The 2022 breach that sent people scrambling for LastPass alternatives is now three years in the rearview mirror, long enough to ask honestly: is the exodus narrative still accurate, or has LastPass quietly stabilized while everyone's attention moved on? The short answer is the trust damage hasn't actually repaired itself, and the alternatives that absorbed those refugees have only gotten more competitive since.
Where LastPass actually stands now
LastPass still runs a real product: Free covers one device type, Premium is $3/month with dark web monitoring and emergency access, Families is $4/month for 6 accounts. On paper, that's competitive pricing. What hasn't changed is the reputational math. The 2022 breach exposed encrypted vaults, and while LastPass has since improved its security posture, the core problem for a password manager is that trust, once broken, doesn't come back just because the underlying software got fixed. Security-focused communities on Reddit still treat LastPass as the default cautionary tale in any password manager discussion, and that's not a perception the free tier's device restriction (crippled to one device type only) does anything to help repair.
The honest framing: LastPass isn't broken today in any obvious technical sense, but the reputational cost of that breach is a sunk cost that new users have no reason to accept when better-trusted alternatives exist at similar or lower prices.
1Password: the polished, no-free-tier default
1Password remains the option IT teams reach for once self-hosting Bitwarden looks like too much work and LastPass has worn out its welcome. Individual is $3.99/month billed annually, Families covers 5 members at $5.99/month with shared vaults, and Teams/Business runs $7.99/user/month with admin controls and activity logs. There's no free tier at any level, a real gap compared to Bitwarden.
What justifies the price for a lot of users is the Secret Key, a second encryption factor beyond the master password that protects against server-side compromise in a way LastPass's architecture didn't when it mattered most. Apple ecosystem integration is genuinely polished, and Watchtower's breach monitoring catches reused or weak passwords proactively. The real catch: monthly billing (without the annual commitment) costs meaningfully more, and there's no local-only vault option, everything lives in 1Password's cloud whether you want it there or not.
Bitwarden: still the free option that doesn't feel like a downgrade
Bitwarden's free tier remains the most generous in the category: unlimited passwords across all devices, a password generator, and secure notes, genuinely usable as a permanent home rather than a trial. Premium is $20/year (roughly $1.67/month) adding 1GB encrypted storage and a built-in TOTP authenticator. Families is $48/year for 6 premium accounts, and Teams runs $4/user/month for shared vaults with event logging.
Being open source and independently security-audited is Bitwarden's real trust advantage over both LastPass and 1Password, anyone can verify what the code actually does rather than taking a vendor's word for it. Self-hosting is a real, supported option for anyone who wants to run their own vault infrastructure entirely, which neither LastPass nor 1Password offers at all. For most individual users, Bitwarden's free tier alone is a complete, permanent answer, not just a stepping stone toward a paid plan.
Dashlane: the VPN bundle, at a real premium
Dashlane bundles a VPN, dark web monitoring, and an automatic password changer into the same subscription. Free covers 25 passwords on 1 device, genuinely limited. Premium runs $4.99/month with unlimited passwords and the VPN included, and Family is $7.49/month for 6 accounts with VPN coverage across all of them.
The VPN bundle is a real convenience for anyone who'd otherwise pay separately for both a password manager and a VPN service, and the automatic password changer (which resets passwords on supported sites without manual re-entry) is a feature none of the other three offer. The tradeoff is straightforward: Dashlane is consistently the most expensive of the four at every comparable tier, and paying for a VPN bundled into a password manager only makes sense if you'd actually use both halves of that bundle, not just the vault.
Real cost for a family of 4 switching off LastPass
Bitwarden Families: $48/year flat, the cheapest real option, or $0/year if 4 people just use separate free accounts and share credentials manually through Bitwarden's secure sharing feature instead of a formal family plan.
1Password Families: $5.99/month x 12 = $71.88/year, covering up to 5 members with the Secret Key and Apple ecosystem polish.
Dashlane Family: $7.49/month x 12 = $89.88/year, the most expensive, but the only one of the three that includes VPN coverage for the whole family as part of that price.
Has the exodus narrative held up?
The pattern holds. Security-conscious Reddit threads discussing password manager choice in 2026 still treat "not LastPass" as close to a given starting assumption, and the specific alternatives named are consistently the same three: Bitwarden for free/open-source trust, 1Password for polish and Apple integration, Dashlane for the VPN bundle. What's changed since the original wave of breach coverage isn't the narrative itself, it's that Bitwarden and 1Password have both continued shipping real improvements (Bitwarden's authenticator integration, 1Password's Secret Key architecture) that widen the gap rather than let LastPass catch back up on trust alone.
What actually happens during a real migration
Moving a full vault off LastPass is more mechanical than risky: all three alternatives support a direct CSV import from LastPass's own export tool, and the bulk of a migration is just running that import and then manually re-checking a handful of entries that don't map cleanly, shared folders and attached secure notes are the two categories most likely to need manual cleanup afterward. The bigger practical risk isn't the software step, it's the window between exporting an unencrypted CSV file and deleting it once the import is confirmed working. That export file sits in plain text wherever it's saved, and it's worth treating that file with the same care as the vault itself: delete it immediately after a successful import rather than leaving it in a downloads folder.
Browser extensions and mobile apps for the new manager should get installed and tested with a handful of real logins before fully retiring the old LastPass account, since discovering a broken autofill integration after canceling the old subscription means falling back to manually looking up passwords rather than having a working backup in place.
Which one to actually pick
Pick Bitwarden if free (or nearly free) and open-source verifiability matter, or if self-hosting is a real requirement, it's the only one of the four that offers it.
Pick 1Password if Apple ecosystem polish and the Secret Key's extra encryption layer are worth paying for, and annual billing isn't a dealbreaker.
Pick Dashlane if a VPN is genuinely part of the budget anyway and bundling it into the password manager subscription is a real convenience, not just an unused add-on.
Skip LastPass. Not because the current product is technically unsafe, but because there's no real advantage it offers over the other three that outweighs starting fresh with a vendor that doesn't carry a major breach in its recent history.