This comparison cannot be written honestly without addressing one thing first, so it goes at the top rather than buried under a feature table.
LastPass disclosed a serious security incident in 2022 in which attackers exfiltrated customer vault data. LastPass’s own published incident notices confirmed that a threat actor obtained a backup of customer vault data containing both unencrypted fields, such as website URLs, and encrypted fields including usernames and passwords, and separately obtained encrypted backups including customer information.
The encrypted contents remain protected by each user’s master password. That means the practical exposure depends on master password strength and the account’s key-derivation iteration count — and older LastPass accounts were on substantially lower iteration settings than the then-current defaults, which weakens resistance to offline cracking.
Security professionals widely advised affected users to rotate credentials. If you have a LastPass vault from before 2023 and have not rotated your important passwords, that is worth doing regardless of which product you end up using.
This is not a reason nobody can use LastPass. It is a fact that belongs at the front of any comparison of the two, and readers should weigh it themselves.
The Architectural Difference
Beyond the incident, the two products differ in a way that is directly relevant to what happened.
1Password uses a Secret Key in addition to your master password. This is a 128-bit key generated on your device at setup, never transmitted to 1Password’s servers, and combined with your master password to derive the encryption key.
The consequence: a server-side breach at 1Password would not give an attacker something they can brute-force offline, because they would be missing a high-entropy key that never existed on 1Password’s infrastructure. Authentication also uses SRP, so the master password itself is never sent over the network.
LastPass uses master password derivation alone, with PBKDF2 iterations as the work factor. If encrypted vaults leave the building — which they did — the only barrier is how strong your master password was and how many iterations your account used.
That is precisely the scenario the Secret Key design exists to prevent. It is a genuine architectural advantage, not marketing.
Feature Comparison
| 1Password | LastPass | |
|---|---|---|
| Secret Key / second factor in encryption | Yes | No |
| Free tier | No, trial only | Yes, limited |
| Breach monitoring | Watchtower | Yes |
| Travel Mode | Yes | No |
| Passkey support | Yes, early adopter | Yes |
| Family sharing | Strong | Yes |
| Developer tooling (CLI, SSH) | Best in class | Limited |
| App quality | Excellent | Adequate |
| Self-hosting | No | No |
| Open source | No | No |
| Major vault breach | No | Yes, 2022 |
Pricing changes periodically for both. Verify current individual, family and business pricing directly.
Where LastPass Still Competes
Being fair rather than piling on.
It has a free tier. 1Password does not. For someone who will otherwise reuse passwords across sites, a free password manager is better than none — though Bitwarden’s free tier is more generous and does not carry this history.
It is familiar. Large numbers of people and businesses already use it, and migration has a cost.
The company has invested in remediation. LastPass has published updates on security improvements, raised default iteration counts and forced upgrades for older accounts. Whether that is sufficient is a judgement each user makes.
Where 1Password Wins
The encryption architecture, as above. This is the substantive point.
App quality. The most polished in the category, and this matters practically — a password manager only works if people actually use it, and family members abandon awkward ones.
Watchtower surfaces reused passwords, weak passwords, credentials in known breaches and sites where you have not enabled two-factor. This is the feature most likely to improve your security in week one.
Travel Mode removes vaults you have not marked travel-safe from your devices. Relevant for journalists, lawyers and anyone crossing borders with sensitive client data.
Developer tooling. The CLI, SSH agent and secrets injection are genuinely best in class and a real reason engineering teams choose it.
Which Should You Choose?
Choose 1Password if: you can pay, you want the strongest encryption model available in a mainstream product, app quality matters for family or team adoption, or you have developer requirements.
Choose LastPass if: you have assessed the 2022 incident and are satisfied with the remediation, you need a free tier and prefer it to alternatives, or migration cost across a large organisation genuinely outweighs the concern.
