LastPass Review: Features, Security History and Value for New Zealand Users

Choosing a digital vault means weighing everyday convenience against the harder question of whether a provider can be trusted with the keys to your entire online life. This guide takes a practical, fact-based look at LastPass — one of the longest-running names in password management — covering how it works, what it costs, its well-documented security history, and whether it still deserves a place on the devices of everyday New Zealanders. A password manager is simply an encrypted app that generates, stores and fills in your login details so you only ever memorise one strong cyber security credential: your master password.

Whether you are juggling work portals in Wellington, household bills in Hamilton or online banking in Christchurch, the sections below break down the features, the 2022 breach and its 2025 fallout, the pricing in plain terms, and the main alternatives — so you can decide for yourself.

What Is LastPass and How Does It Work?

LastPass is a cloud-based password manager that centralises your logins, secure notes, payment cards and other sensitive details in one encrypted vault. It runs as a browser extension, desktop tool and mobile app, syncing your data across devices so a password saved on a laptop is available on your phone moments later. LastPass has operated as an independent company since May 2024, when it completed its spin-off from GoTo (formerly LogMeIn).

The service is built on a “zero-knowledge” model. In practice this means your vault is encrypted and decrypted on your own device with 256-bit AES encryption, and the key is derived from your master password — which LastPass says it never receives or stores. The upside is that even LastPass staff cannot read your vault contents; the trade-off, covered below, is that no one can reset your master password for you.

The Zero-Knowledge Model in Plain English

When you type your master password, LastPass runs it through a key-stretching function called PBKDF2 (Password-Based Key Derivation Function 2), which repeatedly hashes the password to slow down anyone trying to guess it. Following updated OWASP guidance, LastPass raised its default from a legacy 5,000 iterations to 600,000 iterations in 2023. That figure matters: the more iterations, the harder a stolen, encrypted vault is to crack offline. Older accounts that were never updated may still sit on the weaker setting, so checking your iteration count in the account settings is a worthwhile five-minute job.

The LastPass Browser Extension in Daily Use

Most people interact with LastPass through the browser extension, available for Google Chrome, Mozilla Firefox, Microsoft Edge, Opera and Apple Safari. It sits in your toolbar and watches active tabs for login fields; when you click into a username or password box, a small in-field icon offers to fill your saved credentials with one click. A quick-access menu lets you copy a card number, generate a fresh passphrase or open a secure note without loading the full vault.

In everyday browsing the extension handles most sites reliably, including multi-step checkout flows and corporate sign-in portals. Occasionally the fill icon overlaps a button on an awkwardly built page — a common quirk across all password managers — but that is easily managed through the settings.

Tuning the Extension for Speed and Privacy

A couple of minutes in the extension’s preferences panel makes daily use smoother and safer:

• Set an auto-lock timer so the vault re-locks after a period of inactivity, protecting you on shared or public computers.
• Use the “Never” URL list to stop the fill icon appearing on sites where it gets in the way.
• Learn the shortcuts — for example the built-in hotkey to generate a strong password without reaching for the mouse.
• Enable biometric unlock to link the extension to Windows Hello or macOS Touch ID for faster, hands-free access.

Security Track Record: The 2022 Breach and Its Fallout

Any honest LastPass review has to confront the company’s security history head-on, because it is the single biggest factor in whether the service is right for you. The core zero-knowledge encryption has not been broken — attackers have not simply read people’s passwords — but the operational failures around how backups were protected have drawn heavy criticism from security researchers.

The 2022 incident actually involved two linked breaches. In August 2022 an attacker accessed a LastPass development environment and took source code and technical documents. Those were later used to compromise a senior engineer’s home computer, and by late 2022 the attacker had reached cloud backups and exfiltrated copies of customer vault data. Critically, while password and note fields stayed encrypted, some fields — including website URLs, along with names, billing addresses and phone numbers — were stored unencrypted. Our separate LastPass breach analysis walks through the timeline in more detail.

What the Aftermath Means for You

Because attackers hold offline copies of encrypted vaults, the strength of your data now depends entirely on how hard your master password is to crack and how many PBKDF2 iterations protected it at the time. This is not theoretical: in 2025 LastPass reached a class-action settlement of roughly US$24.5 million (an US$8.2 million general fund plus a US$16.25 million pool for crypto losses), and blockchain-analysis firm TRM Labs has linked stolen LastPass vaults to large-scale cryptocurrency thefts, with victims who had stored wallet “seed phrases” in their vaults among the hardest hit.

• Unencrypted URLs gave attackers a map of which services each victim used — useful for targeted phishing.
• Offline cracking remains the key risk for anyone with a weak master password or a low iteration count.
• Never store seed phrases or recovery codes in plain text in any cloud vault; treat crypto wallet secrets separately and offline.
• Since the breach LastPass has moved to encrypt URL fields, raised the iteration default, and invested in monitoring — but the historical exposure cannot be undone.

Plans and Pricing for New Zealand Users

LastPass uses a tiered model priced in US dollars. The Free plan includes unlimited password storage but carries one significant catch: it works on a single device type only. You must choose either computers (desktops and laptops) or mobile devices (phones and tablets) — you cannot sync across both without paying. For most people that alone pushes them toward a paid tier.

Premium is billed annually at US$36 per year (about US$3 per month, roughly NZ$60 depending on the exchange rate) and adds full cross-device sync, one-to-many secure sharing, emergency access, advanced multi-factor options and 1 GB of encrypted file storage. Families costs US$48 per year and bundles six individual Premium accounts under one bill with a shared folder for the whole household. For a deeper cost breakdown, see our dedicated LastPass pricing and plans guide, and compare it against the wider market in our password manager NZ guide.

