IT Pro Tutorials 
If you are reading this, you have probably already decided to leave LastPass and just want to know where to go. This guide is for IT teams making that move deliberately, not in a panic, and it focuses on what actually matters when you are responsible for other people’s credentials rather than just your own.
The short version is that there is no shortage of good replacements, and the right one depends on whether you want to self-host, how much you care about open source, and how much polish you are willing to pay for. We will go through the realistic options, what each is good at, and how to choose.
Short verdict:
- Bitwarden is the obvious default replacement: open source, cheap, audited, and feature-complete for teams.
- Passbolt and Psono are the picks if self-hosting and control are the whole point of leaving.
- Vaultwarden suits small teams that want a lightweight self-hosted vault.
- 1Password is the premium commercial alternative if you want the most polished experience and a stronger architectural answer to exactly the failure that hurt LastPass.
Why teams reassess LastPass
Be precise about this, because the reason matters for choosing a replacement.
In 2022, LastPass disclosed a serious breach. An attacker first accessed its development environment and stole source code, then used that foothold, combined with a separate compromise, to reach cloud storage. The result was that a backup of customer vault data was exfiltrated. That backup contained unencrypted metadata such as website URLs, company and user names, billing addresses, email addresses, phone numbers, and IP addresses, alongside the encrypted credential fields. Source: LastPass notice of security incident.
LastPass’s encryption meant the sensitive fields stayed protected by each user’s master password, and master passwords were never stored. That is true and important. But the operational reality is what drove teams away: those vaults are now offline in an attacker’s possession, where they can be attacked indefinitely. Accounts with weak master passwords or old, low iteration counts are the ones at risk, and the exposed URL metadata is a ready-made map for targeted phishing.
LastPass has since raised default key-derivation iterations and tightened its controls, and it remains a working product. For many IT teams, though, the calculus is simpler than a feature comparison: the trust was the product, and the trust took a hit. That is a legitimate reason to move, and once you have decided to, the only real question is where.
What a replacement has to do well
A consumer password manager and a team password manager are different products. Whatever you migrate to needs to clear the team bar:
- Real sharing structure. Collections, folders, and groups so the right people see the right credentials and nobody sees everything.
- Provisioning and offboarding. Ideally SSO and SCIM or directory sync, so adding and removing people is not a manual chore that gets skipped.
- Audit logs. Who accessed what, and when. You cannot run an incident response without this.
- Admin recovery. A sane way to regain access when an employee leaves abruptly.
- A credible security and transparency story. After LastPass, this is the whole reason you are moving. Open source, published audits, and a defensible encryption model should weigh heavily.
Keep this list next to you as you read the options. Every tool below clears the bar in a different way.
Bitwarden: the default replacement
For most teams leaving LastPass, Bitwarden is the path of least regret. It is open source, independently audited, and it covers the team feature set without the premium price tag.
The team tier is vendor-reported at $4 per user per month and enterprise at $6, with SSO via SAML and OIDC, SCIM provisioning, Directory Connector sync, event logs, and policies on the business plans. Source: Bitwarden business pricing. Its security posture is well documented: AES-256, zero-knowledge, PBKDF2 at 600,000 iterations by default with Argon2id available, and annual third-party audits. Source: Bitwarden security audits.
It also gives you an exit from the SaaS-trust question entirely if you want one, because you can self-host. Most teams will not need to, but the option is there. For a straight LastPass replacement that nobody will second-guess, this is it.
Passbolt and Psono: when self-hosting is the point
If part of why you are leaving LastPass is that you no longer want a third party holding your vault, the answer is a self-hosted, open-source tool, and the two strongest team-oriented options are Passbolt and Psono.
Passbolt is built on OpenPGP, encrypts each secret separately per authorized user, and is designed around granular team sharing. The Community Edition is free and open source; paid Pro tiers (vendor-reported from $4.9 per user per month) add SSO, LDAP, and account recovery. Source: Passbolt pricing.
Psono puts security architecture first, with client-side encryption before data reaches the server and open code for public audit, and makes all business features free for up to ten users. Source: Psono homepage.
These two are close competitors, and which one fits depends on your priorities. We broke down the decision in Passbolt vs Psono, and reviewed the more security-driven of the pair in our Psono review. The shared caveat is honest: self-hosting means you own the deployment, patching, backups, and recovery. If nobody on the team will own that, do not choose this path.
Vaultwarden: lightweight self-hosting
For a small team that wants to self-host without standing up real infrastructure, Vaultwarden is the pragmatic choice. It is an independent Rust server that speaks the Bitwarden client API, so you get the Bitwarden apps and extensions pointed at your own lightweight container, including organizations, sharing, and MFA. Source: Vaultwarden on GitHub.
The trade-off is the usual self-hosting one, sharpened by the project’s own honesty: it is not affiliated with Bitwarden, the maintainers disclaim liability for data loss, and backups are your job. For a capable small operator that is fine. We put it side by side with the official server in Bitwarden vs Vaultwarden if you are weighing the two.
1Password: the premium commercial benchmark
Not every team wants open source or self-hosting. Some just want the most polished product and a vendor relationship, and for them 1Password is the benchmark.
It is proprietary and cloud-only, with business pricing vendor-reported at $7.99 per user per month, and a strong enterprise feature set including SSO, SCIM, SIEM integration, and device-trust access controls. Source: 1Password business pricing. Its most relevant feature in this context is architectural: alongside your account password, 1Password requires a locally generated Secret Key to decrypt your vault, so stolen server-side data alone cannot be brute-forced. Source: 1Password security.
That is a direct answer to the exact failure mode that made the LastPass breach so damaging. You pay more per seat and you give up open source and self-hosting, but if your priority is the strongest commercial guarantee with the least friction, it earns the shortlist.
How to choose
Map your main reason for leaving to the right replacement:
- You want the safe, cheap, no-arguments default. Bitwarden hosted.
- You are leaving because you no longer trust SaaS vaults. Passbolt or Psono, self-hosted, with a named owner for operations.
- You want self-hosting but not a platform to run. Vaultwarden.
- You want the most polished product and the strongest commercial architecture. 1Password.
- You need enterprise SSO, SCIM, and compliance at the lowest cost. Bitwarden Enterprise.
On migration itself, the mechanics are usually the easy part. LastPass can export to a standard CSV, and every tool here can import it, so plan the cutover around the human side: a hard date, mandatory new master passwords or passphrases rather than reused ones, enforced MFA from day one, and a verification pass that everyone has actually moved before you revoke the old vaults. Treat the migration as a chance to reset hygiene, not just relocate it.
Final verdict
The good news is that leaving LastPass does not mean compromising. For most IT teams, Bitwarden is the straightforward replacement that nobody will question. If your reason for leaving is specifically about trusting a third party with your vault, the self-hosted open-source options, Passbolt and Psono, are built for exactly that, with Vaultwarden as the lightweight version. And if you want the most polished commercial product with the best architectural answer to offline vault theft, 1Password is the premium pick.
Choose based on why you are leaving, not on which name is loudest. For a fuller map of the team password-manager landscape, including how these stack up by team size and operating model, see our hub on the best password managers for IT teams and MSPs in 2026.
