LastPass was breached in 2022 — encrypted vaults were exfiltrated, and attackers subsequently cracked master passwords of some users with weaker passwords. 1Password, by contrast, has no history of breach incidents. This isn't a normal product comparison; it's a 'is LastPass worth trusting anymore?' question that security professionals have largely answered.
1Password
1Password wins clearly. LastPass has rebuilt its infrastructure, but its breach history and the ongoing fallout make it hard to recommend when better alternatives exist at comparable prices.
Specs Comparison
| Spec | 1Password | LastPass |
|---|---|---|
| Individual price | $2.99/mo (annual) | $3/mo (annual) |
| Breach history | None | Major breach in 2022 |
| Security architecture | Zero-knowledge + Secret Key | Zero-knowledge (post-rebuild) |
| Free tier | No | Yes (1 device type) |
| Security community trust | High | Low (post-breach) |
The LastPass Breach
In late 2022, LastPass disclosed that attackers had obtained copies of encrypted customer vaults alongside email addresses, billing info, and IP data. The breach was significant: even though vaults were encrypted, users with weak master passwords were at real risk. Security researcher Troy Hunt and others documented cases of crypto wallets being drained after the breach.
LastPass has since rebuilt its infrastructure, improved encryption iterations, and changed leadership. Their security team argues the current architecture is sound. Most independent security experts remain skeptical and recommend migrating.
1Password's Track Record
1Password has never had a vault breach. The Secret Key architecture means even if 1Password's servers were compromised, encrypted vaults can't be decrypted without the device-local Secret Key. Security researchers on Hacker News and r/netsec consistently cite this architecture as meaningfully stronger than most competitors.
1Password completed a SOC 2 Type 2 audit and has been audited by independent security firms. The company has been transparent about its security model.
Pricing After the Breach
LastPass Individual is $3/mo (annual). LastPass Families (6 users) is $4/mo. 1Password Individual is $2.99/mo; Families (5 users) is $4.99/mo. They're priced nearly identically. There's no financial reason to choose LastPass over 1Password at these prices.
Bitwarden at $10/year is cheaper than both, and security researchers recommend either 1Password or Bitwarden over LastPass at this point.
1Password Strengths
- No breach history — clean security record
- Secret Key architecture adds device-level protection
- Best password manager UX in the industry
- Travel Mode for sensitive border situations
LastPass Strengths
- Rebuilt infrastructure post-breach
- Familiar interface for existing users
- Emergency Access feature for beneficiary access
- Similar pricing to 1Password
1Password Weaknesses
- No free tier for individuals
- Closed source
- Secret Key creates recovery complexity
LastPass Weaknesses
- 2022 vault breach — encrypted vaults were exfiltrated
- Trust deficit with the security community
- Free tier drastically restricted in 2021 (one device type only)
Best For
- a: Anyone starting fresh or migrating from LastPass who wants a proven, trusted password manager
- b: Existing LastPass users who've updated their master password and are comfortable staying — though most security experts recommend migrating
FAQ
Should I migrate from LastPass after the breach?
Most security professionals say yes. If your master password was strong (20+ random characters), your vault is likely still secure. But the trust damage and security community consensus make 1Password or Bitwarden better long-term choices.
How do I export from LastPass and import into 1Password?
Export a CSV from LastPass settings, then import via 1Password's built-in LastPass import tool. The process takes under 10 minutes. Delete the CSV from your device after import.