<p>Lastpass is for your personal (or team) passwords. I would not use Lastpass for storing credentials of service accounts. </p>

<p>Use HashiCorp's Vault or any other solution like Amazon KMS for infrastructure secrets.</p>

CC BY-SA 3.0
2017-08-11T09:24:13.423Z
Could you give an example of what you consider as a team password? Why not use Hashicorp's vault for personal accounts?
030
CC BY-SA 3.0
2017-08-11T09:25:27.043Z
Team or personal passwords are the ones to access to web services for example for log in the IDM/backup/monitoring solution as user.
On the other hand, if you need password for monitoring agent for example that should be saved in a vault, that is a service account
RuBiCK
CC BY-SA 3.0
2017-08-11T09:12:49.883Z
2017-08-11T14:16:51.047Z
2017-08-11T14:16:51.047Z
RuBiCK
<p>While this is a very old question, I’ll add a bit to it to anyone landing here.</p>
<p>I’m not familiar with Laspass specifically but assuming its internals are similar to others such as Bitwarden: server has no access to your secrets. They are decrypted client-side with your master password.<br />
For organization/shared secrets, a separate key is used to encrypt them and then stored as a personal secret of each user (encrypted by their master password).</p>
<p>In vault, every secret is encrypted by a single master key. That key is split into 3 partial keys which <em>should</em> be kept by different people.<br />
Not sure about the details but 2 out of those 3 keys are required to “unlock” vault for anyone to use.<br />
Secrets are then decrypted server side and delivered in plaintext to the clients. Policies and ACLs prevent accessing secrets that you shouldn’t but anyone able to create/modify policies can read any secret.</p>
<p>In short, IMO, vault is nice for “organization” secrets but I would never put my personal ones there.</p>

CC BY-SA 4.0
2022-08-02T16:20:59.717Z
2022-08-02T16:20:59.717Z
Filipe Pina
<p>I don't have enough rep to comment but I'm going to expand on what <a href="https://devops.stackexchange.com/users/3869/rubick">RuBiCK</a> said.</p>

<p>In the first case, if you have a password for JIRA that I'm going to use to log in to the website with and fiddle with some tasks, then this goes in LastPass. You can store it there and use the extension or the vault to help me remember a complex password. You can also use LastPass to send credentials to my team members and then they can use LastPass to log in with.</p>

<p>In the second case, if you have made a script which asks AWS for what instances you have running right now then that script is going to need some credentials to log in with. You could put them in LastPass if you wanted but every time you went to run the script it would mean you have to go and get them from LastPass, enter them into the script somehow and get my list of instances.</p>

<p>Vault however presents an API which your script can use to ask for credentials when it runs. The credentials are stored in a secure way by Vault and you can now store much more in there as well.</p>

<p>The above is also why Vault wouldn't be useful for most people to do what they want to do. You don't want to have to write something to talk to Vault and create browser extensions etc when LastPass is, kind of, affordable and good at what it does.</p>

<p>I hope this helps!</p>

CC BY-SA 4.0
2018-05-12T05:02:53.593Z
LastPass does have a CLI too, so I imagine getting passwords out of it could be automated. But I do agree, it's probably not the best tool for the job.
Tim Malone
CC BY-SA 3.0
2017-08-11T14:01:23.457Z
2017-08-11T14:01:23.457Z
Briansbum
<p>In <a href="https://www.vaultproject.io/intro/vs/index.html" rel="noreferrer">this section</a> Hashicorp compares <code>Vault</code> with other solutions. How does Hashicorp's Vault compare to <a href="https://www.lastpass.com/" rel="noreferrer">Lastpass</a>?</p>

<p><strong>Attempt to answer the question</strong></p>

<p>It is possible to login to LastPass from a web browser, create secrets and share these with other users. There does not seem to be an audit log. Imagine that a password of one of the users is retrieved one could retrieve a password from a database without knowing it.</p>

<hashicorp-vault>
How does Hashicorp's Vault compare to Lastpass?
030
# How does Hashicorp's Vault compare to Lastpass?

(Asked by: username_0 on 2017-08-11)

In [this section](https://www.vaultproject.io/intro/vs/index.html) Hashicorp compares `Vault` with other solutions. How does Hashicorp's Vault compare to [Lastpass](https://www.lastpass.com/)?

**Attempt to answer the question**

It is possible to login to LastPass from a web browser, create secrets and share these with other users. There does not seem to be an audit log. Imagine that a password of one of the users is retrieved one could retrieve a password from a database without knowing it.

**Tags:** hashicorp-vault


---

## 3 answers

### Answer by username_3 on 2017-08-11. Score: 6 | Accepted answer

I don't have enough rep to comment but I'm going to expand on what [username_1](https://devops.stackexchange.com/users/3869/rubick) said.

In the first case, if you have a password for JIRA that I'm going to use to log in to the website with and fiddle with some tasks, then this goes in LastPass. You can store it there and use the extension or the vault to help me remember a complex password. You can also use LastPass to send credentials to my team members and then they can use LastPass to log in with.

In the second case, if you have made a script which asks AWS for what instances you have running right now then that script is going to need some credentials to log in with. You could put them in LastPass if you wanted but every time you went to run the script it would mean you have to go and get them from LastPass, enter them into the script somehow and get my list of instances.

Vault however presents an API which your script can use to ask for credentials when it runs. The credentials are stored in a secure way by Vault and you can now store much more in there as well.

The above is also why Vault wouldn't be useful for most people to do what they want to do. You don't want to have to write something to talk to Vault and create browser extensions etc when LastPass is, kind of, affordable and good at what it does.

I hope this helps!

> **Comments:**
> **username_4**: LastPass does have a CLI too, so I imagine getting passwords out of it could be automated. But I do agree, it's probably not the best tool for the job.  

---

### Answer by username_1 on 2017-08-11. Score: 2

Lastpass is for your personal (or team) passwords. I would not use Lastpass for storing credentials of service accounts.

Use HashiCorp's Vault or any other solution like Amazon KMS for infrastructure secrets.

> **Comments:**
> **username_0**: Could you give an example of what you consider as a team password? Why not use Hashicorp's vault for personal accounts?  
> **username_1**: Team or personal passwords are the ones to access to web services for example for log in the IDM/backup/monitoring solution as user. On the other hand, if you need password for monitoring agent for example that should be saved in a vault, that is a service account  

---

### Answer by username_2 on 2022-08-02. Score: 0

While this is a very old question, I’ll add a bit to it to anyone landing here.

I’m not familiar with Laspass specifically but assuming its internals are similar to others such as Bitwarden: server has no access to your secrets. They are decrypted client-side with your master password.  
For organization/shared secrets, a separate key is used to encrypt them and then stored as a personal secret of each user (encrypted by their master password).

In vault, every secret is encrypted by a single master key. That key is split into 3 partial keys which *should* be kept by different people.  
Not sure about the details but 2 out of those 3 keys are required to “unlock” vault for anyone to use.  
Secrets are then decrypted server side and delivered in plaintext to the clients. Policies and ACLs prevent accessing secrets that you shouldn’t but anyone able to create/modify policies can read any secret.

In short, IMO, vault is nice for “organization” secrets but I would never put my personal ones there.


---

