Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

This repo claims to document the vault format.

https://github.com/cfbao/lastpass-vault-parser/wiki/LastPass...



I created a temporary account to check whether anything of this has changed since 2018, but no, the format is still entirely the same. The fields have slightly different names, but that might be because of the way I got the vault file (looked at network responses during login). There are also four fields not listed in the above link ("Form Fields", "?", "??", and "???"), but those might be an artifact of the process of reading the file.

In particular all timestamps (creation, last modification, last access) are unencrypted, as are information about whether you want to auto-logon or auto-fill, whether the password was auto-generated and whether the password has been breached.


Field 6 "sharedfromaid": "aid of the sharer's Site/Secure Note" is unencrypted. The hackers will be able to infer relationships between Lastpass users.

Field 10: "genpw": "Is an auto-saved generated password". Good for deciding whether to brute force or not.

Yikes. I can't imagine why anyone would trust Lastpass after this.


Last password change date is a good way to figure out if a password is in a known breach dump, too.


Notes field appears to be encrypted!




Consider applying for YC's Summer 2026 batch! Applications are open till May 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: