What are the real privacy trade-offs between LastPass and 1Password for team password sharing?

The moment the trade-off stops being theoretical

A twelve-person revenue team shares one analytics vendor login, one ad-platform account, one CRM sandbox, and a dozen SaaS trial accounts nobody remembers creating. Then an SDR leaves on a Friday. Monday morning, three things need to happen: revoke that person's access, confirm what they could see, and get the replacement productive before the quarter closes. That single sequence exposes every meaningful difference between the two products.

With LastPass, the departing user's account is disabled from the admin console, shared folder membership is removed, and the new hire receives an email invite. They set a master password, install the extension, and shared folders appear. Total elapsed time is typically under ten minutes of the admin's day plus five minutes of the new hire's. If the new hire forgets their master password two weeks later, an administrator with the right policy enabled can initiate a recovery and the person is back in the same afternoon.

With 1Password, the same revocation happens from the admin console, but provisioning the replacement requires that person to receive and retain a Secret Key — a long random string generated on their device and embedded in an Emergency Kit PDF. If they lose both the Secret Key and their account password, no administrator and no vendor employee can restore the account. Recovery exists, but it works by having an administrator initiate a recovery flow that re-keys the account, and it depends on the organization having a functioning admin who is not themselves locked out.

The privacy trade-off is exactly this: the recoverability that makes LastPass operationally forgiving is the same mechanism that gives an administrator — or anyone who compromises an administrator — a route to a user's vault. The friction that makes 1Password annoying to onboard is the same mechanism that removes the vendor from the threat model entirely. Neither is universally correct. A four-person startup with one technical founder and no compliance obligations has different math than a fifty-seat organization mid-SOC 2 audit.

There is a second, quieter dimension most teams discover late: what the vendor stores unencrypted. In the 2022 LastPass incident, the attacker obtained backup copies of customer vault data. Password fields were encrypted, but LastPass's own disclosure confirmed that URL fields were stored unencrypted in the vault format at that time. For a revenue team, an unencrypted URL list is a complete map of the commercial stack — which billing system, which data enrichment vendor, which internal admin panels exist and at what hostnames. That is a privacy exposure even when no password is recovered, and it is a category of leak most buyers never think to ask about.

How the two encryption models actually differ

Both products are described as zero-knowledge, and both genuinely encrypt vault contents on the client before transmission. The difference is what feeds the key derivation and whether the vendor holds a lever.

LastPass derives an encryption key from the master password using PBKDF2-SHA256. The iteration count is the security parameter here, and it is where the history matters: LastPass's default iteration count was 5,000 for accounts created in earlier years, was later raised to 100,100, and was raised again to 600,000 following the 2022 incident. Critically, existing accounts did not automatically inherit the higher counts — many vaults stolen in that incident were protected at legacy iteration levels, which is why the practical crackability of a stolen vault depended enormously on when the account was created and whether anyone had touched the setting. Any team still running LastPass should verify the iteration count in account settings rather than assume the current default applies to them.

1Password combines two inputs. The account password is something the user chooses and remembers. The Secret Key is 128 bits of entropy generated locally at signup, never transmitted to the server, and used alongside the account password in the key derivation. The practical consequence is that a stolen server-side vault blob is not brute-forceable in the way a weak-master-password vault is, because the attacker lacks a factor that was never on the server. A weak account password does not open the vault by itself.

That is the entire crux. Offline attack resistance in LastPass is a function of how good the user's master password is and what iteration count their account happens to carry. In 1Password it is a function of a 128-bit random value the user never chose and cannot make weak.

Sharing works differently too, and the difference affects how much a single compromise reveals. LastPass's primary sharing construct is the shared folder: a container whose members all get every item inside it. Fine-grained per-item control exists in business tiers but the folder is the natural unit, and the natural unit is what teams actually use. 1Password's construct is the vault, and organizations typically run several — one per function, one per sensitivity tier — with per-vault permissions covering view, edit, manage, and export separately. The privacy consequence is blast radius. If one contractor's laptop is compromised, the question "what did they have" is answered by which folders or vaults they belonged to. Teams that put everything in one shared container get the worst possible answer regardless of which product they bought.

Both offer time-limited or revocable access patterns, but revocation has a hard limit worth stating plainly: revoking access removes future retrieval, not past knowledge. Anyone who viewed or copied a credential still has it. The only real remediation after a departure or a breach is rotation of every credential the person could reach. This is true of every password manager ever built, and it is the single most commonly skipped step in offboarding.

