What would you do if the password vault holding your entire digital life suddenly became the thing you were worried about? That question stopped being hypothetical for millions of people after LastPass confirmed a significant security incident in 2022, in which attackers obtained customer vault backup data. For many users, the takeaway was not “passwords are dangerous” but “I need to know exactly what I’m trusting.” That is why a structured checklist matters more than a list of brand names. This guide walks through the criteria that actually separate a solid password manager from a risky one, with practical notes on where people go wrong. (LastPass)
Why a Checklist Beats a Simple “Best Of” List
Most “best password manager” articles rank products by price and interface. That is fine for a shopping decision, but it is a poor basis for a security decision. A checklist forces you to ask uncomfortable questions: Who can read my vault? What happens if the company is breached? Can I leave with my data intact?
Security researchers have long argued that transparency and independent review matter more than marketing claims. The Open Web Application Security Project publishes guidance on credential storage and authentication that applies directly to how you evaluate a vault. Likewise, the Electronic Frontier Foundation has repeatedly emphasized that security tools should be auditable and that users deserve clear information about how their data is protected.
The practical lesson: build your shortlist from criteria, not from ads.
The Core Checklist: Nine Questions to Ask Every Vendor
1. Is the vault architecture zero-knowledge, and how far does that claim go?
“Zero-knowledge” means the vendor cannot decrypt your vault. But the term is used loosely. Ask instead: Is encryption done locally on the device? Is the encryption key derived from the vault password alone, or does the server hold a second key? Has an independent firm reviewed the implementation?
Common mistake: accepting a marketing page as proof. Look for a published audit report with a date, scope, and named firm.
2. Is the code open source?
Open-source vaults can be inspected by anyone. Closed-source vaults can still be secure, but you are relying on the vendor’s word plus any audits. Neither choice is automatically wrong, but you should know which one you are making.
3. Has the vendor disclosed breaches honestly and quickly?
Every company can be attacked. What separates good from bad is disclosure behavior: how fast customers were told, how detailed the notice was, and whether the company changed its practices afterward. Check the vendor’s own incident notices and any regulator or attorney-general filings rather than relying on secondary summaries.
4. Can you export your data cleanly?
This is the most underrated item on the list. Before committing, confirm that you can export your vault in a standard format such as CSV or an encrypted archive. If a vendor makes export deliberately awkward, that is a red flag. Portability is your exit strategy.
5. What multi-factor options exist?
Look for support for hardware security keys and authenticator apps, not only SMS codes. SMS-based second factors are vulnerable to SIM-swapping, a well-documented attack pattern covered by NIST’s digital identity guidelines. Prefer TOTP or hardware keys where possible.
6. Where is the company based, and what law governs your data?
Jurisdiction affects what can be demanded of a provider and what must be disclosed to you. There is no universally “best” jurisdiction, but you should know the answer rather than assume it.
7. What does the free tier actually include?
Free tiers are where most people start and where limits bite hardest. Some cap the number of stored items; others restrict sync to one device type. If you are comparing free plans specifically, a broader look at how free alternatives stack up in other software categories can help you calibrate expectations — for example, this comparison of best free VPN alternatives shows how much genuinely usable functionality free tiers tend to offer.
8. Does it support the platforms you actually use?
A beautiful desktop app is useless if your phone is your primary device. Check browser extensions, mobile apps, and desktop clients for every operating system in your household.
9. What is the recovery model?
If you forget your vault password, what happens? With a true zero-knowledge design, the honest answer is often “you lose the vault.” Some vendors offer emergency access or account recovery keys. Decide which trade-off you prefer before you need it.
How the Main Contenders Stack Up on Paper
The table below summarizes structural differences rather than prices, since pricing changes frequently and should be verified directly with each vendor.
| Vendor | Model | Open Source | Notable Structural Trait | Verify Before Committing |
|---|---|---|---|---|
| Bitwarden | Freemium, cloud or self-host | Yes | Free tier includes unlimited passwords and device sync | Current paid tier contents |
| 1Password | Subscription only | No | Travel Mode and strong family features | Current plan names and prices |
| KeePassXC | Free, fully offline | Yes | Local KDBX vault; sync is user-managed | Current release version |
| Proton Pass | Freemium | Partly | From Proton, the Swiss encrypted-mail provider | Current feature set |
| Dashlane | Subscription | No | Polished interface and bundled features | Whether a free tier still exists |
| NordPass | Freemium | No | From Nord Security, maker of NordVPN | Current free-tier limits |
A few practical notes on reading that table. Bitwarden is the usual recommendation for people who want an open-source vault with a genuinely useful free plan. 1Password appeals to households and teams that value polish and shared vaults. KeePassXC is the choice for people who want nothing to do with cloud sync and are willing to manage their own backups — and that willingness is not trivial. Proton Pass is newer, so its feature set has been expanding quickly; check the current state rather than older reviews.
The Mistakes People Make When Switching
Switching password managers is a migration project, and migrations go wrong in predictable ways.
Mistake one: exporting to CSV and leaving the file lying around. A plaintext CSV contains every password you own. Export it, import it, then delete it securely. Do not email it to yourself “just in case.”
Mistake two: reusing the same vault password. Your vault password should be long, unique, and memorized. It is the one password you cannot store inside the vault.
Mistake three: skipping the audit of old accounts. The switch is the perfect moment to delete accounts you no longer use. Every dead account is a liability you do not need to migrate.
