LastPass alternatives, and how to move a vault without losing it

This migration is different

Most switching guides are about money. This one is about a file.

In 2022, an attacker obtained backups of LastPass customer vaults. The password fields inside were encrypted with each user’s master password — but the site URLs were not, so anyone holding those backups can see exactly which services each victim used, and can run offline guesses against the master password with no rate limit and no lockout. That work continues years later, and it gets cheaper every year.

So the question is not only “which password manager is better”. It is “what is the correct order of operations to get out safely”, and the order matters more than the destination.

Do these three things in this order

Change the master password and enable two-factor authentication on the LastPass account. Everything else runs through this account, and it should not still be protected by a password you chose in 2021.

Export, import, delete. The CSV export is plaintext. It should exist for minutes, not days, and it should never touch a synced folder, an email or a cloud drive.

Rotate. Email first, then banking, then anything with a card stored, then everything you have reused. Moving your vault to a new product does not undo a password that was stolen — only changing the password does.

Choosing where to go

Bitwarden is the right default. It is open source, audited annually by Cure53 with the reports published, it imports LastPass exports cleanly, and its free tier does the thing LastPass free stopped doing in 2021: sync across all your devices. Paid is $10 a year, which is a tenth of what some rivals charge.

1Password is the right answer if the breach itself is what frightened you. Its Secret Key is a second 128-bit secret stored only on your devices, so a stolen server-side vault cannot be brute-forced with a master password alone. That is a direct architectural answer to how the LastPass theft played out.

Proton Pass is the right answer if you want the ownership to be different in kind. A Swiss non-profit foundation holds the controlling stake, the code is open, and email aliasing through SimpleLogin is built in rather than bolted on. It is also the youngest product here.

Keeper is the right answer when the vault is shared with colleagues rather than family: per-record keys, deep admin controls and the compliance paperwork enterprises ask for.

Our full password manager ranking scores all of them on the same formula, and explains why LastPass sits on the avoid list rather than the chart.

What “zero knowledge” is worth without an audit

Every product in this category says it cannot read your vault. That claim is either checkable or it is not.

Bitwarden, 1Password and Proton Pass publish independent audit reports. There is no comparable published independent audit of LastPass’s current architecture. After an incident in which vault backups left the building, an unverifiable claim is not a reassurance — it is the same promise, repeated.

After you have moved

Keep the LastPass account alive, empty and locked for a couple of weeks in case something was missed in the import. Then delete it properly through the account-deletion flow rather than just removing the browser extension, which leaves the account and its stored data intact.

Then, once a year, check whether your addresses have appeared in anything new with the email breach checker. Migration is a day’s work. Rotation is what actually closes the hole.