According to the LastPass FAQ, employees of LastPass cannot see nor decrypt the stored passwords.
LastPass encrypts your Vault before it goes to the server using 256-bit AES encryption. Since the Vault is already encrypted before it leaves your computer and reaches the LastPass server, not even LastPass employees can see your sensitive data!
However, there is an option to use SMS Recovery in case of a lost Master Password.
One method of gaining access to your account after you forget your Master Password is to use SMS recovery to reset the password. This method, however, requires that you enable SMS account recovery in LastPass before you forget your Master Password. If you have already enabled SMS recovery for Master Password retrieval, do the following:
- Navigate to https://lastpass.com/recover.php, enter your email address, then click Continue.
- The system texts your phone a numeric code. Enter this code into your browser, and click Verify.
- Click Press to Recover Account.
- If Multifactor Authentication is enabled, authenticate yourself, but you must type the authentication numbers in your web browser for this step.
- When the next window appears advising that Account Recovery has been detected and that you must immediately change your password, click OK to proceed.
- Enter a new Master Password and a password hint (optional), then click Confirm.
- When prompted with a message that your password has changed and advising you to log out manually (if you are not automatically logged out), click OK to proceed.
- Once you have been logged off of LastPass, you can log back in again using your new Master Password.
This suggests that the stored passwords are decrypted without knowing the original master password, and re-encrypts them with the new master password. This happens all server side.
To me, it seems like LastPass employees could abuse this method to decrypt users passwords.
Am i correct or am i missing something?