LastPass vs 1Password: Price, Security and Which to Choose

LastPass and 1Password are both built around the same promise — one master credential that unlocks every other password you own — but they have taken very different paths to get there. 1Password pairs your password with a locally stored Secret Key and has no public history of a vault-level compromise. LastPass went through a well-documented 2022 security incident, has since rebuilt large parts of its security program, and now undercuts 1Password on price for individuals and families. For anyone typing "lastpass vs 1password" into a search bar in 2026, usually because they already have a LastPass account and are wondering whether to leave, the short answer is: 1Password costs a little more and has the cleaner security track record; LastPass is cheaper and has made real changes since 2022, but the breach history is the thing you have to weigh for yourself.

Pricing compared: LastPass vs 1Password in 2026

Both companies price around a free-to-cheap individual tier, a family plan for up to five or six people, and per-seat business tiers. LastPass is the cheaper option across the board, and it still offers a genuinely free tier — something 1Password dropped years ago in favor of a 14-day trial. 1Password raised its individual and family prices in March 2026, which narrowed but didn't close the price gap. Current list pricing from each company's own pricing page and 1Password's pricing page looks like this:

Two caveats worth flagging. First, both companies run promotions and regional pricing frequently, so treat these as list prices to confirm at checkout rather than fixed numbers. Second, LastPass's free tier comes with a real restriction most people don't notice until they hit it: you can sync across multiple computers or multiple mobile devices, but not both categories at once, which is the main thing Premium removes.

Security architecture and encryption

Both products are built on the same core idea — a zero-knowledge vault, encrypted on your device before anything touches the company's servers, so neither company can read your stored passwords even if compelled to. The implementation differs in one meaningful way.

LastPass encrypts vault data with AES-256, with the encryption key derived from your master password through a key-derivation function. As LastPass puts it on its own security page, the master password "is never known to LastPass and is not stored or maintained by LastPass" — which means LastPass genuinely cannot decrypt your vault for you if you forget it, but it also means your vault's real-world security is only as strong as that one password.

1Password adds a second, machine-generated component on top of your password. Every account gets a locally stored, 128-bit encrypted Secret Key, generated once at sign-up and never transmitted to 1Password's servers. 1Password's own description of this is that the combination of "a password — which we never store and only you know — and a 128-bit encrypted Secret Key" forms a "dual-key" model, so that, in the company's words, "even we can't see exactly what you've saved in 1Password." Logging in also uses the Secure Remote Password (SRP) protocol, which 1Password says "authenticates your account without sending your credentials over the Internet." You can read the technical breakdown on 1Password's own Secret Key support page.

In practice, this means an attacker who only has your 1Password master password — say, from a phishing page or a reused-password leak elsewhere — still can't unlock your 1Password vault without the Secret Key, which never leaves your own devices. A LastPass vault, by contrast, is unlocked by the master password alone. Both approaches are standard practice in password management, and both are reasonable; 1Password's extra key is simply an additional barrier that doesn't depend entirely on password strength.

The LastPass 2022 security incidents, explained

This is the part of the comparison most people searching "lastpass vs 1password" actually want answered, so here is what LastPass has disclosed, in order, sourced to the company's own incident notices.

• August 25, 2022: LastPass disclosed that an unauthorized party had gained access to "portions of the LastPass development environment through a single compromised developer account" roughly two weeks earlier, and took "portions of source code and some proprietary LastPass technical information." At that point, the company stated there was "no evidence that this incident involved any access to customer data or encrypted password vaults."
• September 15, 2022: Following an investigation with the incident-response firm Mandiant, LastPass confirmed the intruder's activity in the development environment was confined to a four-day window in August, and again reported no evidence that customer data or vaults were accessed in that incident.
• December 22, 2022: LastPass published a follow-up notice disclosing a second, related incident: the same attacker used source code and technical information stolen in August to target a LastPass engineer and obtain credentials that gave access to a cloud-based backup storage environment, separate from LastPass's production systems. From there, the attacker copied basic account information — company names, end-user names, billing addresses, email addresses, phone numbers, and the IP addresses customers had used to access LastPass — along with a backup of customer vault data.
• What was and wasn't encrypted in that vault backup: according to LastPass's own December update, the vault backup used a proprietary binary format where some fields, such as website URLs, were not encrypted, while sensitive fields — usernames, passwords, secure notes, and form-filled data — were encrypted with 256-bit AES, with each user's unique key derived from that user's master password. LastPass reiterated that master passwords are never stored by LastPass and are not part of what was taken.
• Business customers using Federated Login (SSO): LastPass stated that these accounts use a hidden master password split into fragments stored separately, and that the attacker did not obtain those fragments, so SSO-based business users did not need to take additional action as a result of this incident.

Put plainly: LastPass's encrypted vault data was copied in late 2022, but it was still encrypted, and decrypting it depends on the strength of each user's individual master password — LastPass itself never had that password to lose. That's a materially different situation from a breach that exposes plaintext passwords, but it's also why security researchers at the time urged LastPass users, especially anyone with a short or reused master password, to rotate it and move to a stronger, unique one. In the years since, LastPass has published hardening guidance, rolled out passkey support, and continued to disclose updates through its own blog rather than through third parties — which is the standard it should now be held to going forward.

