LastPass Plugin: Chrome and Safari Setup Guide

If you’ve searched for the LastPass plugin, you’re probably trying to get password autofill working in a new browser, or you’ve heard about the 2022 security incident and want the actual details instead of secondhand summaries. This guide covers both. It walks through installing the LastPass extension on Chrome and getting the LastPass plugin working on Safari, explains which browsers LastPass officially supports, breaks down free versus paid plans, and lays out exactly what LastPass itself has said about the breach — no more, no less. It also flags something LastPass doesn’t do: protect the tabs you have open. That’s a separate problem, and one worth solving alongside your password manager, not instead of it.

What Is the LastPass Plugin?

The LastPass plugin is a browser extension that stores your website logins in an encrypted vault and fills them in automatically when you sign in. You install it once per browser, create a master password, and LastPass takes over the job of remembering credentials for every site you save. It also supports passkeys, so newer sign-in methods land in the same vault as your passwords.

Here’s the quick version for anyone who wants the answer before the detail:

That table alone answers most of the “does it work on my browser” question, but the details matter, especially around Safari, where LastPass doesn’t ship a separate extension you grab from a store listing. It comes packaged with a Mac app instead, which trips up a lot of first-time installers.

One thing to keep in mind as you read the rest of this piece: LastPass, like any password manager, is scoped to your logins and form data. It doesn’t track your open browser windows, and it isn’t built to bring back a session after a crash or an accidental window close. That’s a different kind of data loss, and later on we’ll get into how a tool like BelayTab covers that gap without overlapping with what LastPass already does well.

How Do I Install the LastPass Chrome Extension?

You install the LastPass Chrome extension from the Chrome Web Store, then set up an account and master password inside the extension itself. LastPass’s own product page for Chrome walks through this as a short, linear flow, and it’s the same whether you’re setting up a personal vault for the first time or adding LastPass to a new machine.

A couple of practical notes worth adding. First, pin the extension icon to your toolbar once it’s installed. You’ll use it constantly, and it’s easy to lose track of otherwise if Chrome tucks it into the overflow menu. Second, Chrome has its own built-in password manager that will also try to offer saving prompts, and having two extensions racing to save the same login gets annoying fast.

Turn off Chrome’s own save prompt. If you’d rather LastPass handle saving without competing dialogs, open Chrome’s menu, go to Passwords and autofill → Google Password Manager → Settings, and turn off Offer to save passwords and passkeys. Chrome’s own support page on this setting covers the exact toggle.

If you’re new to installing browser extensions in general, our guide to the Chrome Web Store covers how to vet listings before you add anything to your browser, which is a habit worth building regardless of which password manager you pick.

How Do I Get the LastPass Plugin on Safari?

You get the LastPass plugin on Safari by downloading LastPass’s Mac app from the App Store, since the Safari extension isn’t a separate download. It’s bundled inside that app. This trips people up because most Safari extensions live in a self-contained App Store listing, and LastPass’s setup is structured a little differently.

LastPass’s own instructions are direct about this: download the LastPass Mac app, which “includes the LastPass browser extension for Safari,” and once it’s installed you can start adding passwords either in the Mac app itself or directly in the Safari browser extension.

1. Download the LastPass Mac app. Get it from the App Store rather than looking for a standalone Safari extension listing.
2. Install and open the app. This step also installs the bundled Safari extension.
3. Check that Safari has it enabled. Safari lists your installed extensions in its own settings, and you’ll want to confirm LastPass is turned on and, ideally, pinned so it’s visible in the toolbar.
4. Add your first passwords. You can do this either from the Mac app’s interface or right inside the Safari extension once it’s active — LastPass treats both as valid entry points into the same vault.

This same underlying vault syncs across whatever other browsers you use, so a password saved through the Safari extension shows up in your Chrome extension too, and vice versa. If you’re a Mac user weighing Safari against Chrome for daily browsing generally, our Safari extensions guide has more on what Safari’s extension model can and can’t do, and BelayTab’s own Safari page covers a few Safari-specific limits worth knowing about before you build a workflow around it.

Which Browsers Does the LastPass Extension Support?

LastPass officially supports Chrome, Firefox, Microsoft Edge, and Opera as standalone extensions, plus Safari through its bundled Mac app. LastPass’s download page lists each of these by name, with a specific note that its Edge extension is built for Chromium-based Edge, and that its Firefox extension “also works on other Mozilla-based browsers, such as SeaMonkey, LibreWolf, etc.”

