As of July 2026
CredentialBase vs LastPass
Long-established password manager that disclosed a major security breach in 2022.
Where CredentialBase has the edge
- LastPass's free plan locks you to a single device type — you cannot sync between a phone and a laptop without paying. CredentialBase's free tier syncs across every device you sign into.
- In 2022, LastPass suffered a breach in which attackers stole encrypted customer vault backups from its cloud storage provider, affecting up to 1.6 million UK users; the UK Information Commissioner's Office fined LastPass's parent company £1.2 million in December 2025 for inadequate security controls. The ICO stated there is no evidence the stolen vaults were decrypted.
Where LastPass has the edge
- Business and Teams tiers with admin controls, which CredentialBase does not offer.
- Longer track record and broader third-party integrations.
Feature-by-feature
| Feature | CredentialBase | LastPass |
|---|---|---|
| Encryption & architecture | ||
| Encryption | AES-256-GCM | AES-256 |
| Key derivation | PBKDF2, 600,000 iterations | PBKDF2, 600,100 iterations (current default) |
| Open source | ||
| Disclosed major breach | 2022 (encrypted vault backups stolen) | |
| Feature | CredentialBase | LastPass |
|---|---|---|
| Pricing | ||
| Free tier | All devices, no limit | Locked to one device type |
| Paid plan (individual) | $1.99/mo or $15.99/yr | $3.37/mo billed yearly |
| Family plan | $4/mo, up to 6 users | |
| Feature | CredentialBase | LastPass |
|---|---|---|
| Vault & sharing | ||
| Login, card, secure note storage | ||
| Secure share links | PIN + view limit + expiry | |
| Cross-device sync on free plan | ||
| Feature | CredentialBase | LastPass |
|---|---|---|
| Platforms | ||
| Web app | ||
| Browser extension | Chrome | All major browsers |
| Android app | In development | |
| iOS app | ||
Frequently asked
That's a judgment call for each user. What's factually established: attackers stole encrypted vault backups and customer metadata in 2022, and the UK ICO fined LastPass's parent company £1.2 million in December 2025 for the security failures that allowed it. LastPass and the ICO both state there is no evidence the stolen vaults themselves were decrypted, since decryption requires the user's master password, which was never on LastPass's servers.
Sources for claims about LastPass above:
LastPass is a trademark of its respective owner. This page is not affiliated with or endorsed by LastPass; it exists to compare publicly available pricing and features. Figures were accurate as of July 2026 and may have changed — verify current pricing on LastPass’s own site before deciding.