LastPass has launched a consumer VPN bundled with its password manager under a new LastPass Plus subscription, initially available through a standalone Windows desktop app.
The VPN service launched today offers unlimited VPN traffic, support for up to 10 devices, and access to more than 100 virtual locations across over 85 countries. LastPass lists the combined Premium password manager and VPN package at $84 annually, equivalent to $7 per month.
The VPN is currently exclusive to LastPass Plus and is not available as a standalone subscription. The company is pitching the bundle to existing customers who already pay for a separate VPN, aiming to consolidate subscriptions and account management.
Founded in 2008 and headquartered in Boston, LastPass provides password and passkey management for consumers and businesses. The company says its services are used by millions of people and more than 100,000 organizations.
Separate app, same account
Customers access the VPN through a Windows application downloaded from the Microsoft Store, signing in with their existing LastPass account.
LastPass plans to add support for iOS, Android, and macOS, but has not provided release dates for those platforms.
The VPN encrypts users’ internet connections, with LastPass positioning it as a privacy tool for browsing at home, traveling, and using public Wi-Fi. The company also states that it does not log browsing activity passing through its VPN servers.
That no-logging commitment is a company claim, and we will be monitoring for the release of independent audit results on the VPN’s logging practices, as well as details about which VPN protocols the service uses.
LastPass says the VPN operates separately from the password vault, despite sharing an account and subscription, and leaves its zero-knowledge vault security model unchanged. Under that model, vault data is encrypted on users’ devices, and LastPass does not know their master passwords.
Security assurances
The expansion comes after LastPass's 2022 security incidents, in which attackers stole customer information and backups containing encrypted password vault data. Some vault fields, including website URLs, were unencrypted.
In the launch announcement, LastPass says it has spent the past three years rebuilding its security foundation through a multi-million-dollar investment. It cites ISO 27001 and SOC 2 certifications, a dedicated threat intelligence team, and an increase to 600,000 PBKDF2-SHA256 iterations for strengthening password-derived keys.
For customers considering Plus, the immediate limitation is platform support, as the VPN is currently available only on Windows. Users should review the service’s privacy terms and device compatibility before replacing an existing VPN subscription.
Leave a Reply