Note: This comparison is based on LastPass’s and NordPass’s official pricing pages, help docs and security disclosures, checked on September 27, 2026. We did not run hands-on benchmarks. Promo prices change often, so confirm on each vendor’s site before you buy.
Short answer: For most people and small teams, NordPass is the better pick in 2026. It costs less, its free plan works on any device type (one active session at a time), and it doesn’t carry LastPass’s 2022 breach history. Pick LastPass if you’re already on it, have rotated the credentials stored in your vault since 2022, and want to keep features like one-to-many sharing on a plan you know. If you’re leaving LastPass because of the breach, changing your master password alone is not enough. See the breach section below.
Pricing at a glance (September 2026)
| Plan | LastPass | NordPass |
|---|---|---|
| Free | Yes, limited to one device type | Yes, one active session at a time |
| Personal | Premium: $3.00/mo, billed annually ($36/yr) | Premium: $1.39/mo on a 2-year plan ($37.53 for the first 27 months) or $1.99/mo on a 1-year plan ($23.88 for the first year) |
| Family | Families: $4.00/mo, billed annually ($48/yr), 6 users | Family: $2.49/mo on a 2-year plan ($67.23 for the first 27 months) or $3.69/mo on a 1-year plan, 6 users |
| Small team | Teams: $4.25/user/mo, billed annually, up to 50 users | Teams: $1.79/user/mo on a 2-year plan, sold as a 10-user pack |
| Business | Business: $7.00/user/mo; Business Max: $11.00/user/mo, billed annually | Business: $3.59/user/mo on a 2-year plan ($3.99 on 1-year, $5.99 month-to-month), 5-user minimum |
| Trial / refund | 30-day Premium/Families trial, 14-day Business trial | 30-day money-back guarantee |
How to read this:
- NordPass shows its personal prices as discounts off a regular $2.99/mo (Premium) and $5.99/mo (Family). Its plans page doesn’t say what the plan renews at, so check the renewal price at checkout.
- LastPass prices come from its own pricing page and product catalog, and are billed annually.
- NordPass was showing a business coupon (NPFALL26, up to 10% off annual Business and Enterprise plans) on September 27. It may be gone by the time you read this.
Free plans compared
| LastPass Free | NordPass Free | |
|---|---|---|
| Passwords | Unlimited | Unlimited |
| Devices | One device type: computer or mobile, not both | Any device, but only one active session at a time |
| Sharing | One-to-one sharing | Not included (Premium only) |
| Passkeys | Not listed as a Free feature | Yes. NordPass says passkeys work “with any plan” |
| Built-in authenticator (TOTP) | Separate LastPass Authenticator app | Not included (Premium only) |
| File storage | 50 MB | Not included |
| Breach monitoring | Dark web monitoring included | Not included (Data Breach Scanner is Premium) |
LastPass defines its two device types as “computer (all browsers running on desktops and laptops) or mobile (mobile phones, smart watches, and tablets).” If you use a laptop and a phone, LastPass Free covers only one of them.
NordPass Free runs everywhere, but you’re logged out on one device when you log in on another. That’s annoying, but most people can live with it. Being unable to reach your phone vault at all is a harder limit.
The LastPass breach: what was taken and what it means
These are the facts from LastPass’s own disclosures and the UK regulator’s findings.
What happened (per LastPass):
- August 2022: An attacker used a compromised developer account to reach LastPass’s development environment and took source code and technical information.
- Late 2022: Using information from that first incident, the attacker got into a cloud storage backup service. LastPass disclosed on December 22, 2022 that the attacker copied a backup of customer vault data.
- March 1, 2023: LastPass’s final update said the attacker had targeted a senior DevOps engineer “by exploiting vulnerable third-party software” to get the access needed for the backups.
What was taken:
- Unencrypted account data: company names, end-user names, billing addresses, email addresses, phone numbers and IP addresses.
- Encrypted vault data: usernames, passwords, secure notes and form-fill data, protected with AES-256 and a key derived from each user’s master password.
- Website URLs were not encrypted at the time, so the attacker can see which sites each user had saved.
- A backup of the MFA/federation database, including LastPass Authenticator seeds and phone numbers used for MFA backup.
What it means for you:
- The stolen vaults can be attacked offline, indefinitely. How safe yours is depends on how strong your master password was and your PBKDF2 iteration count at the time of the theft. LastPass said users on its defaults (a 12+ character master password and 100,100 iterations) were well protected. For users with weaker master passwords or settings, it recommended changing the website passwords stored in the vault.
- Changing your master password now does not protect the copy that was stolen. The practical fix is to rotate the passwords, API keys and crypto wallet seeds that were in your vault in 2022, starting with the most valuable ones.
- This isn’t theoretical. Blockchain analytics firm TRM Labs reported in December 2025 that it had traced more than $35 million in crypto stolen from wallets whose keys were stored in cracked LastPass vaults, with thefts continuing into September 2025.
