If you've heard "don't use LastPass, it got hacked" and wondered whether that means password managers in general are a bad idea, the short answer is: no — but the LastPass story is worth understanding accurately rather than either dismissing or overreacting to.
What Actually Happened to LastPass
In August 2022, an attacker compromised a LastPass engineer's development environment and stole source code. That alone wasn't catastrophic — but the attacker used information from that first breach to later access a cloud storage backup containing customer vault data. What was taken included both unencrypted information (like some website URLs) and encrypted data (usernames and passwords, protected by each user's own master password).
The fallout continued for years, not weeks: in November 2025, the UK's data protection regulator fined LastPass £1.2 million for inadequate security measures, and LastPass separately settled a class-action lawsuit for $24.5 million over losses tied to the breach. Some of those losses were real — attackers have used the stolen, encrypted vaults for offline "cracking" attempts, and users with weak or reused master passwords have reportedly lost cryptocurrency and other assets as a result.
Why the Damage Was Limited (For Most People)
Here's the important nuance: LastPass, like most reputable password managers, uses what's called zero-knowledge or end-to-end encryption architecture. Your vault is encrypted on your own device before it's ever uploaded — the company itself never has the key to unlock it. So when the vaults were stolen, the attacker got a locked box, not the contents.
The catch: the strength of that lock is entirely your master password. If yours was strong and unique, the stolen vault is, in practical terms, useless to an attacker — cracking modern encryption without the key is not feasible even with significant computing power. If your master password was weak, reused, or guessable, an attacker with unlimited time and a stolen encrypted file can eventually try enough combinations to get in. That's exactly what happened to some LastPass users.
So Is a Password Manager Still Worth Using?
Yes — the alternative is worse. Reusing the same password across multiple sites means one breach anywhere exposes you everywhere. Writing passwords on paper or in an unencrypted note is vulnerable in different, often simpler ways. A password manager with zero-knowledge encryption, protected by a genuinely strong and unique master password, remains the most practical way most people can manage dozens of accounts securely.
As of mid-2026, independent reviewers commonly point to Bitwarden (open-source, strong free tier), 1Password, NordPass, Proton Pass, and Keeper as options with clean security track records and zero-knowledge architecture. Built-in options like Apple's Passwords app or Google's Password Manager have also improved significantly and are reasonable choices for simpler needs. This isn't an endorsement of any specific product — reviews and breach histories change, so it's worth checking current, independent comparisons before choosing.
What Actually Matters, Regardless of Which One You Pick
- Your master password is the single point of failure. Make it long, unique, and not reused anywhere else. A memorable passphrase (several unrelated words) is often both stronger and easier to recall than a short, complex-looking password.
- Turn on two-factor authentication for the password manager itself — this protects you even if your master password is somehow compromised.
- A clean breach history is a point in a provider's favor, not a guarantee. Any company can be targeted; what matters most is whether your data was protected by real encryption when it happened, not whether an attack was attempted.
Why This Actually Matters for Estate Planning
This connects directly to end-of-life planning in a way that's easy to overlook: most password managers offer an "emergency access" or "legacy contact" feature specifically designed for exactly this situation — letting a trusted person request access to your vault after a waiting period, without you having to hand over your master password while you're alive.
If you use a password manager, it's worth documenting which one, and whether you've set up emergency access, as part of your plan. Without it, your executor may find your digital life — bank logins, email, subscriptions — effectively locked, even though the accounts themselves are perfectly findable.
Getting Started
Legaxi's plan includes a place to note where your important account information lives, without ever asking for the actual passwords themselves — see our security post for why that distinction matters. Start your plan today to make sure your executor isn't locked out of the accounts they'll need.
This post is for general informational purposes and reflects publicly reported information as of August 2026. It is not a specific product endorsement — research current, independent reviews before choosing a password manager.