Sovereign alternative to LastPass
LastPass popularized the password vault in the browser, but it is a proprietary service from a US publisher, marked by security incidents in 2022. Vaultwarden covers the same use cases in open source, Bitwarden-compatible, and Bunker hosts it in Europe on your dedicated instance.
LastPass is still a widely used password manager. It is a proprietary service, published in the US, whose vault is hosted in the US by default, with an optional European region on business plans. As the publisher is American, it falls under the CLOUD Act. In 2022, the vendor acknowledged intrusions that allowed the exfiltration of encrypted vaults, a reminder of how much it matters to know where your secrets live and who can reach them.
Vaultwarden answers the same need in free software. It is a lightweight reimplementation of the Bitwarden server, compatible with its official apps. Bunker hosts it in Europe on an instance reserved for you, with client-side encryption. Your secrets stay on the continent, on sovereign infrastructure, and the instance re-internalizes whenever you decide.
Point-by-point comparison
| Criterion | Vaultwarden (Bunker) | LastPass |
|---|---|---|
| Model | Open source (GPLv3), auditable | Proprietary, closed code |
| Vault hosting | Your instance, in Europe | US by default, EU region on business plans |
| CLOUD Act exposure | No subcontractor under US jurisdiction | Subject (US publisher) |
| Encryption | End-to-end, client-side (AES-256) | End-to-end |
| Client compatibility | Official Bitwarden apps | LastPass clients only |
| Security track record | Isolated instance, under your control | Intrusions and vault theft in 2022 |
| Two-factor authentication | TOTP, WebAuthn | TOTP, hardware keys |
| Import from LastPass | Yes (CSV / JSON) | N/A |
| On-premise reversibility | Yes, re-internalizable | Export possible, no self-hosting |
Your secrets on an infrastructure you do not control
With LastPass, your vault is stored by the vendor, in the US by default. A European region exists on business plans, but the publisher stays American and so falls under the CLOUD Act wherever the servers sit. You trust closed software. The 2022 incidents, during which backups of encrypted vaults were stolen, showed the question is not merely theoretical: what leaves your walls can slip out of your control.
Vaultwarden keeps your secrets on an instance reserved for you in Europe. Encryption happens client-side, the code is open, and you can bring everything back onto your own servers. The exposure surface shrinks to your single instance, not a global provider’s database.
Bitwarden compatibility, hosted in Europe
Vaultwarden speaks the Bitwarden protocol. Your teams use the Bitwarden browser extensions, mobile apps and desktop clients, then point them at your instance. Generator, autofill, sharing by organization and two-factor authentication are all there.
The difference lies in hosting and model. The vault lives in Europe, on sovereign infrastructure, and the service is billed at a flat rate for your instance rather than through consumer subscription tiers.
When LastPass remains an option
To be fair: LastPass stays easy to adopt for an individual or a small team who want a vault in the browser with nothing to administer, and it offers a free entry tier. For a use case with no sovereignty stake or sensitive data, it gets by.
Managed Vaultwarden becomes the right call as soon as you want open software, hosting in Europe with no subcontractor under US jurisdiction, an isolated instance and the freedom to bring everything back. You import your LastPass export to migrate without starting over.
Frequently asked questions
Is Vaultwarden safer than LastPass after the 2022 incidents?
Encryption happens client-side with AES-256 in both cases. The difference lies in the exposure surface: with managed Vaultwarden, your vault lives on an isolated instance in Europe, not in the shared database of a global provider targeted by attacks. Because the code is open source, security is verifiable, and you keep control over hosting.
Can I migrate my LastPass vault to Vaultwarden?
Yes. You export your LastPass vault as CSV, then import it from a Bitwarden client connected to your instance. Logins, notes and folders come across. Delete the export file once the migration is done, since it holds your passwords in plain text.
How is managed Vaultwarden more sovereign than LastPass?
Your vault is hosted in Europe, on a dedicated instance, with no subprocessor under US jurisdiction. The software is open, you decide on retention, and you can bring everything back onto your own infrastructure. LastPass stays a proprietary service hosted in the US.
Your passwords, encrypted and hosted in Europe
Dedicated Vaultwarden instance, Bitwarden-compatible, client-side encryption, no subcontractor under US jurisdiction.
Other comparisons
Bunker is not affiliated with LastPass. "LastPass" is a trademark of its publisher, referenced here for comparison to designate the competing service.