I am a web developer, not a security expert, but I know a little bit about security because I need it as a web developer.

According to LastPass,

LastPass encrypts your Vault before it goes to the server using 256-bit AES encryption. Since the Vault is already encrypted before it leaves your computer and reaches the LastPass server, not even LastPass employees can see your sensitive data!

As I understand it simply means that LastPass employees cannot see password by using any method. So how we can find our passwords which are saved on their servers (encrypted password)? I mean if their program can show passwords for us, why employees can't use the same method to decrypt our passwords which are stored in their servers?

Or do I misunderstand some point?


The decryption happens on your device, using the password you enter when starting the program, or a stored version of this, if you've selected "remember me" or are using biometric authentication. The password isn't sent to their servers, so the employees don't have access to it.

In more detail: the master password is used to generate an encryption key, which is then used on the client device to encrypt passwords. When you log into a new device, the password you've entered is used to generate the same encryption key, which, since symmetric encryption is used, also allows for decryption. This effectively means that the master password is the key for all the other data stored.

If you change your master password, the client side code re-encrypts all your passwords with the new key generated from this. This can take a while if you have a lot of passwords stored.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.