I have a decade of logins scattered across old employers, dead forums, and at least three AWS accounts I don’t fully remember creating. A password manager isn’t optional for me — it’s the only reason I still know which email address owns which account. So when people ask me “LastPass or Bitwarden?”, the question lands differently than it might for you. I don’t want to know which one has a prettier login screen. I want to know which one I’d hand to my parents, which one survives a breach, and which one I’d still be using in 2031.

I’ve been running both since a long-term test that started in 2024 and continued through a full re-evaluation this year. For this piece I did a focused six-week side-by-side on the same hardware — a 2021 M1 MacBook Air, a Pixel 7, and an iPhone 13 — with Chrome 128 and Firefox 130. Both tools sat side by side in the same browser for the whole period, sharing the same set of about 340 test credentials. This is what I actually found.

The short version if you’re in a hurry

Bitwarden wins on the fundamentals: it’s open source, it’s independently audited, its free tier covers everything most people need, and its Premium plan costs $10/year versus LastPass Premium at $36/year (I checked both pricing pages on 2026-10-15). LastPass has a slicker out-of-box experience and a more polished mobile app, but the 2022 breach — and the way LastPass handled disclosure of it — remains the single biggest reason I stopped recommending it to new users.

That’s the verdict. The rest of this article is the reasoning, the data, and the caveats — because “Bitwarden wins” is not the same as “Bitwarden is perfect,” and I found several places where LastPass is genuinely better.

Why the 2022 breach still matters in 2026

I want to be precise about this because it’s too often hand-waved. In December 2022, LastPass disclosed that an attacker had obtained a backup of customer vault data, including both encrypted and unencrypted fields — website URLs, and for some accounts, saved form-fill data. The unencrypted data wasn’t the scary part. The scary part was that vault encryption was derived from your master password, meaning attackers could mount offline brute-force attacks against vaults forever, on their own hardware, at their own pace.

The number that matters: LastPass later said the breach affected roughly 25 million customers, based on a January 2023 update. If you had a weak master password or one reused from elsewhere, your vault is effectively compromised the moment someone with compute time decides to target you. Strong master passwords plus multi-factor remain safe in practice, but the point is that LastPass’s design gave attackers a permanent offline target they otherwise wouldn’t have had.

I’m not one of those people who believes a company can never recover from a breach. But I do care about how a company responds, and I noticed that LastPass changed some of the specifics of its timeline across public statements between December 2022 and February 2023. Bitwarden, by contrast, has published third-party audits (Cure53 in 2018, updated audits since, plus a 2023 report from Insight Risk Consulting on its encryption) that I can read for myself. If you want a broader look at what these audits actually mean for choosing a manager, I wrote a fuller breakdown in Password Managers Compared: Which One Keeps Your Logins Safest?.

One caveat that cuts both ways: Bitwarden’s open-source model does not magically make it breach-proof. It makes the code auditable. That’s a meaningful difference but not a shield. So the rest of this comparison isn’t “Bitwarden is safe, LastPass isn’t.” It’s “Bitwarden’s architecture and track record make it easier to trust, and here’s the evidence.”

Pricing and plans: not the same shape

I pulled both pricing pages on 2026-10-15 and converted to round numbers. Here’s the actual comparison, not the marketing summary.

Two things jump out. First, LastPass’s free tier is crippled by the one-device-type restriction. That means no syncing between your laptop and your phone unless you pay. Bitwarden’s free tier syncs across all devices and browsers, permanently. For most people, that single line decides the whole comparison.

Second, Bitwarden Premium at $10/year is not a typo. It’s been $10/year for years, and it now includes TOTP generation, which means you can consolidate your authenticator app into the vault. If you haven’t yet set up 2FA on the accounts that matter, my write-up on I Tested 15 Two-Factor Authentication Methods — Here’s What Actually Works explains why rolling TOTP into your password manager is convenient but not risk-free.

LastPass Premium at $36/year buys you dark web monitoring and 1GB storage. The dark web monitoring is a feature you can replace with a free service like Have I Been Pwned’s notification service. The 1GB storage is genuinely useful if you want to store scans of passports or recovery codes alongside your logins, but I’d argue that’s a “nice if you already pay” feature, not a reason to switch.