Here’s how that breaks down browser by browser:

Brave is the notable gap here. LastPass’s official download page simply doesn’t name Brave as a supported browser, which doesn’t necessarily mean nothing works if you sideload something, but it does mean you shouldn’t expect LastPass’s own support team to treat Brave as a first-class target the way they do Chrome or Firefox. If Brave is your daily browser and password manager support matters to you, it’s worth checking each vendor’s own list rather than assuming compatibility. Our Brave extensions guide has more general context on how Brave’s Chromium base affects extension compatibility.

If you split your work across more than one browser (say, Chrome at your desk and Safari on a laptop) the upside of LastPass’s cross-browser support is that your vault follows you. The catch is that each browser still needs its own installation step, and it’s easy to set up LastPass everywhere except the one browser you use least, then get stuck the one time you need it there.

How Do I Save and Autofill Passwords With LastPass?

You save a password with LastPass by simply logging into a site as normal — the extension detects the sign-in and offers to save it, and from then on it autofills that login whenever you return. There’s no separate “add password manually” step required for everyday use, though your vault does let you edit or add entries directly if you want to.

Once LastPass has a credential saved, autofill happens the moment you land on that site’s sign-in page. Instead of typing your username and password, you click into the field, let LastPass suggest the saved login, and confirm. For sites that support passkeys, LastPass handles the same flow with your stored passkey instead of a password. That distinction matters more each year, since more sites are shifting toward passkeys as a primary sign-in option rather than a backup.

Two password managers, one prompt. If you don’t turn off Chrome’s built-in password save prompt, you’ll get two competing “save this password?” dialogs every time you sign in somewhere new — one from Chrome, one from LastPass. It’s not dangerous, just annoying, and it’s a common reason people think LastPass is “buggy” when it’s really just Chrome doing its own thing in parallel.

Managing what’s in your vault is a separate task from saving and autofilling. LastPass’s own product pages describe accessing your vault as the way to “manage and organize your credentials,” which covers editing saved logins, deleting old ones, and organizing entries into folders if you have a lot of them. If you’re comparing LastPass’s approach to how other managers structure this, our guides to the 1Password Chrome extension and Bitwarden Chrome extension walk through their save and autofill flows for a side-by-side sense of how the category generally works.

Is LastPass Free, and What Do the Paid Plans Add?

Yes, LastPass has a genuinely free plan, though it’s limited compared to the paid tiers. LastPass’s pricing page describes the free plan as “limited to 1 device type and basic password management features,” which in practice means you can use it on, say, just your phone or just your desktop browsers, but not across both device categories under the same free plan.

Beyond free, LastPass offers five paid tiers aimed at different use cases:

Every paid plan offers a free trial with no credit card required, which is worth using before you commit, especially if you’re migrating a household’s worth of saved logins from another manager. As for exact pricing, LastPass’s pricing page renders its dollar figures through client-side scripting based on your locale and currency rather than putting a fixed number in the page itself, so the honest answer is to check LastPass’s current pricing page directly rather than trust a number that might be stale by the time you read this.

Families plan math. LastPass’s Families plan includes six individual Premium accounts, not one shared login for the whole household. That’s the same general structure most password manager family plans use, since sharing one vault account among multiple people creates its own security headaches.

Whichever plan you land on, it’s worth thinking about what “device type” actually restricts you from doing on the free tier before assuming you need to upgrade. If you genuinely only ever touch your vault from one kind of device, free may cover you fine.

How Secure Is the LastPass Vault?

LastPass encrypts your vault with AES-256, combined with PBKDF2 hashing and SHA-256 salting, and it says master passwords are never stored or transmitted to LastPass at all. Its own security page puts it plainly: “Your data is kept secret, even from us.” Only you hold the Master Password that opens your encrypted vault.

That architecture (encryption keyed to something only you know) is standard practice across serious password managers, and it’s the reason a breach of LastPass’s own infrastructure doesn’t automatically mean your saved passwords are readable by an attacker. The encrypted fields stay encrypted unless someone also has your master password, which LastPass says it has never had access to.

Beyond the encryption model, LastPass names several third-party certifications on its security page: ISO 27001, SOC2 Type II, SOC3, BSI C5, and TRUSTe. It also states that it engages “trusted, world-class security organizations to conduct routine audits and testing of the LastPass service and infrastructure,” which is the kind of external validation worth checking for in any password manager, not just LastPass.

None of this makes a password manager immune to every kind of incident, which is exactly why the next section matters — LastPass has had a well-documented one, and it’s worth understanding in its own words rather than through summaries that tend to exaggerate or understate what happened. You can read LastPass’s full security page directly at lastpass.com/security if you want the unedited source.

What Happened in the LastPass 2022 Security Incident?

In short: an attacker compromised a single developer account in August 2022, used that access to later reach cloud backup storage, and in doing so copied encrypted customer vault backups along with some account metadata — but LastPass says master passwords themselves were never exposed, because LastPass never stores them. Here’s the timeline in LastPass’s own published words.