Numbers that actually drive the decision

Pricing as published: LastPass Teams and Business tiers sit in roughly the four to seven dollar per user per month range depending on tier and billing term, with the Business tier adding SSO and directory integration and advanced policy controls. 1Password Teams Starter Pack and Business sit in roughly the eight to eleven dollar per user per month range, with Business adding advanced reporting, custom roles, and expanded policy controls. Both vendors adjust pricing and both offer annual discounts, so treat these as directional and confirm on current pricing pages before budgeting.

At twenty-five seats, the delta between a five-dollar seat and a nine-dollar seat is one hundred dollars a month — twelve hundred a year. At one hundred seats it is roughly forty-eight hundred a year. That number is small relative to almost any revenue stack, which means cost should rarely be the deciding variable. If the price difference is what is driving the decision at ten or twenty seats, the decision is being made on the wrong axis. What actually costs money is a credential rotation event: re-keying forty shared SaaS accounts, coordinating with every person who used them, and absorbing the outages when something breaks silently because an API key changed.

Onboarding time is the one operational metric that reliably differs, and it is worth measuring rather than guessing. Realistic ranges from practitioner experience: LastPass invite-to-productive is roughly five to ten minutes for a non-technical user. 1Password is roughly ten to twenty minutes because of the Emergency Kit step and the requirement that the user store the Secret Key somewhere durable before proceeding. At a hundred hires a year, the difference is on the order of ten to twenty hours of aggregate onboarding time annually. That is real but not decisive. Where it becomes decisive is device switching: every new device on 1Password requires the Secret Key again, and users who did not save their Emergency Kit hit a wall. Teams that adopt 1Password without a policy for where the Emergency Kit lives will generate a steady trickle of support tickets forever.

Iteration counts deserve a concrete number rather than a hand-wave. PBKDF2 at 5,000 iterations versus 600,000 is a 120x difference in the cost of each guess. Against a password with genuinely high entropy, both are fine. Against a twelve-character human-chosen password with predictable structure, the difference between those two settings can be the difference between a stolen vault being opened and not. This is why the audit step matters more than the vendor choice for existing LastPass tenants: check the iteration count first, then decide whether migration is even the highest-value action.

Breach history, stated without embellishment. LastPass disclosed a security incident in August 2022 in which source code and technical information were taken, and disclosed in December 2022 that the attacker had used information from that incident to access a cloud storage service and obtain a backup of customer vault data. Encrypted fields remained encrypted; certain metadata including website URLs was not encrypted. 1Password disclosed in October 2023 that a threat actor accessed its Okta tenant, and stated that no user data or vault data was accessed. These are materially different events: one exposed customer vault blobs, one exposed an identity-provider instance with no confirmed customer data impact. Both companies publish security documentation and undergo third-party audits; 1Password publishes a detailed security design white paper that describes the two-secret key derivation in full, which is a meaningful transparency signal when an auditor asks how the scheme works.

One number that is often quoted and should not be trusted without context: aggregate average breach cost figures from industry reports describe the cost of a data breach across all causes at large organizations. They are not a per-credential figure and applying them to a password manager decision at a twenty-person company produces nonsense. Use them to argue that credential hygiene matters, not to compute an ROI.

Where each one wins, and what else is on the table

The honest framing is that this is a choice between two well-built products with different threat models, not a choice between a safe option and a dangerous one.

LastPass wins when recoverability is the dominant operational constraint. High-turnover teams, teams without dedicated IT support, teams where the admin is a sales operations person doing this as a fifth job. The admin-initiated master password reset is a genuine feature in that environment — it converts a hard lockout into a ten-minute fix. It also wins on the raw mechanics of getting a non-technical person onto the tool quickly, and its folder-based sharing model is easy to explain to people who will never read documentation.

1Password wins when the vendor itself must be outside the trust boundary. That includes regulated environments, teams handling customer data under contractual security obligations, and any organization whose security questionnaire asks whether a third party can access credentials. The answer "the Secret Key is never transmitted to us, therefore no" is a cleaner audit response than "we can disable that policy." It also wins on multi-vault architecture for teams that want genuine least-privilege separation between, say, finance credentials and marketing tool credentials.

