Let me stop you right there.
Because you just read that headline—”Apple’s New Passwords App Is Making LastPass Obsolete”—and your brain did the thing. Finally. A native solution. Free. Secure. No more LastPass anxiety.
Here’s the truth the headlines aren’t screaming loud enough for you to hear:
Apple’s Passwords app is not making LastPass obsolete.
LastPass is making LastPass obsolete.
And Apple is just standing there, quietly, holding a better option, while LastPass spends 2026 fighting off fines, phishing campaigns, and the lingering stench of a 2022 breach that still hasn’t stopped leaking.
Let me walk you through what’s actually happening in February 2026. Because the story isn’t “Apple killed LastPass.”
The story is “LastPass spent four years self-destructing, and Apple finally handed everyone an exit door.”
🧠 First, The Apple App You Actually Need to Know
Apple’s Passwords app launched in 2024 with iOS 18 and macOS Sequoia .
It’s not “new.” But the 2025/2026 updates made it real:
| 2026 Capability | What It Actually Means | Why It Matters Now |
|---|---|---|
| Dedicated app, not buried in Settings | You can actually manage passwords without digging through menus | Discovery. Millions of iPhone users didn’t know Keychain existed. Now they do. |
| Shared groups | Teams and families can share credentials securely, no subscription required | Small businesses and households can finally ditch LastPass Family plans. |
| Windows client | iCloud Passwords extension for Chrome, Edge, Firefox | You’re no longer locked into Apple hardware. Your PC autofills what your iPhone saved. |
| Password history (macOS 26/iOS 26) | See previous versions of a password. Figure out why that “correct” password suddenly isn’t working . | Actually useful for troubleshooting. Not just a vault—a record. |
| 2FA code generation | Built-in authenticator. No more Google Authenticator or Authy . | One app for passwords and codes. This is the feature that actually kills dedicated authenticator apps. |
| Passkey support | Passwordless login for supported sites | Future-proofing. Apple’s implementation is cross-platform via iCloud. |
Here’s the part that actually matters for the “obsolete” question:
Apple’s Passwords app is free. Not freemium. Not “basic tier with upgrade nagging.” Free. Included with every Apple device you already own.
LastPass Premium is $3/month. Family plans are $4/month. Business plans are more .
For millions of users—especially individuals and families already deep in the Apple ecosystem—the math is not complicated.
Why pay $36/year for what you already get for $0?
💣 But Here’s Why LastPass Is Actually Collapsing
Apple didn’t kill LastPass. LastPass committed suicide in slow motion, and the autopsy is public.
Let me lay out the timeline of destruction, because the compounding effect is what actually matters.
🗓️ August 2022: The Breach That Keeps Giving
A hacker compromises a LastPass employee’s corporate laptop. Then another employee’s personal device via a known vulnerability in a third-party streaming service. Keylogger captures the master password. MFA bypassed with a trusted device cookie.
Result: Customer names, emails, phone numbers, physical addresses, and encrypted vaults of 1.6 million UK users exfiltrated .
The company’s defense: “Zero knowledge” encryption means customer passwords remain encrypted. The hacker can’t read them without the master password.
The reality: Encrypted vaults are now in the wild. Hackers have been cracking weak master passwords offline for years. As of December 2025, TRM Labs confirmed stolen vault backups are still being cracked, enabling cryptocurrency theft .
A 2022 breach with a 2025 body count. That’s not a security incident. That’s a liability annuity.
🗓️ December 2025: The £1.2 Million Fine
The UK Information Commissioner’s Office issues a penalty notice. The findings are damning :
“LastPass failed to implement sufficiently robust technical and security measures… allowing its employees, including senior employees with access to highly confidential corporate credentials, to access their Employee Business vaults via the internet from their unmanaged personal devices.”
The specific failures:
- Senior employees accessed corporate vaults from personal devices
- They linked personal and business LastPass accounts with a single master password
- A known vulnerability in a streaming service on one employee’s personal device became the entry point
The ICO’s statement is worth reading slowly:
“Password managers are a safe and effective tool… However, as is clear from this incident, businesses offering these services should ensure that system access and use is restricted to ensure risks of attack are significantly reduced.”
Translation: We still recommend password managers. Just maybe not this one.
🗓️ January 19, 2026: The Holiday Weekend Phishing Campaign
This is the one that broke trust irreparably.
Attackers launch a phishing campaign impersonating LastPass. Emails claim “urgent maintenance” and demand users back up their vaults within 24 hours .
The infrastructure:
- Phishing email → redirect on compromised AWS S3 → spoofed domain
mail-lastpass[.]com - Subject lines referencing “infrastructure updates,” “vault security,” “missed deadlines”
- Launched over US holiday weekend to exploit reduced security staffing
LastPass’s statement, quoted directly:
“LastPass will never ask for their master password or demand immediate action under a tight deadline.”
This is not a company in control. This is a company on its back foot, issuing damage control while attackers dance on its brand equity.
🧭 The Honest 2026 Landscape: Apple vs. The Alternatives
Let me give you the decision framework the sponsored listicles won’t.
✅ Apple Passwords App is the right choice if:
You’re an individual or family already in the Apple ecosystem.
iPhone, iPad, Mac, maybe a Windows PC at work with the iCloud extension. You don’t need advanced sharing controls. You don’t need audit logs. You just need your passwords to work everywhere, securely, without another subscription.
