LastPass now requires users to set a master password with a minimum of 12 characters, after enforcing the requirement for new accounts or resets in April 2023
LastPass notified customers today that they are now required to use complex master passwords with a minimum of 12 characters to increase their accounts' security.
Context & Ripple Effects
LastPass is extending to all users a password standard it had already applied to new accounts and password resets. The move follows a period in which the company disclosed that an attacker had obtained portions of its source code and technical information and later pursued company-wide security changes.
The rollout also has an account-access trade-off: some customers previously reported being locked out of their vaults after authenticator resets. Raising the master-password floor makes credential hygiene more consistent, but it puts added weight on clear migration and recovery processes.
First-order effects
- Existing LastPass customers who do not meet the new 12-character minimum must choose a longer, complex master password, bringing legacy accounts in line with the policy introduced for new accounts and resets.
- LastPass standardizes a core account-security control across its user base, making master-password requirements less dependent on when or how an account was created.
Second-order effects
- Support and recovery workflows become more consequential: users changing credentials may need help preserving vault access, especially given prior reports of authentication-reset lockouts.
- The change narrows the distinction between LastPass's legacy security posture and that of rivals pursuing alternatives to master-password-centric access, including 1Password's passkey support rollout.
Third-order effects
- Password managers are likely to face a durable design tension between stricter account-entry requirements and low-friction, dependable recovery; failure on either side can damage trust in the product's central promise.
- This is another step in the broader shift from treating password policy as a static setup choice to continuously hardening identity controls across installed user bases.
The trend: Consumer identity products are moving from grandfathered credential policies toward uniform, continuously updated security baselines, while passkeys increasingly challenge the master password as the long-term access mechanism.