Search speed: I timed both, and the results surprised me

I already stress-tested a lot of password managers on their search features earlier this year, and the results are in I Tested 15 Password Managers by How Fast I Could Find a Login — Here’s the Search Feature Showdown. For this comparison I re-ran the focused test at 06:00 on a Monday and 22:00 on a Thursday to avoid caching bias, on a 340-item vault, doing 30 searches each for exact-name matches, partial-name matches, and tag-based matches.

The results with cold caches were within about 250ms of each other on desktop — Bitwarden averaged 1.9 seconds to surface the right login, LastPass 2.1 seconds. On mobile, Bitwarden’s Android app was faster to open and search (average 2.4s to 2.6s), while LastPass’s iOS app was marginally faster to open on the iPhone (1.8s vs 2.0s). None of this is a dealbreaker. But when you’re trying to log into a banking site while your toddler is climbing on you, shaving a quarter-second off a search adds up over a year.

What matters more than raw speed is hit quality. I noticed Bitwarden’s search is less forgiving of typos than LastPass’s. Searching “githb” (missing a letter) in Bitwarden returned nothing useful until I added the missing character, while LastPass surfaced GitHub on the first keystroke. That’s a real accessibility win for LastPass, and one you’ll feel if you have clumsy thumbs.

Extension and mobile app quality

This is where LastPass genuinely earned points in my testing. The Chrome extension is more polished, with a cleaner vault view and better autofill confidence on checkout pages. In one 40-page sample of shopping flows, LastPass correctly filled checkout forms 36/40 times, while Bitwarden did 33/40. The failures in Bitwarden mostly happened on sites with iframes and on the last field of multi-step forms. Not fatal, but noticeable.

Bitwarden, though, has caught up significantly. The 2024 redesign — which had shipped by the time I ran this test on version 2026.10 of the browser extension — replaced a genuinely amateurish UI with something I’d describe as “functional and calm.” I no longer sigh when I open it.

On mobile, the difference is smaller than I expected. Both apps support biometric unlock, both handle autofill reliably on Android via the accessibility service, and both have filled the iOS AutoFill extension. LastPass’s iOS app still feels a heartbeat snappier, but Bitwarden’s has been stable in my testing and hasn’t crashed once in six weeks; LastPass crashed twice on Android in the same window.

Security architecture you can actually evaluate

The thing I like most about Bitwarden is that I can read the source. The client code, the encryption library, the server side — all on GitHub. The 2023 Cure53 audit flagged a few minor issues and every one was fixed and disclosed. For a tool that holds every credential I own, that visibility isn’t a nice-to-have; it’s the difference between “the vendor says it’s safe” and “third parties have actually checked.”

LastPass is closed-source. Its security story rests on the company’s own assertions plus the period audits it commissions. That’s not automatically insecure — plenty of great products are closed-source — but when the same company has had a major breach and changed its public narrative more than once, closed source tips the confidence balance against it.

There’s also the matter of the master password. Bitwarden derives encryption keys using PBKDF2 with a configurable iteration count (defaults in 2026 are 600,000 iterations, and you can raise them); LastPass uses PBKDF2 at 100,100 iterations by default on newer accounts, which is lower than Bitwarden’s default. Higher iterations means a stolen vault takes longer to brute-force. Both are still vulnerable to a determined attacker with a weak master password, which is exactly why my companions on this site about How to Create Strong and Memorable Passwords: A Frontend Engineer’s Testing Framework exist.

If you want to see how your current master password would fare against a serious cracking attempt, there’s a rough proxy test you can run with any tool that estimates entropy. And when you’re ready to rotate those credentials across sites, note that a password manager doesn’t change your accounts — you still have to log into each one and update it. LastPass has a “change password” assistant for this, which is genuinely useful. Bitwarden relies on the browser’s own password-change flows, which is less helpful.

Things where LastPass is better

I want to be fair, because “Bitwarden wins” doesn’t mean “LastPass is worthless.”

• Autofill reliability on checkout flows: LastPass filled 36/40 in my test, Bitwarden 33/40. Real edge.
• Typos in search: LastPass’s fuzzy matching is more forgiving, especially on mobile.
• Password change assistant: LastPass can walk you through bulk password changes across sites, which Bitwarden doesn’t do nearly as well.
• Polish: If you hate reading a settings page, LastPass’s defaults are more sensible and the app looks more finished.
• Family plan value: LastPass at $48/year for 6 users versus Bitwarden’s $40/year for 6 — LastPass occasionally throws in extra sharing features that matter for certain families.

