In August 2022, LastPass disclosed that an attacker had accessed its development environment and stolen source code and proprietary technical information. By December, the company confirmed the breach had gone further: the same attacker used data from that first incident to access a cloud storage backup containing customer vault data, some of it encrypted, some not. Wikipedia's summary of the incident lays out the full timeline, including a 2025 ICO penalty and a $24.5 million class action settlement tied to the breach.

Password managers ask for a lot of trust. You hand them everything from banking logins to social media credentials on the promise that they'll keep it all safe. When that promise breaks, the fallout, compromised accounts, stolen information, months of cleanup, falls entirely on the user, not the vendor.

If you're evaluating alternatives, here are three design choices that actually determine whether a password manager can survive a breach like this one.

1. Say No to Human-Readable Credentials

A secure password manager should not use human-readable credentials, usernames or master passwords, especially not to unlock the encryption keys that protect your data. If a master password is what stands between an attacker and your vault, it's less safe than it feels.

Complex passwords don't solve this. Hackers typically try common passwords and known phrases first, not brute-force combinations, so even a password that satisfies every complexity rule is still exposed to reuse and prior compromise. Usernames carry a version of the same problem: they're often guessable and reused across platforms, and once paired with weak password hygiene, that shared namespace makes an attacker's job easier, not harder.

If the human-readable credentials guarding your account are compromised, an attacker is one step closer to everything your password manager protects.

PassHub uses WWPass authentication to manage the flow of encryption keys, so human-readable credentials never enter the picture. Rather than adding friction to slow down password cracking, WWPass removes both weak links, usernames and passwords, entirely. Authentication runs through a self-managed WWPass Key app on a trusted device, and it's bilateral: both sides of the connection verify each other's identity, not just yours.

2. Choose Architecture Where Keys Are Never Exposed Outside a Secure Channel

Encryption is the baseline for protecting data online, but not all encryption is implemented equally. How a password manager handles its encryption keys, not whether it uses encryption at all, is what actually determines its security. If keys ever travel over an unencrypted channel or sit in storage unprotected, they can be intercepted, and once they are, the rest of the system's protections stop mattering.

Good architecture means that even if a key were somehow exposed, the damage stays contained. That's the bar to look for.

With PassHub, keys are never exposed in plaintext; they stay encrypted and are never transmitted over an unencrypted channel. Sensitive data is encrypted with a WWPass Key directly in your browser, so nothing meaningful is ever visible to the server. User data is then fragmented, with each fragment encrypted separately and distributed across different data centers. Reassembling that data requires your trusted authentication device, the WWPass Key, making unauthorized access to a single fragment worthless on its own.

3. Choose an Open-Source Option With Proven, Standard Encryption

A password manager's security claims should be reviewable, not just asserted. If the technology is genuinely sound, there's no reason to keep it secret, and reliance on hiding the source code is itself a warning sign.

If an attacker gained access to closed source code, whether through an insider, a mistake, or an undiscovered vulnerability, would the underlying data still hold up? That's hard to answer for a vendor whose code nobody outside the company has ever reviewed. Most password managers claim to use standard encryption, but without transparency, there's no way to verify it was implemented correctly.

PassHub's code base is reviewable and the product is self-hostable, so security experts can audit it and run their own vulnerability analysis. It uses only NIST-approved algorithms, AES-GCM 256-bit and RSA-OAEP, rather than untested or proprietary cryptography. You can review the code directly on GitHub.

FAQ

What actually happened in the LastPass breach?
An attacker compromised a developer's account in August 2022 and stole source code and technical documentation. That same data was later used, per LastPass's own December 2022 disclosure, to access a cloud backup containing customer vault data, some fields encrypted, some not.

Does using a master password make a password manager less secure?
Yes, structurally. A master password is a single human-readable credential that, if guessed, reused, or phished, unlocks everything else it protects. Architectures that remove the master password entirely, rather than just strengthening it, remove that single point of failure.

Is open-source software actually more secure than closed-source?
It's more verifiable, which is what security ultimately depends on. Closed-source vendors ask you to trust that their encryption is implemented correctly. Open-source code lets independent researchers confirm it, which is a meaningfully different guarantee.

What should I look for when switching password managers after a breach like LastPass's?
Three things: no human-readable credentials protecting your encryption keys, an architecture where keys are never exposed outside a secure channel even if part of the system is compromised, and a reviewable, open codebase using standard, NIST-approved encryption rather than proprietary algorithms nobody outside the company has vetted.

The Bottom Line

The LastPass breach wasn't a failure of encryption as a concept, it was a failure of the architecture around it: a master password and key-handling process that gave an attacker a path from a single compromised account to customer vault data. Evaluating a password manager on these three points, credential design, key handling, and code transparency, is how you avoid the same failure mode twice.