Consider Bitwarden instead of both if: you want free — its free tier covers unlimited passwords on unlimited devices, it is open source, it publishes third-party audits, and it can be self-hosted. For a large share of people asking this question, Bitwarden is the better answer than either.
If You Are Leaving LastPass
The migration itself is straightforward. The security hygiene around it is what matters.
- Export from LastPass to CSV.
- Import into the new manager. Both 1Password and Bitwarden have documented LastPass importers.
- Verify everything came across — logins, secure notes, cards, TOTP codes. Attachments and some field types are the usual casualties.
- Securely delete the export file. It is an unencrypted plaintext file containing every credential you own. Do not leave it in Downloads, and do not let it sync to cloud storage.
- Rotate your important passwords. This is the step specific to leaving LastPass. If your vault predates 2023, treat those credentials as potentially exposed and change the ones that matter — email, banking, anything financial, anything with payment details stored.
- Re-enrol two-factor codes where TOTP did not migrate cleanly, before you lose access to the old account.
- Delete the LastPass account once verified, rather than leaving it dormant.
Step 5 is the one people skip and it is the reason to migrate at all.
Common Mistakes to Avoid
- Migrating without rotating passwords. If your LastPass vault predates 2023, moving it elsewhere does not undo the exposure. Rotate what matters.
- Leaving the plaintext export on disk. The most dangerous hour in any password manager migration.
- Assuming TOTP codes transferred. Verify each before closing the old account.
- Reusing your old master password. Choose a new, strong, unique one.
- Not saving 1Password’s Emergency Kit. It contains your Secret Key. Lose it and your devices, and the vault is unrecoverable by design.
- Storing the Emergency Kit inside the vault. People genuinely do this.
- Leaving the old account dormant. Delete it once you have verified the migration.
- Choosing on price alone. The annual difference is small next to the consequences of a compromised vault.
FAQs
Was LastPass hacked?
Yes. LastPass disclosed incidents in 2022 in which a threat actor obtained a backup of customer vault data, containing unencrypted fields such as URLs alongside encrypted username and password fields. Encrypted contents remain protected by each user’s master password, so exposure depends on password strength and the account’s iteration count.
Is LastPass safe to use now?
LastPass has published remediation work and raised default iteration counts. Whether that is sufficient is a judgement you should make yourself after reading their published notices. What is not in dispute is that users with pre-2023 vaults should rotate important credentials.
Is 1Password more secure than LastPass?
Architecturally, yes — the Secret Key means a server-side breach does not expose vaults to offline brute-forcing, which is precisely the scenario that occurred at LastPass. That is a design difference, not a marketing claim.
Should I switch from LastPass?
If you are comfortable with the incident and remediation, staying is defensible. If you switch, the important part is rotating your credentials, not the migration itself.
Is there a free alternative to both?
Bitwarden. Its free tier covers unlimited passwords across unlimited devices, it is open source, it publishes third-party audits, and it can be self-hosted. For many people asking this question it is the better answer than either product here.
What happens if I lose my 1Password Secret Key?
If you also lose access to every signed-in device, your vault cannot be recovered — by you or by 1Password. That is the intended behaviour of a zero-knowledge system. Print the Emergency Kit and store it physically.
Key Takeaways
- LastPass suffered a 2022 breach in which encrypted customer vaults were exfiltrated. That belongs at the front of this decision.
- 1Password’s Secret Key means a server breach does not expose vaults to offline cracking.
- If your LastPass vault predates 2023, rotate important credentials whether or not you switch.
- Bitwarden is likely the better answer for anyone who needs a free tier.
- The dangerous moment in migration is the plaintext export file. Delete it securely.
Making the Call
If you are paying either way, 1Password’s architecture is the stronger position. If you need free, use Bitwarden rather than LastPass’s free tier. Either way, if you have held a LastPass vault since before 2023, rotate your important passwords this week — that matters more than which product you choose.
For more, see our 1Password review, 1Password alternatives, and password managers for small businesses.