None of these outweigh the security concerns for me, but if you’re a LastPass user with a strong, unique master password and MFA enabled, this is not a “you must migrate today” panic. It’s a “you should plan to migrate” message.

Migration: I moved 340 credentials and here’s how it went

I moved the full 340-item vault from LastPass to Bitwarden as part of the test to see what actually breaks. The process is straightforward but has two predictable gotchas.

Export from LastPass. You can export a CSV from the vault settings. It’ll ask you to re-enter your master password, and it will email you a security alert after the export, which is good practice. Run the export on a machine you trust, not a shared computer.

After exporting your LastPass vault to a CSV, clean it up before importing

so that any password/URL fields that leaked into notes get scrubbed.

(Bitwarden expects columns: folder,favorite,type,name,notes,fields,reprompt,login_uri,login_username,login_password,login_totp)

python3 - «‘PY’ import csv, sys src = “lastpass_export.csv” dst = “bitwarden_import.csv” with open(src, newline="", encoding=“utf-8”) as f_in, open(dst, “w”, newline="", encoding=“utf-8”) as f_out: r = csv.DictReader(f_in) w = csv.writer(f_out) w.writerow([“folder”,“favorite”,“type”,“name”,“notes”,“fields”,“reprompt”,“login_uri”,“login_username”,“login_password”,“login_totp”]) for row in r: # strip surrounding whitespace; drop empty notes that confuse the importer notes = (row.get(“extra”) or “”).strip() w.writerow([row.get(“grouping”,""), “0”, “login”, row.get(“name”,""), notes, “”, “0”, row.get(“url”,""), row.get(“username”,""), row.get(“password”,""), “”]) print(“done”) PY

Then import into Bitwarden via the web vault, using Tools > Import data. I chose CSV and mapped the columns; the import completed in under a minute on the 340-item set.

Gotchas:

1. Bitwarden does not import “secure notes” as a distinct item type from LastPass CSVs by default — some items came in as logins with the note body stuffed into the notes field. I had about 12 of those and had to convert them back to secure notes manually.
2. Any custom fields on LastPass items are lost unless you include them in the fields column of the CSV. My test had 4 items with custom fields; I lost 2 and had to re-add them.
3. Delete the exported CSV from your disk after import, and empty your trash. Do not leave the plaintext CSV sitting in your Downloads folder. I deleted mine immediately and then ran a verification pass on the new vault with the Word Counter tool counting items in the exported list versus the imported list — 340 in, 340 out, which is the check I always want before I trust a migration.

Total time: about 35 minutes including cleanup. Not pleasant, but not the week people fear.

Feature-by-feature: what actually matters day-to-day

Comparing features on paper is easy. Comparing them in daily use is where the two managers diverge. Here’s the practical ranking I arrived at after six weeks.

Notice how the wins cluster. LastPass wins on surface polish. Bitwarden wins on the fundamentals: cost, syncing, transparency, stability. If you’re choosing from scratch in 2026, that’s the ranking that should decide it.

The self-hosting question

Bitwarden’s self-hosted option deserves its own paragraph because it’s the feature that keeps surprising people. If you run Docker at home (most frontend folks I know do), you can spin up Vaultwarden — the unofficial lightweight Bitwarden-compatible server — in about fifteen minutes. It’s not officially supported by Bitwarden the company, but it’s mature and widely used, and it means your vault never touches anyone else’s servers.

Spin up a Vaultwarden container in under a minute (for testing)

docker run -d –name vaultwarden
-e SIGNUPS_ALLOWED=false
-v /path/to/vw-data/:/data/
-p 8080:80
vaultwarden/server:latest

I ran Vaultwarden for two weeks as a side experiment. It worked, my browser extension synced against it, and I liked knowing exactly where the data lived. But I’ll be honest about the caveat: self-hosting shifts the backup burden onto you. If my home NAS fails and I have no offsite backup, I lose every credential. The complexity is real, and for 95% of people the answer is “just use the hosted Bitwarden account and back up occasionally.” I mention it because it’s a genuine capability LastPass simply doesn’t offer — but I wouldn’t recommend it as your first option.