The category that beats both for a large fraction of credentials is not a password manager at all. Any application supporting SAML or OIDC single sign-on should be behind the identity provider, not in a shared vault. Every credential moved to SSO is a credential that cannot be shared, leaked, or forgotten. The realistic target is that the password manager holds only what cannot be federated: vendor portals without SSO, legacy tools, shared service accounts, and API keys. A revenue team that starts with sixty shared credentials in a vault can often get to fifteen through SSO adoption alone, and fifteen credentials is a fundamentally more manageable privacy surface than sixty regardless of which product holds them.

Adjacent alternatives worth naming honestly: Bitwarden offers a comparable team product with an open-source codebase and a self-hosting option, which matters to organizations that want to audit the client or keep the vault on their own infrastructure. Keeper and Dashlane both ship team tiers with comparable feature sets. For infrastructure secrets specifically — API keys consumed by code, CI pipelines, deployment automation — a dedicated secrets manager is the right tool rather than either password manager, and both vendors offer developer-oriented products for injecting secrets into environments without checking them into configuration.

Migration between the two is mechanically straightforward and operationally the risky part. Both support CSV export and both support importing from the other. The problem is that the export file is every plaintext credential the organization owns sitting in a file on someone's laptop. If a migration is happening, the export should be created on an encrypted disk, imported immediately, and securely deleted, with the entire operation done by one person in one sitting. Sending the export over email or storing it in cloud sync during the transition is a worse privacy event than anything either product's architecture would have caused. Migration is also the correct moment to rotate anything sensitive and to drop credentials nobody has used in a year, since both products' export formats will faithfully carry forward every piece of accumulated junk otherwise.

Pitfalls that cause more damage than the architecture choice

Treating one shared folder as the whole system. The most common failure is a single "Team" folder containing everything, with every employee as a member. Whatever privacy properties the software has, this configuration means one compromised endpoint exposes the entire credential set. Separate by function and sensitivity: a vault for tools everyone genuinely needs, a vault for finance and billing, a vault for anything touching customer data, a vault for admin-level access to core systems. Membership should be the smallest set that can do the work.

Leaving admin recovery enabled without deciding to. On LastPass business tiers, the super admin master password reset policy is a configuration choice. Teams should make it deliberately, document the decision, and know that leaving it on means the admin account is functionally equivalent to every user's vault. If it stays on, that admin account needs hardware-key MFA and its own scrutiny — it is now the most valuable account in the organization.

Not auditing PBKDF2 iterations on legacy LastPass accounts. Accounts created years ago may still carry low iteration counts even though the current default is far higher. This is checkable in account settings and changeable. For any organization that was a LastPass customer before the 2022 disclosures, this check plus a full rotation of anything that was in a vault at that time is more valuable than any product comparison.

Losing the 1Password Secret Key with no organizational policy. The Emergency Kit is generated once and users close the tab. Decide where it lives — printed and in a safe, in a personal password manager, with a manager — and enforce it at onboarding. Also ensure the organization has more than one account with recovery permissions, because a single admin who loses their own credentials creates a problem no vendor can solve.

Skipping rotation on offboarding. Revoking vault access is necessary and insufficient. Any credential a departing person could view should be assumed retained. Maintain a mapping from each person's vault memberships to a rotation checklist so this is a fifteen-minute task rather than a project nobody starts. This is the single highest-value habit in shared credential management and it is independent of which product is in use.

Sharing credentials for systems that support individual accounts. Shared logins destroy attribution. When an action needs to be traced to a person — a deleted record, an exported customer list, a changed pricing rule — a shared account makes that impossible. Reserve shared credentials for systems that genuinely offer no per-user option, and push vendors on it during renewal, since seat-based pricing is usually the real reason teams share in the first place.

Assuming the browser extension is the whole risk surface. Both products ship extensions, and extensions are broadly the most exposed component of any password manager because they interact with hostile web content. Keep them updated, set a short auto-lock interval on shared or personal devices, and require the desktop or mobile app for anything in a high-sensitivity vault. Auto-lock defaults are generous; tighten them.

Enabling MFA on the vault but not on what it protects. A vault protected by a hardware key that stores an unprotected admin credential for a critical system has moved the risk, not removed it. MFA on the underlying systems is what limits damage when a credential leaks, and no password manager substitutes for it.