On August 25, 2022, LastPass notified customers that “an unauthorized party gained access to portions of the LastPass development environment through a single compromised developer account” and took “portions of source code and some proprietary LastPass technical information.” At that stage, LastPass said its “system design and controls prevented the threat actor from accessing any customer data.”

That changed with the December 22, 2022 update. LastPass disclosed that the same threat actor had “copied information from backup that contained basic customer account information and related metadata including company names, end-user names, billing addresses, email addresses, telephone numbers, and the IP addresses from which customers were accessing the LastPass service.” The same update went further, stating the attacker also obtained “a backup of customer vault data from the encrypted storage container which is stored in a proprietary binary format that contains both unencrypted data, such as website URLs, as well as fully-encrypted sensitive fields such as website usernames and passwords, secure notes, and form-filled data.” LastPass’s stated mitigation was that “these encrypted fields remain secured with 256-bit AES encryption and can only be decrypted with a unique encryption key derived from each user’s master password.”

Read this section as sourced, not summarized. Every quote above comes directly from LastPass’s own incident notices, linked below. If you’ve seen secondhand claims about the incident elsewhere that go further than this, check them against LastPass’s original posts before repeating them.

A March 1, 2023 update gave a final scope: the first incident involved access to “14 of 200 software repositories,” and the second used “DevOps Secrets” to reach cloud backup storage plus a “Backup of LastPass MFA/Federation Database” containing “copies of LastPass Authenticator seeds.” LastPass reiterated that master passwords “are never known to LastPass and are not stored or maintained by LastPass,” and said its investigation “concluded with no threat-actor activity since October 26, 2022.” You can read the full December 2022 notice directly at LastPass’s own incident update.

Does the LastPass Plugin Support Passkeys?

Yes, the LastPass plugin creates, stores, and manages passkeys alongside your regular passwords in the same encrypted vault. LastPass describes the feature simply: “Create, store, and manage passkeys with LastPass, making sign-ins faster, easier, and more secure across your favorite apps and websites.”

The flow works like this: when you visit a site that supports passkeys, LastPass prompts you to create one, and if you do, it saves that passkey in your vault the same way it would save a password. Signing back in later means choosing to use the saved passkey, and LastPass autofills it rather than asking you to type or tap anything else.

What makes this genuinely useful is the cross-platform reach. LastPass syncs passkeys across “Chrome, Firefox, Edge, Safari, and Opera” browsers, and across “Windows, Mac, Linux, and web vault” plus “Android, iOS, and watchOS.” That means a passkey you create on your work laptop in Chrome is available the next time you sign in from your phone, without needing to set it up twice — which is genuinely one of the more useful improvements password managers have made in the last few years, since passkey adoption without cross-device sync is a lot less convenient in practice.

Passkeys don’t replace your master password. Your LastPass master password still protects the vault that holds your passkeys. Losing or forgetting it isn’t something LastPass can bypass for you, since (as covered above) it never stores that password on its own systems.

If you’re deciding whether to lean into passkeys more broadly across your accounts, it’s worth checking which of your regularly used sites offer them yet, since support still varies a lot by service even as the underlying standard becomes more common.

Does the LastPass Plugin Protect Your Open Tabs Too?

No, and this is worth being clear about: LastPass manages your saved logins and passkeys, not your browser’s open tabs or windows. If Chrome crashes, your laptop restarts unexpectedly, or you accidentally close a window full of research tabs, LastPass has no role in getting that window back. It was never built to.

That’s not a flaw in LastPass. Password managers and tab managers solve different problems, and conflating them is how people end up assuming their vault also backs up their session, only to find out the hard way that it doesn’t. Chrome, Edge, and most other browsers offer some form of recently-closed-tabs history, but that history is thin, temporary, and gone entirely once you clear browsing data or reset the browser.

BelayTab exists for exactly this. It runs alongside your password manager rather than competing with it, quietly saving your open windows as named sessions you can restore later. It takes automatic snapshots of every open window every five minutes, and again the moment you close a window, keeps up to 20 versions of each saved session so restoring never overwrites your history, and gathers everything (snapshots, deleted sessions, your browser’s own recently closed windows, and export files) into one Recovery screen. It’s free, with no account required and no limits on sessions or tabs, and it works across Chrome, Edge, Brave, Opera, Vivaldi, Arc, Firefox, and Safari on Mac.

If you want your saved sessions available across more than one machine, BelayTab’s optional paid Sync adds cross-browser sync and 90 days of cloud version history, though the free version already covers the core job of not losing tabs on the machine you’re using. Pairing that with your existing LastPass vault means both halves of your browsing setup (what you sign into, and what you have open) are covered, instead of just one of them.