From this support thread on the LastPass website:
LastPass says they never receive my Master Password. Don’t I send it to the LastPass servers when I log in?
No, when you login to LastPass, two things are generated from your Master Password using our code discussed previously before anything is sent to the server: the password hash and the decryption key. This is all done locally.
- The password hash is sent to our servers to verify you. Once verified, we send back your encrypted Vault. We are only sent your hash, not your Master Password.
- The decryption key, which NEVER leaves your computer, is then used to decrypt your Vault once it comes back.
So to answer your questions:
How does LastPass know that my password is correct?
LastPass only has access to your vault in an encrypted form; they can't read it without knowing the key. When logging in, your client only sends the hash of your password, and LastPass simply compares it to the password hash they possess.
How does LastPass decrypt my passwords on a new device?
The decryption key is a function of your password. As a result, the same input (your password) will always produce the same output (hash + the decryption key). That's all your new device needs to know in order to decrypt your vault.
Is it really secure?
The answer to this depends on how much you trust LastPass.
If it works exactly the way they say it does, then a sufficiently strong password should be relatively secure.
If at any point they obtain access to your password (whether it be intentional or accidental), you should probably consider it to be compromised, and should not only change your LastPass password, but the password for every account you have in your vault.
What if I forget my Master Password?
If you forget your password, you lose access to your vault. LastPass can't send it to you or reset it..
For users who are willing to trade away some of their LastPass security in exchange for a "safety net", LastPass allows you to produce and use One-Time-Passwords, and you can even enable Emergency Access to provide access to your account from specified users.
LastPass Help Desk - One Time Passwords
One Time Passwords
If you are using an untrusted public computer and need to access your LastPass data but are hesitant to do so because of potential keyloggers, LastPass provides One Time Passwords (OTPs) as one option for securely accessing your account.
While using a trusted computer, go to https://lastpass.com/otp.php to create a list of random passwords that can be used only once to log into LastPass. You must be logged into the plugin to manage your OTPs. From this page, you will be given the option to Add a New One Time password, Clear All OTPs, or Print your OTPs.
Each time you generate a new OTP, it will be added to your list. These passwords can be printed or carried with you on a portable storage device. You can then revisit the above page to login using this password and you can be certain that, even if captured, the password will not allow access into your account in subsequent attempts because it expires after you login with it once.
You can even use OTPs with another form of multi-factor authentication (Yubikey, Google Authenticator, Sesame or GRID), to be even more secure when you are not using a trusted computer.
LastPass Help Desk - Emergency Access
Do you worry about your family, friends, partner, or spouse having access to important accounts should something happen to you? Do you want an easy way to give them the passwords and logins they’d need to manage accounts on your behalf? Prepare for the unexpected and ensure your loved ones don’t get locked out of important accounts, like paying bills or the mortgage, and that they can manage your digital legacy.
With the Emergency Access feature, you can give trusted family and friends access to your LastPass account in the event of an emergency or crisis. Your designated Emergency Access contact(s) can request access to your account and securely receive the passwords and notes without knowing your Master Password. You decide how much time should pass before they’re given access once they request it, and you can decline access if it’s requested unnecessarily.
Emergency Access can also be used as an alternative account recovery feature, if you worry about ever forgetting your master password and want to ensure you have a backup way of recovering your vault.
Please note: the person you share access with will need their own LastPass account as well.