This is not a simple “safe versus unsafe” comparison. LastPass disclosed that an attacker copied customer-vault backups during its 2022 security incidents. The sensitive vault fields were encrypted, while some metadata—including website URLs—could be present in less-protected form. 1Password uses a different account model built around an account password and Secret Key. The useful decision is whether each provider’s security history, recovery design, features, and price fit your risk tolerance.
Quick answer
Choose 1Password if a separate Secret Key, Emergency Kit, family recovery tools, and a clean publicly documented track record since launch matter more than having a free plan. Consider LastPass only after reading the incident disclosures, verifying its current security controls and pricing, and deciding whether you are comfortable with the residual risk and the work of rotating credentials. If you already use LastPass, do not panic-delete the vault: secure the account, assess your master-password strength, and migrate methodically if you decide to leave.
What LastPass disclosed in 2022
LastPass’s December 22, 2022 notice says an unauthorized party accessed a third-party cloud storage service holding archived production backups. The copied vault backup contained unencrypted account metadata such as website URLs and fully encrypted fields such as usernames, passwords, secure notes, and form-fill data. LastPass says encryption and decryption occurred on the local client and that master passwords were not known to LastPass. LastPass security-incident notice
LastPass’s March 2023 update provides additional detail about the data accessed and describes response actions, including credential rotation, changes to privileged access controls, and additional security technologies. LastPass incident update and recommended actions
The practical implication is conditional, not binary:
- A strong, unique master password makes offline cracking of encrypted vault fields harder.
- A weak or reused master password increases the danger because an attacker can work against copied encrypted data away from the service.
- URLs, email addresses, and other metadata can reveal useful information even when passwords remain encrypted.
- Phishing and credential-stuffing risk remain relevant after any breach disclosure.
Do not repeat the outdated claim that “nothing was compromised,” and do not claim that every LastPass password was instantly exposed. The published facts support a more precise assessment.
1Password’s account model
1Password uses an account password together with a randomly generated Secret Key. 1Password says the Secret Key works with the account password to encrypt and protect data, is stored on trusted devices and in the Emergency Kit, and is not a password-reset code. 1Password Secret Key and Emergency Kit
1Password describes its current security design as a two-secret-key derivation model in which decryption happens locally on trusted devices. That is a meaningful architectural difference from a password-only discussion, but it creates its own responsibility: protect the account password, Secret Key, and recovery materials. 1Password pricing and security explanation
No provider’s past record guarantees future security. Treat “no comparable publicly disclosed breach” as a track-record observation, not proof of invulnerability.
Pricing and plan fit
1Password currently lists Individual and Families plans, with monthly and annual billing, a 14-day trial, and family administration features. Its personal page says Families can invite up to five members, share unlimited vaults, and use administrator controls. 1Password personal and family plans
LastPass pricing and included features vary by individual, family, and business plan. Verify the current pricing page, renewal price, device support, family seats, emergency access, authenticator, and breach-monitoring features before relying on an old comparison. LastPass pricing
Compare the two-year cost—not only the first promotion—and include the value of any features you would otherwise buy separately. A free or discounted plan is not a security advantage if it causes you to reuse credentials or skip MFA.
Security features beyond the vault
1Password documents passkeys, Watchtower security alerts, Travel Mode, secure sharing, and recovery tools. Confirm the exact plan and platform support before treating any feature as included. 1Password passkeys · 1Password security
LastPass documents encrypted vault storage, MFA, password generation, secure notes, sharing, and security controls. Its current security page says it uses 256-bit AES and PBKDF2 with SHA-256 hashing and salting, and that vault data is decrypted on the user’s device. LastPass security overview
Neither provider’s marketing feature list tells you how well autofill works on your own bank, work, and two-factor-login sites. Test those sites before importing your entire vault.
If you currently use LastPass
Do not export the vault to an unencrypted folder and leave it there. A careful migration looks like this:
- Change the LastPass master password if it is weak, reused, or uncertain.
- Enable MFA and verify the account’s recovery methods.
- Identify high-value accounts and rotate their individual passwords first.
- Create a protected export and import a small sample into the destination manager.
- Verify usernames, URLs, secure notes, attachments, shared access, and one-time-code fields.
- Recreate passkeys where the destination cannot import them.
- Securely delete temporary export files and revoke old sessions after verification.
LastPass’s own incident guidance warned users about phishing and brute-force attempts. Never provide a master password or click a “security update” link from an unsolicited message. LastPass incident guidance
Who should choose which?
1Password is the better fit when: you want the Secret Key/Emergency Kit model, family account recovery, Travel Mode, and a paid product whose workflow you can test during a trial.
LastPass may still fit when: you have a well-managed account, a strong unique master password, current MFA, a documented incident-response plan, and a compelling reason to keep its existing workflow or business integrations.
Switching is sensible when: the breach history conflicts with your risk tolerance, your master password was weak or reused, you cannot verify the account’s current security posture, or another manager’s recovery and sharing model better fits your household or business.
A fair 20-minute comparison test
- Install each browser extension and mobile app.
- Add two low-risk test logins and one secure note.
- Test autofill on a difficult website and an app.
- Create or use a passkey on a second device.
- Test family/shared-vault access and revoke it.
- Locate the recovery code, Secret Key, Emergency Kit, or account-recovery process.
- Read the current renewal price and cancellation terms.
- Export one test record, import it elsewhere, and securely delete the file.
Frequently asked questions
Were LastPass passwords exposed in the 2022 incident?
LastPass said copied vault backups contained encrypted sensitive fields and some unencrypted metadata. Whether a specific password could be recovered depended heavily on the strength of the master password and the attacker’s offline cracking effort. The incident was serious, but “every password was immediately exposed” is not supported by the disclosure.
Is 1Password safer than LastPass?
1Password’s Secret Key architecture and different public incident history may make it preferable for some buyers. That is a risk-based judgment, not a mathematical guarantee. Both still require strong account credentials, MFA, safe recovery, and updated software.
Does 1Password have a free plan?
1Password currently promotes a time-limited trial rather than an equivalent permanent free personal plan. Check the current personal and family pricing before subscribing.
Should I change every password after leaving LastPass?
Prioritize financial, email, work, administrator, and reused credentials first. A full rotation is prudent when the old master password was weak or reused, or when you cannot establish that the vault was protected by a strong unique master password.
Can I move passkeys between password managers?
Not always. Passkey portability depends on the provider, device, browser, and credential type. Plan to re-register important passkeys after migration and keep the old account available until the new sign-ins work.
Sources and verification notes
- LastPass: December 22, 2022 security-incident notice — copied backup contents, encrypted fields, metadata, and local decryption claims.
- LastPass: March 2023 incident update — accessed data and response actions.
- LastPass: current security overview — current encryption, hashing, zero-knowledge, and security-practice claims.
- LastPass pricing — current plans and billing.
- 1Password: Secret Key — Secret Key, Emergency Kit, and account-recovery limits.
- 1Password: personal and family plans — current plan structure, family features, and trial.
- 1Password: passkeys — current passkey support.
- 1Password: security — current security documentation.