Later official updates:
- URL encryption: LastPass says it encrypted the primary URL field starting in 2024 and finished encrypting six more URL-related fields by September 2025.
- Stronger key derivation: LastPass now uses at least 600,000 PBKDF2 iterations for new accounts and for accounts that update their iteration count.
- UK fine: On December 11, 2025, the UK Information Commissioner’s Office fined LastPass UK Ltd £1.2 million, saying it “failed to implement sufficiently robust technical and security measures.” The ICO said up to 1.6 million UK users were affected, and that it found no evidence the hacker had decrypted the encrypted credentials.
NordPass has no comparable public breach disclosure. It uses XChaCha20 encryption with a zero-knowledge design, and says it holds ISO 27001 certification and a SOC 2 Type 2 report.
Features developers care about
| LastPass | NordPass | |
|---|---|---|
| Vault encryption | AES-256, PBKDF2 (600,000+ iterations for new/updated accounts) | XChaCha20, zero-knowledge |
| Passkeys | Yes (paid plans list passkey storage) | Yes, on any plan |
| TOTP codes | Separate LastPass Authenticator app | NordPass Authenticator (Premium) |
| File attachments | 1 GB on paid plans | Premium feature |
| Email masking | Not listed | Premium feature |
| Business SSO/directory | Business Max: SSO apps and advanced MFA | Enterprise: provisioning via Entra ID and Okta |
Neither product is built around developer secrets workflows. If you want op run-style secret injection, SSH-agent support or CI service accounts, look at 1Password. See our 1Password review. If you want an open-source option, see the Bitwarden comparison in Dashlane vs Bitwarden.
Which should you pick?
| Your situation | Pick |
|---|---|
| New to password managers, budget matters | NordPass |
| Need free access on both laptop and phone | NordPass Free (one session at a time) or Bitwarden Free |
| Leaving LastPass after the breach | NordPass, and rotate every credential that was in your 2022 vault |
| Small team, 10 people or fewer | NordPass Teams (10-user pack) |
| Company needing SSO and many admin policies | Compare LastPass Business Max and NordPass Enterprise |
| Already on LastPass, credentials rotated, happy with it | LastPass is fine to keep |
If NordPass fits, you can see NordPass’s current plans here.
Pros and cons
LastPass pros
- Mature product with shared folders and 100+ business policies on the Business plan.
- Free plan includes dark web monitoring and one-to-one sharing.
- URL fields are now encrypted and iteration defaults are much stronger than in 2022.
LastPass cons
- The 2022 breach exposed encrypted vaults that attackers can still work on offline, and a UK regulator fined the company over it.
- Free plan is limited to one device type.
- Costs more than NordPass at every tier.
NordPass pros
- Cheaper personal, family and business plans, especially on 2-year terms.
- Free plan works on any device type, and passkeys work on every plan.
- XChaCha20 encryption, ISO 27001 and SOC 2 Type 2.
NordPass cons
- Free plan allows one active session at a time and has no sharing.
- The best prices require a 2-year prepay, and the renewal price isn’t shown on the plans page.
- No developer secrets tooling (CLI secret injection, SSH agent) listed on its plans pages.
FAQ
Is LastPass still safe to use in 2026? The current product has stronger defaults than in 2022: 600,000+ PBKDF2 iterations for new or updated accounts, and encrypted URL fields. The risk is in the vault copies stolen in 2022, which don’t change when you update your account. If you had an account then, rotate the credentials that were stored in it.
Does changing my LastPass master password protect me from the breach? Not for the stolen copy. That backup is encrypted with the key derived from your master password at the time. Changing it now protects future data, but you still need to change the passwords and keys that were in your vault back then.
Is LastPass Free really limited to one device? To one device type. You pick computer (any desktop browser) or mobile (phones, tablets, watches). You can switch types, but you can’t use both on Free.
Can I use NordPass Free on my phone and laptop? Yes, but only one active session at a time. Logging in on one device ends the session on the other. Premium removes that limit.
How do I move from LastPass to NordPass? Export your LastPass vault to CSV, import it into NordPass, then securely delete the CSV. After that, rotate your most important credentials, starting with email, banking, cloud consoles and crypto wallets.
Not sure you need a paid plan at all? Our best free password managers guide compares every free tier. If NordPass is the one you want, start with NordPass here.
Sources, checked September 27, 2026: LastPass pricing, LastPass Premium vs Free, LastPass product catalog API, LastPass: Notice of Recent Security Incident, LastPass: Security Incident Update and Recommended Actions (March 1, 2023), LastPass: encrypting URLs, LastPass Trust Center FAQ, ICO: password manager provider fined £1.2m, TRM Labs LastPass analysis, NordPass personal plans, NordPass business plans, NordPass Premium vs Free, NordPass passkeys, NordPass security.