LastPass is hired to keep a company's shared logins in one encrypted place and let the right people use them. The job is well understood, but moving it means handling every secret the company has. Below: what to settle first, the one open-source option we verified, and a staged way to move that keeps the old vault as a fallback.
A vault becomes the place where the company's keys live, so every person, shared folder and browser extension depends on it. Nobody wants to be the person who moves it, because the cost of a mistake is a locked-out finance team on a close day.
Seats also accumulate. Leavers keep a seat nobody removes, contractors are added for a project and never taken off, and an admin plan is bought for a feature one person used once. The line on the books looks small, which is another reason it never gets reviewed.
Only alternatives we have checked. An open-source project is listed with the license its repository reports, on the date shown; one whose license could not be read as a single standard id is not offered as open source. Read the license guide before running any of them.
| Alternative | Kind | License | Read from |
|---|---|---|---|
| Vaultwarden | Open source | AGPL-3.0 | Vaultwarden repositoryChecked Oct 25, 2026 |
Each feature below is what the product's own page or README says, linked to where we read it on the date shown. Pros and cons are limited to what those pages state and to what the path itself changes. We do not rank products on quality.
Moving a password vault is a security project that happens to involve software. The risk is not the cost of the tool. It is the week when credentials exist in two places, in an export file, on someone's laptop. We rate this job moderate for that reason, and you should not treat it as a routine switch.
Vaultwarden, an open-source server, is the alternative we have verified. Its repository lists the AGPL-3.0 license on the checked date. It carries obligations you should read, and AGPL's network-use terms apply if you modify it and let others use it over a network. Running it also makes you the operator: updates, backups and access to the server are yours to look after. A hosted commercial vault is a legitimate choice if nobody in the company wants that job. See the 1Password page for one.
Samples are made up and are not LastPass's prices. Type in the figures from your own invoice or order form.
The honest yearly cost of running open-source software yourself, set against the bill it replaces, with the seat count where it stops paying.
Paid seats against seats in use: what the idle ones cost a year, and what you save by right-sizing at renewal.
Arithmetic only, not tax, accounting or legal advice. Check the figures against your own order form.
Do this slowly and in this order. The old vault stays available the whole time, and nothing is deleted until the new one has been used for real work.
Export a list of seats, shared folders and their owners. Count the entries in each folder so you can compare later, and mark which credentials are shared by many people.
Name one administrator and one backup. They invite people, remove leavers and handle lockouts. If nobody can take that on, choose a hosted product instead of running a server.
Stand up the replacement with two or three people. Import a small test set, open each entry the way people really use it, and check that autofill, sharing and recovery work.
Export from a trusted machine, never over email or chat, import to the new vault, and delete the export file and any copies as soon as the import is checked. Compare entry counts per folder on both sides.
Rotate credentials that were shared across many people or that former staff could have seen: banking portals, domain registrars, cloud consoles, admin accounts. Do the most sensitive first.
Move teams in groups. Keep the old vault read-only, with no new entries, so a missed login can still be found. Ask each team to confirm they can reach what they need.
After a full month of normal use, export once more if you need a record, store it under the same rules, then end the plan inside the contract's notice window.
Run the vendor report for QuickBooks Online or Xero, then open the free audit.
General information, not legal advice. See cancelling without penalties. Last reviewed Oct 25, 2026. Product names belong to their owners and are used only to identify them.
Send us the export and see which lines are worth a second look. A connected version is planned. LastPass is one of the lines worth a look.
Worked example. Type over it.
Result
| Self-hosting, per year | Amount |
|---|---|
| Hosting, backups, tooling | 720.00 |
| Admin and restore-test time | 2,640.00 |
| Total | 3,360.00 |
| One-off set-up (not in the yearly total) | 1,200.00 |
The saving holds only if the time is real. Price the admin hours at what that person's time costs the company, not at zero.
Worked example. Type over it.
Result
“In use” is your call: last sign-in in the past 30 or 90 days from the vendor's admin report. A seat for someone on leave is not idle.