Password managers
LastPass privacy rating
Closed source password manager from LastPass US LP with browser extensions, desktop and mobile apps. Vaults are encrypted on the device, and a past breach exposed copies of customer vault backups that also held unencrypted website URLs.
Summary
LastPass scores 45 out of 100 (grade D) on the password managers criteria. It meets 3 of 11 criteria: tells users about requests, TLS configuration and end-to-end encrypted vault. It partly meets no ads or data sales, transparency report, security headers, local or self-hosted option and full export. It does not meet open source, no trackers or telemetry and independent audit. It is based in the United States: Five Eyes member; subject to the US CLOUD Act. Automated tests: SSL Labs grade A+ and Mozilla HTTP Observatory grade B.
Score 45 out of 100. How scoring works
Criteria
- No
-
No
No trackers or telemetry Weight 3 of 3
Are the website and apps free of third-party trackers, with any analytics anonymous and any telemetry off by default?
The Android app contains Google Firebase Analytics, Crashlytics, Pendo and Segment, and the website loads Google Tag Manager.
-
Partial
No ads or data sales Weight 2 of 3
Is the product funded without advertising, ad targeting or selling user data?
Funded by subscriptions, but the privacy notice says third-party cookies for personalized advertising may count as a sale or sharing of personal data.
-
No
Independent audit Weight 2 of 3
Has an independent security or privacy audit been published within the last three years?
No independent audit report is published.
-
Partial
Transparency report Weight 2 of 3
Does the provider regularly publish how many government and legal requests it receives and how it responds?
Publishes law enforcement request guidelines but no request counts.
-
Yes
Tells users about requests Weight 1 of 3
Does the provider promise to tell users about requests for their data, unless a court forbids it?
Notifies customers before disclosing data unless legally prohibited or there is a risk of harm.
-
Yes
End-to-end encrypted vault Weight 3 of 3
Is the vault encrypted on the device before it is synced, with a key the provider does not hold?
Vault data is encrypted on the device with a key derived from the master password. Stolen vault backups included unencrypted website URLs.
-
Partial
Local or self-hosted option Weight 2 of 3
Can the vault be kept locally or on your own server?
Vaults are stored only in the LastPass cloud. Data can be exported.
-
Partial
Full export Weight 1 of 3
Can every item be exported in an open format?
Exports vault items to unencrypted CSV, without attachments.
Automated tests
-
Yes
TLS configuration Weight 2 of 3
Does the website pass the Qualys SSL Labs test with a grade of A or better?
Grade A+
-
Partial
Security headers Weight 1 of 3
Does the website pass the Mozilla HTTP Observatory test with a grade of A or better?
Grade B (70/100+)
-
Not tested yet
Modern web standards Weight 1 of 3
Does the website score 90% or higher on the Internet.nl website test?
Not tested yet.