LastPass or Bitwarden: organise sharing and access recovery

Analysis of official documentation, with no testing on a paid account.

Differences that change choice

Start with the most difficult accounts to recover

List some fictitious accounts: main email, domain, billing tool and shared service. Define who needs access and who can restore access. A convenient safe does not replace a recovery procedure kept in an appropriate location.

LastPass Free distinguishes computers from mobile devices; installing the app everywhere does not mean you can use both categories free of charge in the same way. For Bitwarden, compare the individual plan and the organisation needed for sharing, rather than treating all vaults as equivalent.

Review history and available controls

LastPass has published information about the 2022 incident, including a backup of vaults. This background deserves careful reading in the risk assessment. It alone does not permit the affirmation of the current state of an account or the qualification without proof of a competing safe product in all circumstances.

For a team, check permissions, logs and offboarding procedures for the plan. Bitwarden offers several encrypted export formats: an account-restricted export is not as portable as a password-protected export. Choose the format to suit your recovery scenario.

Run an exercise without exposing real secrets

Use fictitious identifiers to test for addition, filling, sharing and removal of access. Then check the recovery on another device. Test exports must be protected and deleted when no longer necessary.

Choose the service your team understands the rules and can apply the procedures. Do not send passwords in a conversation or comparison document. The quality of deployment, authentication and recovery counts as much as the list of functions displayed.

Prepare a migration without confusing copy with usable backup

Suggested exercise with fictional data: create three login credentials, a note and a demonstration card without a valid number. After importing them into the intended manager, check the fields and login URLs, rather than only the number of items. An account imported twice can make a vault look complete while creating duplicates.

Accurate Bitwarden that cards, identities and passkeys are not included in the CSV export. Its encrypted "Account restricted" JSON depends on the original account; "Password protected" allows recovery in another Bitwarden account. This second format does not guarantee compatibility with another vendor. Individual exports also exclude data belonging to an organisation.

• Set the destination before choosing the format and check the types of supported items.
• Keep the means of recovery in an accessible location independently of the vault.
• For real transfer, protect temporary files; do not email them or drop them into an ordinary shared space.

The comparison LastPass Free and Premium confirms the desktop/mobile distinction. If you switch between them daily, calculate the cost of the appropriate offer before migrating. No real vault or user secret was handled for this article; the scenario defines the checks to make before committing.

Reviews to consult

• LastPass
• Bitwarden