Two-factor authentication, passkeys, and hardware keys

Both services have converged on roughly the same modern authentication options, though the companies describe their rollouts differently.

LastPass added general-availability passkey support in August 2025, letting users create, store, and manage passkeys directly inside the vault alongside passwords. As the company describes it, only the public key is ever shared with a website — the private key stays encrypted inside the user's LastPass vault. LastPass also supports authenticator apps, biometric and FIDO2-based passwordless vault login, and hardware security keys such as YubiKeys on Premium, Families, Teams, and Business plans.

1Password supports passkey storage and autofill across its browser extensions and apps as well, alongside authenticator-app codes, hardware security keys, and biometric unlock (Face ID, Touch ID, Windows Hello) for unlocking the vault itself on supported devices. Both companies treat passkeys as a first-class credential type now, not a bolt-on feature, which matters if you're trying to reduce how many accounts still rely on a typed password at all.

Core features: autofill, sharing, and breach monitoring

Day-to-day, the two apps look more alike than different: browser extensions for every major browser, mobile apps for iOS and Android, autofill for logins and payment cards, secure notes, one-to-one item sharing, and some form of breach or dark-web monitoring that flags reused or exposed passwords. 1Password's version of this is called Watchtower, which flags weak, reused, and breached passwords and vulnerable items directly in the vault. LastPass bundles dark web monitoring into every tier, including the free plan, and offers an emergency access feature that lets a trusted contact request vault access after a waiting period you set. Where 1Password tends to pull ahead is in extras built for people already deep into other tooling — a command-line tool (the 1Password CLI) and developer-focused secrets management — while LastPass leans toward broader admin policy controls in its business tiers.

Platform and browser support

Neither company gives you a reason to rule it out on platform grounds. Both ship native apps for Windows, macOS, Linux, iOS, and Android, plus browser extensions for Chrome, Firefox, Edge, Safari, and Brave. Both support biometric unlock on mobile and desktop where the hardware allows it. If you live in a particularly unusual environment — a locked-down enterprise Linux desktop, for instance, or an older browser your IT department won't let you upgrade — it's worth checking each company's own system-requirements page before switching, but for the vast majority of people choosing between the two, platform coverage is a non-issue.

Family and business plans

For households, LastPass Families covers up to six individual accounts for about $4 a month with shared folders and a family-manager dashboard, while 1Password Families covers up to five members for about $5.99 a month and adds a shared family vault plus account-recovery options if someone loses their password. For small teams, 1Password's flat-rate Teams Starter Pack (around $24.95 a month for up to ten people) can work out cheaper than LastPass's per-seat Teams plan once you're above a handful of users, while larger organizations will compare LastPass Business and Business Max against 1Password Business on policy depth, SSO support, and directory/SIEM integrations rather than price alone.

Which to choose in 2026

If you're starting from zero, with no existing vault to migrate, 1Password is the easier recommendation: it has no public history of a vault-level breach, the Secret Key adds a second layer that doesn't depend on password strength alone, and the price gap with LastPass has narrowed to a few dollars a year. If you're already a LastPass user evaluating whether to leave, the honest framing is that the specific data taken in 2022 was encrypted, LastPass never had your master password, and the company has since shipped passkeys and kept disclosing incidents on its own blog rather than letting them leak out through third parties — but the breach happened, it's public record, and only you can decide how much weight that carries against LastPass's lower price and still-generous free tier. Either product is a significant upgrade over reusing passwords or storing them in a browser with no master password at all; the real mistake, in both cases, is picking a weak or reused master password, which the NIST digital identity guidelines have long flagged as the single biggest point of failure in any password-manager setup. If you want a third and fourth option before deciding, pandromeda's comparisons of Bitwarden, 1Password, and Proton Pass and of 1Password against Dashlane cover two more credible alternatives if neither LastPass nor 1Password feels right.

What to do next

If you're switching away from LastPass, start by exporting your vault from inside the LastPass app (not through a browser extension alone) and importing it into 1Password's own setup flow, which walks through mapping categories so logins, notes, and payment cards land in the right place. If you're staying on LastPass, the single highest-value step is making sure your master password is long, unique, and not reused anywhere else, then turning on passkey support or a hardware key wherever the sites you use support it. And if you're choosing between these two for the first time, don't stop at this one comparison — if your accounts are mostly inside the Apple or Google ecosystem already, it's worth reading how LastPass and 1Password stack up against the password managers already built into your phone in our look at Google Password Manager versus Apple Passwords before you pay for either one.

Written bySana Qureshi

Sana Qureshi runs the security and privacy desk. She reports on actively exploited vulnerabilities, vendor patches and data breaches, and covers the password managers, VPNs and authentication tools readers use to protect themselves. Her alerts cite vendor advisories, CISA and the CVE record directly.

More from Sana QureshiAll Security & Privacy coverage