I am a user of Lastpass and I have some concern about the storage of local data. According to my knowledge about Lastpass, there is an encrypted local vault stored in my devices with the Lastpass app or browser extension. The encryption key is generated with my master password and every time I login with internet connection, the vault is updated. Now, suppose I have two devices, say A and B, both with the Lastpass browser extension and has been logged into Lastpass with internet connection recently. At some point, I suspected that device A was infected with some malware such as a keylogger. I stopped using device A immediately. Then I use the “clean” device B to change the master password with good internet connection. In this case, both online vault and local vault of device B were updated and reencrypted (according to my understending, is it correct?), but not the local vault in device A. Suppose the hacker somehow gain access to device A, is it possible for him to use my old master password to decrypt the local vault in device A offline? If this is possible, wouldn't it be risky to store the data locally?

1 Answer 1


Sure fire way to keep a hacker from stealing your passwords off of device A is disconnecting it from the internet, then removing the malware. If you want to be really safe, reinstall the OS.

That being said, your understanding is correct, the hacker could potentially decrypt your vault on the computer.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .