and copied backup data. That included basic customer account information such as company names, end-user names, billing addresses, email addresses, phone numbers and IP addresses.
The attacker also copied a backup of customer vault data. LastPass said some fields, such as website URLs, were unencrypted, while sensitive fields stayed encrypted with 256-bit AES encryption and could be decrypted only with a key derived from each user's master password. It added that it had no evidence that unencrypted credit card data was accessed.
LastPass advised users with weaker master passwords to consider changing the passwords stored in their vaults, and recommended a twelve-character minimum for the master password. In other words, a stolen encrypted copy is a bigger risk the weaker your master password is. If you want to compare options, my side-by-side look at two rival password managers shows how two rivals describe their own set-ups.
What regulators and courts did after the breach
According to Wikipedia, the UK Information Commissioner's Office issued a monetary penalty against LastPass UK Ltd in 2025 over failures to implement appropriate technical and organisational measures, affecting over one million UK data subjects. I haven't confirmed the amount, so I'm not quoting one. Wikipedia also says LastPass settled a class action in 2025 for 24.5 million dollars over losses incurred by customers whose vaults were accessed.
| What I checked | What the record says |
|---|---|
| Who founded it? | Four developers in 2008, per Wikipedia |
| Where is it based? | Boston, Massachusetts |
| How are vaults protected? | AES-256 encryption and 600,000 rounds of PBKDF2-SHA-256, per LastPass |
| Was there a breach? | Yes, LastPass confirmed backups of vault data were copied |
| Is anything left unencrypted? | LastPass said some fields such as website URLs were |
Checking your own LastPass vault
I can't tell you what's right for your accounts, but here are the questions worth asking if you use LastPass or are thinking about it:
Want AI doing the heavy lifting in your marketing?
I build the systems that handle the boring 80 percent, so you get your week back. Done properly, with the human kept in.
- How long and unique is your master password? LastPass recommends a twelve-character minimum.
- Did you change the passwords stored in your vault after the breach news, as LastPass advised for weaker master passwords?
- Is two-step verification switched on for your most important accounts, including your email?
- Would the website addresses stored in your vault give away anything sensitive about you?
If your email or social accounts ever feel compromised, my guide to checking whether an account was hacked walks through the signs.
Habits that matter beyond LastPass
Whatever tool you pick, the habits matter as much as the brand. Use a long, unique master password you haven't used anywhere else, switch on extra verification where it's offered, and don't store your master password in a note on your phone. If you run a small business, give each team member their own login rather than sharing one vault password. For a more detailed example of how one rival presents itself, see my review of another password manager, and for site-level security, these tips for keeping hackers off a business website cover the basics.
Fake LastPass emails and downloads
A breach story is exactly what scammers piggyback on. Watch for emails or texts that claim your LastPass vault is at risk and push you to log in through a link. Go to the official website or the app store listing yourself, and never give your master password to someone who calls, messages or emails you. LastPass says it never knows your master password, so a real support agent has no reason to ask for it.
Where I land on LastPass
It's a real company with a clear security design, and it also has a confirmed breach on its record that regulators and courts have since looked at. Whether that's a dealbreaker is your call. If you stay, make the master password long and unique and turn on extra verification. If you're unsure, read how it compares with other password managers before moving anything.
Frequently asked questions
Is LastPass a legitimate company?
Yes. According to Wikipedia, LastPass was founded in 2008, is headquartered in Boston, Massachusetts and is now controlled by Francisco Partners and Elliott Investment Management.
Was LastPass hacked?
LastPass confirmed that an attacker copied backup data and a backup of customer vault data after the 2022 incident. It said sensitive fields stayed encrypted, while some fields such as website URLs were not.
Can LastPass see my passwords?
LastPass says it has zero knowledge of your encrypted vault data and that your master password isn't stored on its servers.
What encryption does LastPass use?
LastPass says vault data is protected using AES-256 encryption and 600,000 rounds of PBKDF2-SHA-256 hashing plus salting.
Should I change my master password?
LastPass advised users with weaker master passwords to consider changing the passwords stored in their vaults and recommends a twelve-character minimum. Check its latest guidance for your situation.
