zenproducts / head to head / reviewed 25 August 2026

Zen Passwords vs LastPass

Ten rounds against the manager that was breached, and is still being cracked in 2026. Zen Passwords takes six, LastPass takes two.

Zen Passwords

rounds won

draws

LastPass

rounds won

Our scoring, of our own product against a competitor, so read it with that in mind. Every round below says exactly what it was scored on. Facts about LastPass checked against their own published documentation on 25 August 2026.

The verdict

Zen Passwords wins six rounds to two. This is not a close comparison, and we take no pleasure in why.

LastPass still has real strengths and we will name them. It runs on Windows, Android and every browser, which we do not. It shares with your family, which we cannot. Its current setting is 600,000 rounds of PBKDF2, which is a serious number.

The problem is what happened underneath it. In 2022 attackers took copies of customer vaults. The website addresses inside those vaults were not encrypted at all, so whoever holds them can see every service each person used. And because LastPass never finished upgrading old accounts, a large share of those stolen vaults were still protected by 5,000 rounds, some by 500, and some by a single round. A researcher told them in February 2018. Four years later the vaults were stolen at the old settings.

Vaults from that theft are still being opened. By September 2023 researchers had linked more than 150 victims and over $35 million in stolen cryptocurrency to them, and by 2025 a single heist of $150 million was tied to the same source. In February 2026 LastPass settled a class action for $24.5 million, $16 million of it earmarked for crypto losses.

So this article is not really about features. It is about the one number that decides what a stolen file is worth, and what happens when a company leaves it alone for four years.

What we would actually tell a friend

If you are still on LastPass, the useful action is not choosing us. It is leaving. Export your vault, change every password that mattered, and move to any manager that derives your key properly, ours included. If you keep an Apple only life, we are a good landing place, and import reads a LastPass CSV directly.

Download on the App Store

The scorecard

All 10 rounds at a glance

Then the same 10 in detail, with what each side actually does and why the round went the way it did.

Round	Zen Passwords	LastPass	Winner
1. What one guess costs an attacker	Argon2id from the start, up to 256 MB of memory per guess	PBKDF2 today. Many stolen vaults were on 5,000 rounds or fewer	Zen Passwords
2. What is actually encrypted	Item contents, and titles and tags sealed separately	Vaults encrypted, but website addresses left in the clear	Zen Passwords
3. The record	No breach, and no independent audit either	Customer vaults stolen in 2022, still being cracked in 2026	Zen Passwords
4. Where your vault actually sits	Your own private iCloud. We run no server	Their servers, which is where the copies were taken from	Zen Passwords
5. What it costs	Five active items free, on all your devices	Free, unlimited passwords, but one device type only	Draw
6. The devices it reaches	iPhone, iPad and Mac	Windows, Android, Mac, iPhone and every browser	LastPass
7. Sharing with the people you live with	Nothing	Sharing on free, and six accounts on Families	LastPass
8. One time codes	In the app, not a separate purchase	Built in, and a separate authenticator app	Draw
9. Getting back in when you have forgotten	A printable recovery key, plus trusted people who can help	Account recovery through their own systems	Zen Passwords
10. How it feels on the device you actually hold	Built with Apple's own tools, for three devices and nothing else	One app that has to work everywhere	Zen Passwords
Final	6 rounds	2 rounds	Zen Passwords

Round 1

What one guess costs an attacker

Zen Passwords

Argon2id from the start, with no menu to find. New vaults work out what your phone can afford. They start at 256 MB of memory per guess and step down through 128 and 64, keeping the strongest setting that still unlocks in under a second.

LastPass

600,000 rounds of PBKDF2 today. But the default was 5,000 from 2013, only rose to 100,100 in 2018, and old accounts were never reliably moved up. Researchers who checked after the breach found accounts still on 500 rounds, and some on a single round.

Winner

Zen Passwords. Zen Passwords. The number today is not the number that protected the vaults that were stolen. A method with no memory cost, run five thousand times, is something a single modern graphics card chews through. That is why we spend the cost on memory, and why we never change a vault's setting underneath it without a migration.