Related questions

Does either vendor's staff have any technical ability to read my vault?

Neither can read plaintext contents in normal operation; both encrypt client-side. The distinction is that LastPass business tiers offer an admin-initiated master password reset, which is an in-product recovery path. 1Password's Secret Key is never transmitted, so no server-side path exists regardless of policy.

If we already use LastPass, is migrating worth the disruption?

Often not immediately. Check your PBKDF2 iteration count, disable admin reset if policy allows, split monolithic shared folders, and rotate anything that predates the 2022 disclosures. Those four steps deliver most of the available risk reduction without a migration's plaintext-export exposure.

What actually happens to shared items when someone leaves?

Access is revoked from the admin console immediately, but the person still knows every credential they viewed. Revocation is not remediation. Rotate every credential in every vault they belonged to, and treat the vault membership list as your rotation checklist.

Should API keys and service credentials live in a password manager at all?

Generally no. Credentials consumed by code belong in a secrets manager or the platform's own secret store, where they can be injected at runtime and rotated programmatically. Both vendors offer developer tooling for this; a human-facing shared vault is the wrong container.

Does SSO reduce how much either product matters?

Substantially. Every application federated to your identity provider is one fewer shared secret. Teams that push SSO adoption hard often cut their shared credential count by half or more, which shrinks the privacy surface far more than switching vendors would.

FAQ

Can a LastPass administrator actually open my vault?

On business tiers with the super admin master password reset policy enabled, an administrator can reset a user's master password, which grants access to that account going forward. This is a documented recovery feature, not a flaw, but it means the admin account sits inside the trust boundary. Organizations that need the vendor and internal admins outside that boundary should either disable the policy or choose an architecture that has no such path.

Why can't 1Password just reset my password like LastPass does?

Because the Secret Key required for decryption is never sent to 1Password's servers. Without it, the server holds an encrypted blob it cannot open. Recovery in 1Password works by having an administrator re-key the account, which requires a functioning admin — it does not work by the vendor decrypting anything. That limitation is the security property, not a missing feature.

Was the 2022 LastPass incident a reason to leave the product?

It is a reason to audit rather than to panic. Encrypted fields stayed encrypted; the practical exposure depended on master password strength and the account's iteration count, and URL metadata was stored unencrypted at the time. Any organization that held vaults during that period should rotate the credentials that were in them regardless of what they do next.

How many separate vaults or shared folders should a small team run?

Three to six is a reasonable starting point for a team under thirty people: a general-access vault, a finance and billing vault, a customer-data-adjacent vault, and an admin-credentials vault with the tightest membership. More than that and people stop knowing where things go; fewer and blast radius grows past what is defensible.

Is the price difference between the two meaningful?

Rarely. At twenty-five seats the annual gap between roughly five-dollar and roughly nine-dollar seats is on the order of a thousand dollars — less than the cost of one emergency rotation event. Decide on threat model and operational fit, then treat price as a tiebreaker rather than a driver.

Does either product protect against a compromised employee laptop?

Only partially, and this is where auto-lock settings earn their keep. Malware on an unlocked device with the vault open can read whatever is on screen or in the clipboard. Short auto-lock intervals, requiring biometric or key re-auth for sensitive vaults, and keeping the highest-value credentials out of the browser extension's reach all reduce this. Endpoint security is a separate control neither product replaces.

Sources

• 1Password Security Design White Paper
• 1Password: About your Secret Key
• LastPass: Notice of Recent Security Incident
• LastPass: Security Incident Update and Recommended Actions
• LastPass: Change your password iterations
• 1Password: Security incident — October 2023
• NIST Special Publication 800-63B: Digital Identity Guidelines
• OWASP Password Storage Cheat Sheet
• CISA: Require Phishing-Resistant MFA
• 1Password Pricing

Related on PULSE

• [What are the privacy concerns with using AI chatbots like ChatGPT in the workplace?](/knowledge/sw0085)
• [Top 10 Password Managers for Enterprises in 2027](/knowledge/sw0012)
• [How does Slack's canvas feature compare to Microsoft Teams' wiki for documentation sharing?](/knowledge/sw0022)
• [What are the real differences in email sequencing between Outreach and SalesLoft for enterprise sales?](/knowledge/sw0111)
• [Can Notion replace both Trello and Confluence for a small marketing team, or are there gaps?](/knowledge/sw0110)