LastPass vs Proton Pass Comparison

• Premium (individual, 1-year): $36 per year
• Families (6 users, 1-year): $48 per year

• Pass Plus (individual, annual): $35.88/year
• Pass Family (up to 6 users, annual): $59.88/year

Source-code review and gray-box testing of the browser extensions, mobile and desktop apps, and CLI

The vault is encrypted client-side with AES-256 in CBC mode. The key is derived from the master password with PBKDF2-SHA256 at a default 600,000 iterations for new accounts (older accounts kept far lower counts for years); one extra PBKDF2 round produces the login hash, and further rounds are applied server-side. Passwords, usernames and notes are encrypted, but item URLs and account metadata are stored unencrypted.

Vault and item data are encrypted with 256-bit AES-GCM under 32-byte random keys; the user key is protected by a bcrypt hash of the account password. Authentication uses a hardened SRP implementation; sharing uses OpenPGP with ECC (Curve25519). Every field is encrypted client-side — usernames, URLs and notes included — so Proton cannot see which services you hold accounts with. Offline access on paid plans uses Argon2 for the local hash.

Operated by LastPass US LP under the holding entity LMI Parent, L.P. Spun out of GoTo (formerly LogMeIn) as a standalone company on 1 May 2024; the 2022 breach happened while LastPass was still part of GoTo. GoTo and LastPass continue to share the same private-equity owners, Francisco Partners and Elliott Management.

Proton AG, Geneva, Switzerland. Since June 2024 the primary shareholder is the non-profit Proton Foundation, which the founders endowed with Proton shares in an arrangement they describe as irrevocable. Proton began as a 2014 crowdfunding campaign.