Round 2

What is actually encrypted

Zen Passwords

Item contents are sealed, and list titles and tags are sealed separately from the body, so the list itself is not readable either. What syncs is scrambled data.

LastPass

The vaults were encrypted. The website addresses inside them were not. Anyone holding a stolen copy can read the full list of services that person used, which is a phishing target list even before a single password is cracked.

Winner

Zen Passwords. Zen Passwords, and this is the detail most coverage skipped. Knowing which bank, which exchange and which email provider somebody uses is valuable on its own. Encrypting the passwords and leaving the addresses in the clear is half a job.

Round 3

The record

Zen Passwords

No breach. Also no independent audit, and we are not going to pretend that is the same thing as a clean bill of health. We are a young product and you should weigh that.

LastPass

In 2022 attackers reached a developer's machine and took copies of customer vaults along with names, billing addresses and partial card numbers. Those copies are still being worked through by attackers today.

Winner

Zen Passwords. Zen Passwords. The full record is below, and it is more than one bad year. We would rather win this round on our own merits than on somebody else's history, and an unaudited newcomer is not automatically safer than a scrutinised incumbent. But a documented theft of customer vaults, at settings the company had been warned about four years earlier, is not a tie.

Round 4

Where your vault actually sits

Zen Passwords

In your own private iCloud, on your Apple ID, scrambled so that it means nothing without your password. There is no Zen server holding your vault, because there is no Zen server.

LastPass

On LastPass servers, which is exactly where the copies were taken from. That is the price of syncing to every platform, and it is a real cost as well as a real benefit.

Winner

Zen Passwords. Zen Passwords. A company holding millions of vaults is a target whether or not anyone succeeds. In this case somebody did.

Round 5

What it costs

Zen Passwords

A free plan that keeps five items fully openable, on all of your devices, and you choose which five. Premium beyond that.

LastPass

Free, with unlimited passwords, but restricted to one device type. Computer or mobile, not both. Premium is reported at $36 a year and Families at $48 for six.

Draw

Even. Even, and both are awkward. They give you unlimited passwords you cannot reach from your phone and your laptop at once. We give you every device and only five items. Neither free plan is a place to live. Pick whichever limit annoys you less.

Round 6

The devices it reaches

Zen Passwords

iPhone, iPad and Mac. On a Mac it fills through the system, so Safari and apps are covered and Chrome is not.

LastPass

Windows, macOS, iPhone, Android and every major browser, with no restriction once you pay.

Winner

LastPass. LastPass. Whatever else is true, they run where we do not, and if your week includes a Windows PC we cannot help you.

Round 7

Sharing with the people you live with

Zen Passwords

Nothing. Your vault is yours alone.

LastPass

Basic sharing on the free plan, and a Families plan giving six people their own vaults with shared folders between them.

Winner

LastPass. LastPass. This is the biggest hole in our product and we are not going to score around it.

Round 8

One time codes

Zen Passwords

One time codes live on the item they belong to and in their own tab, made in the app, copied with one tap, and filled along with the password. Not a separate purchase.

LastPass

Codes are stored alongside logins, and there is a separate authenticator app as well.

Draw

Even. Even. Both of us keep your second factor next to the thing it protects, and neither charges extra for it. No gap worth a round.

Round 9

Getting back in when you have forgotten

Zen Passwords

A thirty two character recovery key you can print and keep in a drawer. It leaves out the characters people mix up, so there is no zero, capital O, one or capital I to type wrong. Nobody stores it anywhere, us included. Or you can use social recovery, which splits that key between people you trust. A few of them together can help you back in. None of them can get in alone.

LastPass

Several recovery routes run through LastPass's own systems, which is convenient and means the way back in depends on a company account rather than on something only you hold.

Winner

Zen Passwords. Zen Passwords. Our recovery key is stored by nobody, and social recovery spreads the ability to help you across people you picked, not a company. After the last few years, we think fewer routes that depend on a vendor is the right trade.

