If LastPass does not store your master password, then how can you login to use their web app?
Surely you must type it in, it is sent over using SSL, and then salted/hashed on the server-side, and then compared with what in their DB, like any other login scheme on the web.
No, The LastPass website does not normally know your login credentials.
On their website, they supply JavaScript code to do in-browser decryption. So, yes, we still need to trust LastPass that this code is implemented correctly, but the password isn't sent to their servers.
Note: Trusting lasspass means that we need to trust them not to give you a non-standard version of their website javascript for certain special IP addresses at the behest of the NSA if they use a National Security Letter.
Resources:
Also see How safe are password managers like LastPass?.
I had concerns about its security integrity and the fact that your passwords are saved on servers that are located in the USA. Even though they only store encrypted data, LastPass is obliged to give this data to the USA government when requested (due to the PATRIOT Act).
Since I realized this, I moved to KeePass Password Safe, an offline password manager with protection against keyloggers.
