What LastPass itself disclosed
LastPass said that in August 2022 an attacker accessed parts of its development environment through a compromised developer account and took source code and technical information [1]. Its 22 December 2022 update said the attacker later copied backup data from cloud storage, including customer account information and a backup of customer vault data.
According to LastPass, the vault backup held encrypted fields such as usernames, passwords, secure notes and form-fill data, and unencrypted fields such as website URLs [1]. The encrypted fields depend on a key derived from each user’s master password, which LastPass says it never knows. It told users with non-default master password settings to consider changing the passwords of websites they had stored.
Its March 2023 update said the attacker targeted a senior DevOps engineer through vulnerable third-party software, and that the stolen data included a backup of its MFA and federation database containing copies of LastPass Authenticator seeds [2].
Three alternatives side by side
Prices were checked on 30 October 2026 and exclude tax. NordPass figures are 1-year terms from checkout; 1Password figures are annual billing on 1Password.com.
| Bitwarden | NordPass | 1Password | |
|---|---|---|---|
| Free option | Free plan: unlimited devices and passwords [3] | Free plan: one active session on one device [9] | No free plan; 14-day free trial [12] |
| Individual price | $19.80 per year [3] | $23.88 first year, then $35.88 per year [7] | $35.88 first year, then $47.88 per year [12] |
| Family price | Families: $47.88 per year, 6 users [3] | Family: $44.28 first year, then $71.88 per year, 6 accounts [8] | Families: $53.88 first year, then $71.88 per year, 5 users [12] |
| LastPass import route | Direct import in browser extension or desktop app, or CSV [4] | Direct import from NordPass settings, or CSV [10] | Direct import in the desktop app, or CSV on 1Password.com [13] |
| Attachments | Not imported; upload manually [4] | Not included in LastPass export; download first [10] | Moved to the same item [13] |
| Shared folders | Groupings become collections; free organizations allow two [4] | Not described in the article reviewed | Become vaults with permissions, for LastPass Families or Business [13] |
| Family sharing | Unlimited sharing within Families [5] | Separate vaults, share chosen items [11] | Share unlimited vaults; organizer can recover members [12] [14] |
Import details that catch people out
- LastPass exports do not include file attachments, so download them before you export [10]. Bitwarden likewise says attachments must be uploaded to the new vault individually [4].
- NordPass imports LastPass SSH Keys, Custom Items and Bank Accounts as Secure Notes [10].
- Bitwarden free organizations allow only two collections; a LastPass export with three or more groupings fails until you remove the grouping column [4].
- 1Password does not import passkeys, private-item password history, or one-time passwords stored in LastPass Authenticator; add those manually [13].
- 1Password asks you to switch away from SMS multi-factor in LastPass before importing [13].
Post-switch checklist
- Count items in LastPass and in the new vault, and spot-check a few logins, notes and cards before deleting anything.
- Delete the exported CSV file once the import is checked; it holds your passwords unencrypted. NordPass advises never sending the export file over email or untrusted channels [10].
- Change the passwords for email, banking, primary phone carrier and any account that can reset others first. LastPass told some users to consider changing stored website passwords, and URLs were stored unencrypted [1].
- If you used LastPass Authenticator, re-enroll two-factor on important accounts with fresh codes, since its seeds were in the stolen MFA backup [2].
- Delete your passwords from LastPass after you have verified the new vault, so credentials are not kept in two places [10].
- Expect phishing. LastPass said it will never call, email or text you asking you to click a link to verify personal information, and will not ask for your master password other than when you sign in from a LastPass client [1].
Which one to choose
Choose Bitwarden if cost is the deciding factor or you want a free plan that still syncs a phone and a computer [3]. Choose 1Password if you have a lot of attachments, shared folders or a family, and you want the import to carry those across and an organizer who can recover members [13] [14]. Choose NordPass if you like its bundle of Password Health, Data Breach Scanner and email masking and accept a higher renewal than Bitwarden [6] [7].
Questions before you decide
Were LastPass master passwords stolen?
LastPass said master passwords are never known to it and were not taken. The encrypted vault backups were copied, so their safety depends on the strength of each master password.
Which alternative imports LastPass attachments?
1Password says attachments move to the same item when you import with its desktop app. Bitwarden and NordPass say LastPass attachments must be downloaded and added manually.
Do I need to change passwords after leaving LastPass?
LastPass advised users with non-default master password settings to consider changing stored website passwords. Changing your most important passwords after the switch is a sensible precaution for anyone.
Sources & verification
Product details and prices can change. Check the linked provider before buying.
- LastPass blog: notice of recent security incident (Aug to Dec 2022 updates) Accessed 30 Oct 2026
- LastPass blog: security incident update and recommended actions (March 2023) Accessed 30 Oct 2026
- Bitwarden pricing Accessed 30 Oct 2026
- Bitwarden help: import data from LastPass Accessed 30 Oct 2026
- Bitwarden help: Password Manager plans Accessed 30 Oct 2026
- NordPass plans (1-year and 2-year tabs, compare all features) Accessed 30 Oct 2026
- NordPass checkout order summary: Premium 1-year Accessed 30 Oct 2026
- NordPass checkout order summary: Family 1-year Accessed 30 Oct 2026
- NordPass: Premium vs Free version of NordPass Accessed 30 Oct 2026
- NordPass: how to export passwords from LastPass to NordPass Accessed 30 Oct 2026
- NordPass family password manager page and FAQ Accessed 30 Oct 2026
- 1Password password manager pricing Accessed 30 Oct 2026
- 1Password support: move from LastPass to 1Password Accessed 30 Oct 2026
- 1Password support: recover accounts for family or team members Accessed 30 Oct 2026
Sources link directly to providers. Product buttons may use separately labeled affiliate links. Read our disclosure.