If you are here, you have probably already decided. This page is less about us than about doing the leaving properly, because a stolen LastPass vault is not a thing you fix by moving house. Start with the part that matters most, then decide whether an Apple only vault suits you.
The 2022 incident is public record and is the reason most people arrive here. We have set out what actually happened rather than the version that gets repeated, because the details decide what you should do next.
In 2022 attackers reached a developer machine and from there a backup database and copies of customer vaults. Researchers had linked more than $35 million in stolen cryptocurrency to those copies by September 2023, a single heist of $150 million was tied to the same source in 2025, and in February 2026 LastPass settled a class action for $24.5 million, $16 million of it earmarked for crypto losses.
The passwords were sealed. The list of sites each person used was not. Anyone holding a stolen copy can read which bank, which exchange and which email provider you used, which is a targeting list on its own, before a single password is cracked.
LastPass raised its default from 5,000 rounds of PBKDF2 to 100,100 in 2018 and to 600,000 later, but never reliably moved existing accounts up. Researchers checking after the breach found accounts still on 5,000, some on 500, and some on a single round. The gap was reported to LastPass on 24 February 2018. The vaults were taken four years later, still at the old settings.
LastPass Free gives you unlimited passwords, but on one device type: computer or mobile, not both. For most people that makes the free plan a trial rather than a place to live.
Two of these are ours to admit rather than theirs to fix. If either applies, changing to us would make your week worse, and you should pick a different destination.
If none of those apply, the rest of this page is the practical part. Do the first step even if you choose a different app than ours.
Zen Passwords and LastPass, side by side
| What is being compared | Zen Passwords | LastPass |
|---|---|---|
| Where it runs | iPhone, iPad and Mac | Apple devices, Windows, Android, browsers and the web vault |
| Account | None. You never create one | A LastPass account, held on their servers |
| What one guess costs an attacker | Argon2id, up to 256 MB of memory per guess | PBKDF2 at 600,000 rounds today. No memory cost at all |
| Where the vault lives | Your own private iCloud, or on the device alone | LastPass servers, which is where the 2022 copies were taken from |
| What you can store | Logins, passkeys, authenticator codes, payment cards, bank details, Wi-Fi, software licences and secure notes | Logins, notes, cards, addresses and form fill entries |
| AutoFill | AutoFill for logins, one-time codes and passkeys in Safari and other apps, on iPhone, iPad and Mac, plus save-password prompts | AutoFill on mobile, plus browser extensions on desktop |
| Sharing | None. A personal vault only | Sharing on free, and six accounts on Families |
| If you forget the master password | Nobody can reset your master password, including us, because we never receive it. You get a printable recovery key instead, or social recovery split across people you trust | Recovery routes through your LastPass account |
| Free plan | Free for up to five active items, then Zen Premium for unlimited items. Apple shows the price and the billing terms before you buy. | Unlimited passwords, but one device type only |
Facts about LastPass were checked on against their own site. Products change, so check theirs before you decide.
The first step has nothing to do with us and is the one that actually protects you. Do it whether or not you end up here.
If your vault existed before 2023, treat everything in it as known. Changing your master password does not help, because it does not re-encrypt the copy somebody already holds. Start with your email, then anything financial, then anything with money or crypto attached. This is the step people skip and it is the only one that undoes the damage.
Export your vault to a CSV from the web vault or the browser extension. The file is your entire vault in readable text, so keep it on the machine, do not put it in a cloud folder, and delete it as soon as the import is done.
Open Zen Passwords, go to Settings, then Import from other app, and choose LastPass. You will see a preview with the row counts before anything is written, so you can back out if it looks wrong.
Set up AutoFill so logins, one-time codes and passkeys fill in Safari and other apps. Save a recovery key, or set up social recovery, because nobody here can reset your master password for you. If you want the strongest setting, turn on the Secret Key and print the Emergency Kit.
Once you have opened a few logins from the new vault and AutoFill is filling, delete the CSV and close the LastPass account. Leaving the old vault in place leaves a copy of your life on a server you have decided not to trust.
Not by itself. Changing the password does not re-encrypt the copy an attacker already holds, and that copy is still protected by whatever settings your account had when it was taken. The only thing that helps is changing the passwords at each site, starting with email and anything financial.
We cannot tell you that, and neither can anyone else here. The safe assumption for a vault that existed in 2022 is that it was included, because the cost of assuming wrongly in the other direction is your accounts.
No. There is no Zen server. Your vault syncs as encrypted data through your own private iCloud, on your Apple ID, or stays on the device if you prefer. We never hold it and could not read it if we did.
No. Zen Passwords runs on iPhone, iPad and Mac. If you need Windows, Android or Linux, we are not the right destination and you should pick one that covers them.
No. Zen Passwords is a personal vault, with no shared vaults and no family plan. If shared logins are part of how your household works, that is a real reason to choose something else.
A private vault for logins, cards, bank details, codes and notes on iPhone, iPad and Mac. Free for up to five active items.
Download on the App StoreNo account, an Apple only vault, and the three cases where you should stay put.
Read the comparisonOpen source and everywhere, against one platform built natively.
Read the comparisonWhat the built-in app has nowhere to put, and how to move just that.
Read the comparisonSame method, eight times the memory, and no bundle you did not ask for.
Read the comparisonTwo products that agree nobody should hold your vault. The difference is the key.
Read the comparisonThis page assumes you are leaving LastPass. If you are still weighing the two up, the verdict page answers that instead.
Zen Passwords vs LastPassEvery feature, the screenshots, the privacy detail and the questions people ask most often.
Open the product pageEverything claimed about Zen Passwords here is what the app does today. Everything claimed about LastPass is limited to things that have been true of it for years, with no prices, because a price on a page nobody re-checks goes wrong in public. If you find something out of date, tell us and we will fix it.