Mistake four: assuming migration is instant. Browser autofill, mobile apps, and shared family vaults all need reconfiguring. Budget an evening, not five minutes.
Mistake five: ignoring the security hygiene around the device itself. A password manager protects credentials, not a compromised machine. If you are also tightening up your setup, it helps to know how to check whether an APK file is safe before sideloading apps, and how to keep an eye on hardware health with a proper GPU temperature check routine.
Free Tier vs Paid: What You Actually Get
The free-versus-paid question deserves its own section because it is where most confusion lives.
Free tiers generally fall into three shapes. The first is unlimited storage with limited features — Bitwarden’s approach, where the free plan covers core vault needs and paid tiers add extras. The second is capped storage — a limit on the number of items, which frustrates anyone with more than a few dozen accounts. The third is trial-style free, where the free plan is really a demonstration.
Paid tiers typically add encrypted file storage, emergency access, breach monitoring, and family sharing. Whether those are worth paying for depends on your situation. A single user with a handful of accounts may never need them. A family sharing streaming logins and banking credentials probably will.
One caution: pricing and free-tier boundaries change often across this entire category. Any figure you read in an article — including this one — should be checked against the vendor’s own pricing page on the day you sign up.
Self-Hosting and the DIY Option
For a certain kind of user, the answer is not a vendor at all. KeePassXC stores an encrypted local file that you control completely. There is no company to breach, no subscription, and no server holding your data.
The trade-off is real. You are responsible for backups, for syncing the file between devices, and for not losing it. A corrupted vault with no backup is a catastrophe. If you go this route, keep at least two encrypted backups in separate locations and test restoring one before you trust the setup.
Self-hosting Bitwarden is a middle path: open-source software, your own server, but with the convenience of a web interface and mobile apps. It requires more technical comfort than a standard subscription.
A Practical Switching Sequence
If you have decided to move, follow a sequence rather than improvising.
- Audit first. List the accounts that matter and delete the ones you no longer use.
- Set up the new vault and confirm multi-factor authentication is enabled with an authenticator app or hardware key.
- Export from the old manager to a local encrypted file or a CSV you will delete immediately after import.
- Import and verify. Spot-check a sample of entries — especially banking, email, and anything with two-factor recovery codes.
- Update critical passwords for your email account first, since email is the reset path for everything else.
- Reconfigure autofill in browsers and on mobile.
- Securely delete the export file and revoke any old sessions in the previous manager.
- Set a reminder to review your vault in three months.
Steps four and five are where people cut corners, and they are exactly the steps that prevent lockouts.
Where Broader Software Choices Fit In
Password security rarely improves in isolation. The same habits — checking provenance, verifying claims, preferring auditable tools — apply across your whole stack. If you are reassessing your digital toolkit at the same time, it is worth applying the same scrutiny to AI tools and everyday utilities, from ChatGPT alternatives to image generators, and even to hardware purchases like Steam Deck stock alternatives. The principle is identical: know what you are trusting, and know how to leave.
Conclusion
The right LastPass alternative is not the one with the best review score. It is the one that passes your checklist: a clear encryption model, honest disclosure history, real export options, strong multi-factor support, and a recovery plan you understand before you need it. Bitwarden, 1Password, KeePassXC, Proton Pass, and the rest each answer those questions differently, and the “best” answer depends on whether you value openness, polish, or complete control.
Do the audit. Read the security page, not the pricing banner. Test the export before you commit. And remember that the most important password in your life is the one that never leaves your head.
Frequently Asked Questions
Is LastPass still safe to use?
LastPass remains a functioning product, and the company has stated it strengthened its security practices after the 2022 incident. Whether it is “safe enough” is a personal risk decision. The checklist approach helps here: review the vendor’s own incident disclosures, check whether independent audits have been published since, and confirm that your vault password and multi-factor setup are strong. Many users who left did so because of trust concerns rather than any specific technical failure. (Use Strong Passwords)
What is the most important item on a password manager checklist?
Export capability. It sounds mundane, but it is the item that determines whether you are locked in. If you can leave with your data intact, every other decision is reversible. Encryption architecture matters enormously too, but it is hard for a non-specialist to evaluate — whereas “can I export my vault” is a question anyone can answer in five minutes.
Are free password managers good enough?
Often, yes. Bitwarden’s free tier includes unlimited passwords and device sync, which covers the core job for most individuals. The limitations tend to appear in extras: encrypted file storage, emergency access, breach monitoring, and family sharing. If you only need a vault and autofill, a good free tier is genuinely sufficient. Verify current limits directly with the vendor, since these change.
How do I switch password managers without losing anything?
Export from the old manager, import into the new one, and verify a sample of entries before deleting anything. Update your email password first, because email is the recovery path for every other account. Keep the old vault intact until you have confirmed the new one works on all your devices. Then securely delete the export file and revoke old sessions.
Is KeePassXC more secure than cloud-based managers?
Not inherently. KeePassXC removes an entire class of risk by eliminating the cloud server, but it introduces a different one: you are now responsible for backups and sync. A lost or corrupted local file with no backup is a total loss. Cloud managers trade some control for convenience and redundancy. The right choice depends on your technical comfort and backup discipline.
How often should I review my password manager setup?
A light review every three to six months is a reasonable rhythm. Check that multi-factor authentication is still active, confirm your recovery information is current, remove entries for accounts you have deleted, and re-read any security notices the vendor has published. Once a year, do a fuller audit: verify your export still works and confirm your backup of the vault is restorable.
