CITT

    Scan results

    LastPass Password Manager

    Android

    LastPass Password Manager secures passwords and personal information in an encrypted vault. Autofills login credentials across apps and websites, stores payment info and secure notes, generates strong passwords, and syncs instantly across devices.

    CITT SCORE
    72
    out of 100
    TRUSTish

    Quick Verdict

    Best for: Password management with standard analytics tradeoffs

    What It Means For You

    Usage patterns and in-app behavior are tracked by Segment Analytics and Pendo, and shared with multiple third parties. Crash data flows to Firebase Crashlytics. Users have limited control over what is collected or how it is used.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (25)

    Data Security

    8 total
    3 Medium
    2 Low
    3 Info

    Network Security

    3 total
    3 Info

    Code Security

    4 total
    2 Low
    2 Info

    Privacy

    6 total
    3 High
    3 Info

    Third-Party Risk

    3 total
    2 High
    1 Low

    Permission Usage

    1 total
    1 Info

    Third-Party Services

    Segment Analytics, Pendo, Firebase Crashlytics, Firebase Messaging, Firebase Remote Config, Firebase Performance, Firebase Dynamic Links, Firebase Sessions, Firebase A/B Testing, OkHttp, Retrofit 2, Dagger 2, ORMLite, Google Gson, Auth0 JWT, Coil, Lottie, AndroidSVG, Google Play Billing

    Security Strengths

    • ✓Backup disabled (android:allowBackup=false) preventing vault exfiltration via ADB or cloud backup
    • ✓Biometric key uses hardware-backed Android Keystore with AES-256-GCM and user authentication required
    • ✓SecureStorage uses RSA-OAEP key wrapping via Android Keystore for all sensitive preferences
    • ✓SecureWebView disables file and content URI access across all WebView instances
    • ✓OAuth PKCE (S256) and state parameter validation correctly implemented to prevent token hijacking
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    sensitive data
    financial
    credentials
    enterprise
    ads

    Package

    com.lastpass.lpandroid

    Version

    6.26.1.13800 (versionName 6.26.1)

    Analysis Date

    Feb 17, 2026

    Classes Analyzed

    15,893

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Acceptable

    Key Findings

    Data Security - 8 findings (3 medium, 2 low, 3 info)

    Network Security - 3 findings (3 info)

    Code Safety - 0 findings

    Privacy - 6 findings (3 high, 3 info)

    Privacy Concerns

    What Data is Collected

    LastPass collects behavioral and usage data through Segment Analytics and Pendo, including how users navigate the app and which features are accessed. Firebase services collect crash reports, performance metrics, and session data linked to the device. Remote configuration and A/B testing services may adjust the app experience without notification.

    Third-Party Data Sharing

    User data is shared with multiple third-party services:

    • Segment Analytics - usage behavior and event tracking
    • Pendo - in-app engagement and behavioral analytics
    • Firebase Crashlytics - crash and error reporting
    • Firebase Messaging - push notification delivery
    • Firebase Remote Config, A/B Testing - feature configuration and experimentation
    • Firebase Performance, Sessions, Dynamic Links - performance monitoring and linking services
    • Google Play Billing - in-app purchase processing

    Understanding the Scores

    CategoryScore
    Security82/100
    Privacy62/100
    Data Security80/100
    Network Security92/100
    Code Safety88/100
    Data Collection58/100
    Data Sharing55/100
    User Control50/100

    Positive Security Features

    • Strong network communication practices, reflected in a high Network Security score.
    • Sound overall code construction, with no high-severity code safety issues identified.

    Areas for Improvement

    • Behavioral data is collected and shared across multiple analytics platforms, with limited transparency about the full scope of that sharing.
    • The app provides minimal in-app controls over what personal data is gathered, leaving most decisions outside the user's hands.
    • Data sharing extends to behavioral profiling purposes beyond what most users would expect from a password management tool.

    About This Analysis

    This scorecard is based on static analysis of the installed app package. Findings reflect the version analyzed and may not capture server-side behavior or recent updates.

    App Details

    FieldValue
    App NameLastPass Password Manager
    Package IDcom.lastpass.lpandroid
    Version6.26.1 (build 13800)
    PlatformAndroid
    Scan Date2026-02-17

    Right of Reply

    Developer not yet contacted