I'm an ancient Lastpass user too. But I don't think the unencrypted URL worries me. If any 3-letter agency want my history, they can just visit anyone in betwe

I'm an ancient Lastpass user too. But I don't think the unencrypted URL worries me. If any 3-letter agency want my history, they can just visit anyone in between me and the URL. My browser have my browsing history. My ISP have my browsing history. DNS resolvers have my browsing history. CDN have my browsing history. Proxy/VPN have my browsing history. (which some they claims they don't log at all) Basically browsing history is too accessible to anyone. If you are using network that doesn't managed by you, they have your browsing history too. (McD, Starbucks, etc) And last again like others+Lastpass have commented, your whole pile of encrypted data is encrypted together and sent to Lastpass. Did you try to read your Wireshark?