LastPass to enforce 12-character minimum for master passwords from 2024

Starting January 2024, popular password manager LastPass is mandating a change to its password policy, requiring all customers to use a master password with a minimum of 12 characters. This is an effort to align with recommended best practices for password length and complexity.

Since 2018, LastPass has suggested a 12-character master password as its default setting. However, customers were previously allowed to bypass this recommendation and opt for a master password with fewer characters. This flexibility will no longer be available from January 2024.

This move complements the PBKDF2 iteration increases that LastPass implemented last year. By enforcing a 12-character minimum for master passwords, LastPass aims to aid customers in creating stronger and more resilient encryption keys. This will enhance the security of their LastPass vault data by providing robust access and encryption.