Open source alternatives to LastPass

What LastPass does

LastPass keeps passwords, passkeys and secure notes in an encrypted vault, generates passwords and usernames, and fills logins in Chrome, Firefox, Safari and on Android and iOS. It warns about weak, reused and old passwords, monitors the dark web for your details, lets you share items with family, friends and colleagues, and offers emergency access to a trusted contact. Business plans add directory integration and federated login.

Why people look for an alternative

• The 2022 security incidents. LastPass reports that in August 2022 an attacker used a compromised developer account to reach its development environment and take source code and technical information. Using what was taken, the attacker later accessed cloud storage and copied customer account data and a backup of customer vaults. LastPass says the backup held encrypted fields, such as usernames, passwords, secure notes and form data, alongside unencrypted data such as website URLs, and that the encrypted fields can only be decrypted with a key derived from each user’s master password.
• Free plan limits. The Free plan works either on computers or on mobile devices, not both, and hardware security keys for login are a Premium feature.
• No self-hosting. Vaults are stored only in LastPass’s cloud.

What to compare in an alternative

1. What is encrypted. Check whether website addresses and other metadata are encrypted too, not only passwords and notes.
2. Free use across devices. Whether a free tier syncs between computer and phone.
3. Hosting choice. A provider’s cloud, your own server, or a local file.
4. Audits and disclosure. Recent independent audits and how findings were published.
5. Migration. Bitwarden, Passbolt and Teampass import LastPass exports; plan to delete the exported file afterwards.
6. Recovery and emergency access. What happens if you forget the master password or someone needs access after an emergency.

Which one to choose

Bitwarden is the most direct replacement: browser extensions and apps everywhere, a free cloud plan that syncs all your devices, emergency access in Premium, organizations for families and companies, and a LastPass importer. People who want to host it themselves often use Vaultwarden, which works with the official Bitwarden apps and runs in a single container. Companies moving from LastPass Business that mostly share credentials between teams should compare Passbolt, which encrypts each shared secret per user with OpenPGP and can also encrypt metadata such as names and URLs. If you would rather not trust any server, KeePassXC keeps the whole vault, URLs included, inside one encrypted file you store and sync yourself. The password manager guide explains the trade-offs.