Bitwarden vs LastPass — and how to migrate

After the 2022 LastPass breach, "bitwarden vs lastpass" became one of the most-searched password manager comparisons. Here's the technical breakdown plus a step-by-step migration guide tested against current Bitwarden web vault (2026).

Quick comparison

Why people are leaving LastPass

The 2022 breach was the trigger for most migrations. The technical detail that hurt LastPass:

• Attacker stole encrypted vault backups from third-party cloud storage.
• The backup format included unencrypted URL fields alongside the encrypted credentials. Attackers got to see which sites users had accounts at — a targeting goldmine.
• Password hashes were Bcrypt with low iteration counts on legacy accounts (5,000 default before a 2018 increase, vs. industry consensus 600,000+).
• The disclosure timeline was slow — initial "no customer data accessed" turned into "encrypted vaults exfiltrated" three months later.

Compare to Bitwarden's design: vault items including URL fields are encrypted; PBKDF2 default is 600,000 iterations; the codebase is open and auditable; no public breach has occurred.

Free tier — biggest differentiator

LastPass's 2021 change forced free users to choose either mobile or desktop access — not both. This effectively required a $36/year upgrade for cross-device use, which is what most password manager users need.

Bitwarden's free tier explicitly preserves cross-device sync — desktop, browser, and one mobile device, all syncing the same vault. This is why "free password manager" search queries skew heavily toward Bitwarden in post-2022 traffic data.

Migration guide — LastPass to Bitwarden

Step 1: Export your LastPass vault

1. Sign into LastPass at lastpass.com.
2. Navigate to Advanced Options → Export (or via CLI: lpass export).
3. Confirm with master password.
4. Save the resulting .csv file (default name: lastpass_export.csv).

Caveat: the LastPass CSV export includes your passwords in plaintext. Treat the file as if it were a copy of every credential you own — encrypt or delete it after import. Don't email it to yourself, don't put it in cloud storage.

Step 2: Sign up / log into Bitwarden

1. Go to vault.bitwarden.com.
2. Click Create account: email, master password, master password hint.
3. The master password should be different from your LastPass master. Pick a strong passphrase.
4. Confirm via email link.

Step 3: Import the LastPass CSV

1. In the Bitwarden web vault, go to Tools → Import data.
2. From the dropdown, select LastPass (csv).
3. Click Choose File, select your lastpass_export.csv.
4. Click Import data.
5. Bitwarden parses the file and imports every login, secure note, and credit card.

For a typical vault (200-500 items), import takes ~5 seconds. For larger vaults (2000+ items), give it a minute.

Step 4: Verify the import

1. Browse a few login entries — confirm username, password, URL all match what you had in LastPass.
2. Test autofill on a few sites.
3. Check secure notes and credit card entries.

Step 5: Migrate TOTP / 2FA codes

The LastPass CSV export does not include TOTP secrets — they're stored separately in LastPass Authenticator app. Migration paths:

• If you used LastPass Authenticator: enable cloud backup in LastPass Authenticator, the encrypted backup syncs to a separate file you can extract via community tools. Or re-add TOTP secrets manually.
• If you used a separate authenticator (Authy, Google Authenticator, Aegis): migrate those to Bitwarden Premium's built-in TOTP, or keep using your existing authenticator alongside Bitwarden.

For high-value accounts, generating fresh TOTP secrets on the new system is most secure — visit each account's 2FA settings, disable old TOTP, re-enable with the new authenticator.

Step 6: Migrate file attachments

LastPass's secure notes can have file attachments. The CSV export does not include attachments. To migrate:

1. In LastPass, open each note with attachments, download the files manually.
2. In Bitwarden Premium, create the equivalent note, attach the same files.
3. For free Bitwarden tier (no attachment support), keep the files separately encrypted (e.g., 7-Zip with strong password, or VeraCrypt container).

Step 7: Install Bitwarden everywhere

• Chrome extension — replaces LastPass extension
• Windows desktop or Mac desktop — backup vault viewer
• iOS or Android — mobile autofill

Step 8: Disable LastPass extension

Two password managers fighting over autofill creates chaos. Disable (or uninstall) the LastPass extension after Bitwarden is configured. Test autofill on 3-4 sites to confirm Bitwarden works correctly before fully removing LastPass.

Step 9: Securely delete the CSV export

The lastpass_export.csv still exists in your Downloads folder, with all your passwords in plaintext. Delete it, then empty Trash. On macOS, use srm -f for secure overwrite. On Windows 11, normal delete + empty Recycle Bin is acceptable since modern SSDs use TRIM.

Step 10: Cancel LastPass subscription (if paid)

After confirming Bitwarden has all your data and works correctly, cancel any LastPass paid subscription. LogMeIn (LastPass's parent) will offer to retain the account on free tier — accept or fully delete depending on your preference.

What doesn't migrate cleanly

• Form fills: LastPass's form-fill profiles (addresses, payment methods stored as form fills) export as secure notes. Manual reformatting needed.
• Equivalent domains: LastPass's URL grouping (treating amazon.com and amazon.co.uk as same) doesn't directly translate. Bitwarden has its own URI matching settings per item.
• Sharing: LastPass shared folders don't migrate — recreate as Bitwarden Organisations / Collections.
• Emergency Access contacts: reconfigure on Bitwarden Premium.
• Credential history: LastPass tracks "old passwords" per item, not exported. If you need history, manually copy old passwords to Bitwarden secure note before deleting.

When NOT to migrate

Migration isn't always the right call:

• You have a workplace LastPass deployment: talk to IT first. Workplace SSO and shared folders complicate the migration.
• You use LastPass Authenticator features Bitwarden doesn't have: like push-based 2FA. Less likely now, but worth checking.
• Your LastPass investment is large: 1000+ items, complex shared folder structure, custom domain mappings. Migration is doable but takes a weekend.

Most personal users — under 500 items, no shared folders, no workplace integration — can complete the migration in 30 minutes.

More Bitwarden comparisons

LastPass is the post-breach migration story; if you're shopping for a destination beyond Bitwarden, compare against the rest of the field side-by-side first:

Bitwarden vs LastPass — frequently asked questions