You’re tired of paying for password managers.
$36/year for LastPass Premium. $40/year for 1Password. $60/year for Dashlane. It adds up. Apple Passwords is included with devices you already bought.
You want 2FA codes in the same app as your passwords.
Apple’s implementation is clean and works across devices. No more opening Google Authenticator, squinting at a 6-digit code, rushing back to the login screen before it expires .
You’re a small Apple-only team with basic sharing needs.
The shared groups feature is genuinely useful for families and small teams. Wi-Fi passwords, shared accounts, household logins. No subscription. No per-seat pricing .
❌ Apple Passwords App is NOT the right choice if:
You need audit logs and compliance reporting.
If you’re subject to SOC2, HIPAA, GDPR, or any regulation requiring detailed access records, Apple Passwords is not for you. There is no way to see who accessed a shared password or when .
Your team uses a mix of Windows, Android, and iOS.
The Windows client exists. It works. It does not autofill passwords into native mobile apps on Android . A password saved in Chrome on Windows will not automatically fill into an app on an iPhone. The cross-platform experience is fragmented.
You need to store non-web credentials.
API keys, SSH keys, database credentials, software licenses. Apple Passwords doesn’t handle these well. Dedicated managers like 1Password and Keeper have purpose-built features for service accounts .
You’re concerned about the device passcode vulnerability.
This is the legitimate security criticism of Apple Passwords that no one is addressing.
Your entire password vault is protected by your device passcode. If someone knows your passcode—a partner, a child, a bad actor who watches you unlock your phone—they have access to every saved password .
You cannot configure Apple Passwords to require your Apple ID password instead. You cannot add a separate authentication layer.
Chrome’s password manager requires Google account authentication. 1Password requires your master password. Apple Passwords requires… whatever 4-digit code unlocks your phone.
“A person that knows the passcode to your device has much more information than what you may realize. If you do not trust them with your Passwords, I also would be concerned about some of the other data they have access to.
This is not a theoretical risk. This is a design choice Apple made, and you cannot override it.
🔐 The Dedicated Managers Still Win When:
| Scenario | Winner | Why |
|---|---|---|
| Cross-platform hybrid teams (Windows + iPhone, Mac + Android) | 1Password Business | Apple Passwords doesn’t autofill into Android apps; 1Password works everywhere . |
| Compliance/audit requirements | 1Password/Keeper | Audit logs, access revocation, detailed reporting. Apple Passwords has none of this . |
| Service accounts (API keys, SSH) | 1Password/Keeper | Apple Passwords is built for login credentials only . |
| Users who share devices or have concerns about passcode access | 1Password/Bitwarden/LastPass | Apple Passwords cannot be locked behind separate authentication . |
| Budget-zero individuals in Apple ecosystem | Apple Passwords | Free, integrated, good enough. |
Your Honest 10-Minute Decision
You don’t need to migrate tonight. You don’t need to panic.
Just do this:
Step 1: Open the Passwords app on your iPhone or Mac.
It’s there. It’s been there since 2024. You may have ignored it. Don’t ignore it now.
Step 2: Look at your password health.
See what’s weak, reused, or compromised. Apple doesn’t nag you about this as aggressively as LastPass or 1Password, but the data is there.
Step 3: Ask yourself the hard questions.
- Am I in the Apple ecosystem exclusively? Or do I bounce between Windows, Android, and Apple daily?
- Do I share passwords with a team? Do I need to know who accessed what and when?
- Do I have concerns about my device passcode? Does my partner know it? My kid? Could someone watch me type it?
Step 4: If you’re staying with Apple Passwords:
Enable 2FA codes inside the app. Delete your third-party authenticator apps. That’s a genuine quality-of-life win.
Step 5: If you’re leaving LastPass:
Export your vault. Import it into Apple Passwords, 1Password, or Bitwarden. The process is straightforward. There’s no lock-in. The encrypted vaults stolen in 2022 are still being cracked; you want your data out of that ecosystem .
The Quiet Takeaway
Here’s what I need you to understand.
Apple’s Passwords app is not “making LastPass obsolete.”
LastPass made LastPass obsolete.
- 2022: Breach. Customer data exfiltrated. Encrypted vaults stolen.
- 2025: Fined £1.2 million for the security failures that enabled the breach.
- 2026: Phishing campaign impersonating LastPass, exploiting the trust they’ve spent 15 years building.
- Also 2026: Confirmation that stolen vaults from 2022 are still being cracked, enabling cryptocurrency theft.
Apple didn’t need to build a killer app. They just needed to build a competent app, wait, and watch.
And that’s exactly what happened.
- Apple Passwords is not the most powerful password manager.
- It’s not the most secure (the device passcode vulnerability is real and acknowledged).
- It’s not the most cross-platform.
But it’s free. It’s integrated. It’s good enough for 80% of users.
And 80% of users are now realizing they’ve been paying $36/year for a company that’s spent four years demonstrating it cannot be trusted with their data.
That’s not a product victory.
That’s a trust bankruptcy.
Open the Passwords app. Look at your password health. Decide if you’re in the 80%.
Export your LastPass vault. It takes 2 minutes. Your future self will thank you.
If you need cross-platform power, try 1Password or Bitwarden. Both have free trials.
The headline asked if Apple’s Passwords app is making LastPass obsolete.
The answer is no.
LastPass made LastPass obsolete.
Apple just happened to be standing there when the body hit the floor.