The Security Dashboard and Dark Web Monitoring

The built-in Security Dashboard acts as a personal auditor for your vault. It scores your overall password health, flags weak or reused credentials, and gives you a clear picture of where to improve. Because reused passwords are the single most common way one leaked account leads to many, this is genuinely useful for tidying up years of accumulated logins. You can pair it with an external password generator when you want to create fresh, unique strings quickly.

Alongside it, dark web monitoring continuously checks your registered email addresses against known breach databases. If your details surface in a public leak, LastPass alerts you so you can change the affected password before it is abused. On the Free plan this covers a single email; Premium extends it to multiple addresses.

Multi-Factor Authentication and Passkeys

A master password alone is no longer enough, so enabling multi-factor authentication (MFA) — a second proof of identity beyond your password — is essential. LastPass supports its own authenticator app plus third-party options such as Google Authenticator, Microsoft Authenticator and Duo. Premium subscribers can add hardware security keys like YubiKey and native biometrics for the strongest protection.

As of 2025, LastPass also lets you create, store and use passkeys directly in your vault. A passkey is a phishing-resistant login credential tied to your device’s biometrics that replaces the password entirely on supported sites. The rollout began on Chrome desktop and has since broadened across platforms, making passwordless sign-in a practical option rather than a novelty.

Family Sharing and Emergency Access

The Families plan gives six people their own private vaults under one subscription, with shared folders for the things a household actually shares — the streaming services, the power account, the school portals. Each member keeps their personal logins private while everyone can reach the shared items.

Emergency Access is a related, often-overlooked feature. You nominate a trusted contact — a partner, family member or executor — who can request access to your vault. You set a waiting period (anywhere from a few hours to several weeks); if you do not decline within that window, access is granted. It is a sensible safeguard for making sure important accounts are not lost in a crisis, provided you set it up in advance.

Using LastPass in the New Zealand Context

LastPass works over any local connection, so it performs the same whether you are on Spark, One NZ, 2degrees or a regional fibre plan — vault syncing uses very little data and won’t trouble your cap. If you are still comparing connections, our overview of internet providers in NZ is a useful companion read.

In practice the autofill and form-filling map well onto the services Kiwis use daily:

• Online banking — ANZ, ASB, BNZ, Westpac NZ and Kiwibank login pages.
• Government portals — RealMe, IRD’s myIR and ACC services.
• Investing platforms — Sharesies, Hatch and Kernel.
• Shopping and utilities — Trade Me, local retailers and regional energy providers, including saved addresses and cards at checkout.

Limitations to Weigh Up

Beyond the breach history, a few practical drawbacks are worth knowing. Organisation relies on a fairly basic folder structure; power users with hundreds of entries often wish for nested subfolders or flexible tags. Some users also report the mobile app and extension feeling a little heavy, with occasional slow loads or repeated biometric prompts compared with leaner rivals.

The biggest competitive weakness, though, is that single-device-type Free plan. Several competitors offer full cross-device syncing at no cost, which makes LastPass a harder sell for budget-conscious users who only want the basics without paying.

How LastPass Compares to the Alternatives

LastPass is one option among several mature password managers, and the right choice depends on whether you prioritise a free cross-device plan, open-source transparency or an unblemished security record. The table below sets out the leading alternatives with links to their official pages so you can verify the details yourself.

Getting Started and Migrating Your Data

Signing up is straightforward: install the extension or app, create your account, and choose a long, unique master password you have never used elsewhere — this is the one credential you must remember and never share. Because of the zero-knowledge model, treat it with care and consider setting up account recovery options and Emergency Access at the same time.

If you are moving from a browser’s built-in password store or another manager, LastPass includes an import wizard that reads standard CSV and JSON exports and sorts them into the right vault categories. After importing, delete the exported file (it is unencrypted plain text) and clear passwords out of your browser so you are not storing two copies in two places.

The Verdict for New Zealanders

LastPass remains genuinely easy to use, with a polished extension, a helpful Security Dashboard and modern features like passkeys and dark web monitoring. For households, the Families plan offers real value and convenience. But the 2022 breach, the offline-cracking risk it created, and the 2025 settlement and crypto-theft findings mean the decision comes down to trust as much as features. If a spotless security record is your top priority, or you want full cross-device sync for free, it is well worth comparing the alternatives above before committing. Whichever you choose, the most important step is simple: use a manager, pick a strong master password, and turn on multi-factor authentication.

Frequently Asked Questions

Is LastPass still safe to use after its 2022 breach?

The core encryption held up, so stored passwords were not read directly. However, because attackers took offline copies of encrypted vaults, your safety depends on having a long, unique master password and a high PBKDF2 iteration count. Check your iteration setting is 600,000 and, if in doubt, change your master password.

Can the free plan sync my laptop and my phone at the same time?

No. The Free plan works on a single device type only — either computers or mobile devices, not both. To sync across all your devices you need to upgrade to Premium or Families.

What happens if I forget my master password?

Because LastPass never stores your master password, it cannot reset it for you. If you have not set up recovery options such as biometric recovery or an Emergency Access contact beforehand, your vault data will be permanently lost.

How much does LastPass cost in New Zealand?

Pricing is set in US dollars: Premium is US$36 per year and Families is US$48 per year for up to six people. Converted to New Zealand dollars that is roughly NZ$60 and NZ$80 respectively, depending on the exchange rate and any bank fees.

Does LastPass support passkeys?

Yes. Since 2025 you can create, store and use passkeys directly in your LastPass vault for passwordless, phishing-resistant logins on supported sites, with support having expanded across browsers and platforms.