Bitwarden vs LastPass Comparison

• Premium (individual, annual): $19.80/year
• Families (up to 6 users, annual): $47.88/year

• Premium (individual, 1-year): $36 per year
• Families (6 users, 1-year): $48 per year

Penetration test and source-code audit of the Bitwarden core application

600,000 PBKDF2-HMAC-SHA256 iterations by default on the client, plus more server-side (700,000 total for the master password hash); Argon2id is available as an alternative KDF. Item names, notes, URIs, custom field names, TOTP secrets and card/identity data are all encrypted client-side. Vault metadata — which account an item belongs to, the number of items — is not.

The vault is encrypted client-side with AES-256 in CBC mode. The key is derived from the master password with PBKDF2-SHA256 at a default 600,000 iterations for new accounts (older accounts kept far lower counts for years); one extra PBKDF2 round produces the login hash, and further rounds are applied server-side. Passwords, usernames and notes are encrypted, but item URLs and account metadata are stored unencrypted.

Private US company based in Santa Barbara, California; the parent company of 8bit Solutions LLC. Founded by Kyle Spearrin, who remains Chief Innovation Officer.

Operated by LastPass US LP under the holding entity LMI Parent, L.P. Spun out of GoTo (formerly LogMeIn) as a standalone company on 1 May 2024; the 2022 breach happened while LastPass was still part of GoTo. GoTo and LastPass continue to share the same private-equity owners, Francisco Partners and Elliott Management.