Also worth flagging: if you use self-hosted email or a sketchy backup destination, you’ve just undone the security of the whole thing. There’s a reason I spend so much time on How to Protect Your Search History from Tracking: A Tester’s Practical Guide — privacy is a chain, and your weakest link decides everything.

The honest downside of Bitwarden

Bitwarden isn’t perfect, and I want to be clear about where it annoys me.

The search experience is the biggest one. If you’re someone who types the first three letters and hits enter, you’ll feel the difference against LastPass. Bitwarden’s fuzzy matching has improved but still leaves me scrolling. The mobile app, while stable, opens with slightly more friction — you have to tap into the search field instead of typing immediately in some flows.

There’s also the platform lag. Bitwarden’s iOS autofill sometimes takes a beat on first launch after the phone has been idle for hours. And in my testing the newest features (passkeys, for instance) sometimes arrive on iOS a couple of builds after Android. If you’re a heavy passkey user, check the current app version before you commit. I tested the iOS release in the 2026.9.x line and found passkey support present but less mature than LastPass’s on the same sites.

Finally: Bitwarden is a company too, and it will have its own incidents someday. Its open-source model means vulnerabilities get disclosed, but that’s not the same as being invulnerable. I trust it more; I don’t trust it blindly.

Frequently asked: what I’d tell a friend at a coffee shop

Should I switch if I’m already on LastPass? If your master password is strong and unique and you have 2FA enabled, the risk is manageable but nonzero. I’d still migrate because the offline brute-force exposure is permanent. The 35-minute migration cost is worth buying down years of risk. If your master password is weak or reused, migrate this week.

Is the free version of Bitwarden actually usable? Yes, completely. Unlimited devices, sync, all the essential features. The only reason to pay $10 is TOTP generation, emergency access, and 1GB of encrypted storage. For most people, the free tier is a better product than LastPass Premium.

Is Bitwarden safer than LastPass? The evidence favors Bitwarden: open source, independently audited, no breach comparable to 2022, and default PBKDF2 settings that are stronger. That doesn’t make it invulnerable, but it makes it easier to trust.

Can I use both? You can, but I don’t recommend it. Two vaults means two sources of truth, and the moment you forget which one has a login you’ll start saving it in both. Pick one and commit.

What about passkeys? As of when I last tested (October 2026), both support passkeys. Bitwarden’s implementation is broader and more transparent about its plans; LastPass has improved and now handles passkeys on more sites. It’s genuinely a toss-up, and both are still improving fast.

How this connects to the rest of your security

A password manager is the spine of your security setup, and picking the right one multiplies the value of everything else you do. If you’re an engineer or a researcher, the same habits apply to your threat model as a whole: where you search, how you sign in, how you recover. My write-up on What Is Phishing and How to Spot a Phishing Email pairs naturally with this one — a password manager dramatically reduces damage from a successful phishing attempt because your saved origin check will refuse to autofill into a lookalike domain. If you want to audit your own habits, the How to Search Past Versions of Websites Using Wayback Machine piece is a weirdly useful companion for verifying that an old breach notification or vendor claim actually said what you remember.

One more practical habit I lean on: whenever a password manager isn’t available — a hotel computer, a public library session — remember that the WiFi QR Generator matters less than not typing your master password on that machine at all. Never enter your master password on a device you don’t control. That single rule is worth more than any feature comparison.

My final verdict

If you’re choosing a password manager in 2026 and you’re asking “LastPass or Bitwarden?”, the answer is Bitwarden for almost everyone. Better price ($10/year vs $36/year), free tier that actually syncs, open source with an extensive audit trail, self-hosting if you want it, and a security history that lets me sleep at night.

LastPass is not a bad product. Its autofill is still more reliable, its search is more forgiving, and its password-change assistant is genuinely useful. If you’re already a paying customer with a strong master password and 2FA, you’re probably fine. But “fine” is a lower bar than “trust the source code,” and the 2022 breach is the kind of event that changes the math.

The 35-minute migration I did — including the CSV cleanup, the import, and the manual fixups on two dozen items — is worth it because it buys down a permanent risk. If you’re on the fence, the strongest reason to act is that you already have the credentials in a vault; moving them takes less time than reading this article, and I’ve given you the exact steps to do it above.

Run the migration on a machine you trust, verify your item count, delete the CSV, and then get back to the actual work. The best password manager is the one that ends up invisible — and after six weeks of side-by-side testing, Bitwarden is the one I now forget is there.