Round 10

How it feels on the device you actually hold

Zen Passwords

Built with Apple's own tools, for iPhone, iPad and Mac and nothing else. Real Mac menus and a proper sidebar. Panels that slide the way you expect. Make the text bigger in your settings and the whole app lays itself out again properly.

LastPass

One product that has to work on every system at once, largely through a browser add on. That is a real achievement and it comes with a real cost in how the app feels on a Mac.

Winner

Zen Passwords. Zen Passwords. Being on one platform is a limitation everywhere except here, where it is the whole advantage. We only have to be right on Apple devices, so we are.

So who should choose what

Recommended

Choose Zen Passwords

Every device you own has an Apple logo on it.
You want the memory cost of a guess printed, not implied.
You would rather your vault sat in your iCloud than on a company's servers.
You want a way back in that does not run through a vendor account.

Choose LastPass

You need what we do not have

A Windows PC or an Android phone in your week.
Family sharing, which we do not offer at all.

If you are still there

Leave, then choose

Export your vault and change every password that mattered, starting with email and anything financial.
Assume anything in a vault before 2023 is known to somebody, including which services you use.
Then pick a manager, ours or otherwise, that derives your key with a memory cost.

Common questions

Is this just piling on after a breach?

The breach is the evidence, not the argument. Every article in this series turns on the same question: what is a stolen copy of your vault worth to whoever holds it. LastPass is the case where that stopped being hypothetical, which is why it is worth reading carefully rather than gloating about.

I changed my master password after the breach. Am I fine?

Changing the password does not re-encrypt the copy somebody already took. That copy is still protected by whatever settings your account had at the time. The only safe assumption is that everything in the vault before 2023 is compromised, and the useful action is changing the passwords themselves at each site.

Is PBKDF2 broken?

No. It is a respected method and 600,000 rounds is a serious setting. It simply costs an attacker time and not memory, and memory is the thing a cracking rig is short of. The failure here was not the method, it was leaving old accounts on a fraction of the setting for years.

Can I move my LastPass data over?

Yes. Import reads a LastPass CSV directly, alongside 1Password, Bitwarden, Chrome and generic files. Moving the twenty accounts that matter takes an afternoon.

Has any of this been independently verified?

The LastPass side is public record. Our side comes from our own source code, and we have not had an independent audit. We will publish one when we have it.

A stolen vault is only as good as the number protecting it, on the day it was taken.

Zen Passwords on the App Store

How every round was scored, and where the facts came from

Our scoring, of our own product against a competitor, so read it with that in mind. The breach details come from the public record and from LastPass's own disclosures, read on 25 August 2026.

LastPass documentation, read directly: Everything attributed to LastPass on this page was read from their own security, help and pricing pages on 25 August 2026, not from a third party summary. Where a claim of theirs could not be found in their own words, the round was drawn rather than scored.
Our own side: Item kinds, the Argon2id tiers and the one second calibration budget, the five item free tier, the recovery key, the health scan thresholds, social recovery and the import sources all come from our own source. Vault contents are sealed with AES-GCM and sync as ciphertext through a private database on your own Apple ID.

These are our own readings of our own implementation, current as of this writing, offered in the interest of transparency rather than as a substitute for independent review. Corrections and questions are welcome.

Keep comparing

Zen Passwords vs Apple PasswordsTen scored rounds. Zen takes five, Apple takes three, and two are honest draws.Zen Passwords vs 1PasswordBreadth against depth. Ten rounds, and the number that decides it if you are all Apple.Zen Passwords vs BitwardenFree and everywhere against the strongest settings out of the box.Zen Passwords vs DashlaneFour rounds to three. Same method, eight times the memory.Zen Passwords vs Proton PassThe strongest rival we have, and the one number where we are ahead.Zen Passwords vs EnpassEnpass four, us three. Two products that agree on the important part.Zen Passwords in fullEvery feature, the screenshots on all three devices, and the questions people ask most often.

Everything claimed about Zen Passwords here is what the app does today. Everything claimed about LastPass is limited to things that have been true of it for years, checked against their own documentation. There are no prices on this page, because a price nobody re-checks goes wrong in public. If something here is out of date, tell us and we will fix it.