One thing I found out (well, actually, just asked them) last year is this[0]. Basically, even though they are claiming not to send your password to the server,

One thing I found out (well, actually, just asked them) last year is this[0]. Basically, even though they are claiming not to send your password to the server, if you open their security check: > Once the master password is entered on the security check page, it decrypts your data (login and passwords) and send the length and character to our server for analysis then send you the result. So, practically, they're not sending your passwords per se, but they are sending the length and characters used? [0] https://lastpass.com/my.php?token=T1KUZTUH78P7&lpnorefresh=1 https://lastpass.com/my.php?token=T1KUZTUH78P7&lpnorefresh=1