# Security & Privacy Scorecard

## LastPass Password Manager

**Version:** 6.26.1 | **Analyzed:** 2026-02-17

## What This Means for You

Usage patterns and in-app behavior are tracked by Segment Analytics and Pendo, and shared with multiple third parties. Crash data flows to Firebase Crashlytics. Users have limited control over what is collected or how it is used.

## Recommendation: Acceptable

**Best For:** Password management with standard analytics tradeoffs

## Key Findings

**Data Security** - 8 findings (3 medium, 2 low, 3 info)

**Network Security** - 3 findings (3 info)

**Code Safety** - 0 findings

**Privacy** - 6 findings (3 high, 3 info)

## Privacy Concerns

### What Data is Collected

LastPass collects behavioral and usage data through Segment Analytics and Pendo, including how users navigate the app and which features are accessed. Firebase services collect crash reports, performance metrics, and session data linked to the device. Remote configuration and A/B testing services may adjust the app experience without notification.

### Third-Party Data Sharing

User data is shared with multiple third-party services:

- **Segment Analytics** - usage behavior and event tracking
- **Pendo** - in-app engagement and behavioral analytics
- **Firebase Crashlytics** - crash and error reporting
- **Firebase Messaging** - push notification delivery
- **Firebase Remote Config, A/B Testing** - feature configuration and experimentation
- **Firebase Performance, Sessions, Dynamic Links** - performance monitoring and linking services
- **Google Play Billing** - in-app purchase processing

## Understanding the Scores

| Category | Score |
|---|---|
| Security | 82/100 |
| Privacy | 62/100 |
| Data Security | 80/100 |
| Network Security | 92/100 |
| Code Safety | 88/100 |
| Data Collection | 58/100 |
| Data Sharing | 55/100 |
| User Control | 50/100 |

## Positive Security Features

- Strong network communication practices, reflected in a high Network Security score.
- Sound overall code construction, with no high-severity code safety issues identified.

## Areas for Improvement

- Behavioral data is collected and shared across multiple analytics platforms, with limited transparency about the full scope of that sharing.
- The app provides minimal in-app controls over what personal data is gathered, leaving most decisions outside the user's hands.
- Data sharing extends to behavioral profiling purposes beyond what most users would expect from a password management tool.

---

## About This Analysis

This scorecard is based on static analysis of the installed app package. Findings reflect the version analyzed and may not capture server-side behavior or recent updates.

### App Details

| Field | Value |
|---|---|
| App Name | LastPass Password Manager |
| Package ID | com.lastpass.lpandroid |
| Version | 6.26.1 (build 13800) |
| Platform | Android |
| Scan Date | 2026-02-17 |