Jake Lee published the move on 5 November 2023. He had spent about a year on LastPass after Chrome’s password manager. The 2022 breach happened before he joined. Trust did not recover.
The LastPass export is what finished it. He asked for a CSV backup before trying 1Password. A few passwords downloaded. The rest rendered in the browser. That is his sentence, not mine.
If you are looking at the same route, start with the LastPass → 1Password playbook. 1Password’s desktop importer is the path he used. LastPass still documents a generic CSV. Jake’s CSV was the warning.
Why he left
Vault data was stolen in the 2022 incident: vaults, notes, website URLs. The vector he cites is a keylogger on a DevOps engineer through a Plex exploit. His own vault, he says, was not in that haul. The communications still felt thin next to a Cloudflare incident post.
The apps had been janky for a year. Android login failed sometimes. The extension fought page fields. The website did not know if he was logged in. He had ignored that while he still trusted the company.
He wanted a cloud vault that worked on phone and desktop. He had used 1Password at work. Personal setup was new.
Twenty-five minutes, and a login you should not share
Twenty-five minutes passed between 1Password signup and permanently deleting LastPass. That is his clock.
He had put work into the vault. More than 1,000 passwords, then about 10 categories and about 400 items after cleanup. Losing folders was the fear. 1Password turned categories into tags. It also added a LastPass tag and a “LastPass Import [date]” tag. One tag lost an odd character. The rest looked right to him.
The transfer did not use a CSV. 1Password asked for his LastPass email, password, and 2FA code. He checked the flow three times. He still calls it disconcerting. Official docs still describe that desktop path: enter LastPass account details in the 1Password app. 1Password troubleshooting also has a paste-from-browser fallback when a CSV import is short. That fallback is close to the broken export he saw.
The trial was 14 days, full features, no card. The signup form asked for payment and made Skip obvious.
What arrived messy
Android login URIs came over as android://…. 1Password stored them as http://android://… and then flagged them for not being HTTPS.
Local IP logins were treated as URLs. A box on his LAN that only speaks HTTP still failed the HTTPS check.
LastPass had treated some sibling hostnames as one site. auth.uber.com and auth3.uber.com became two 1Password logins. He deleted about 40 of those duplicates. After a delete, the survivor sometimes stayed in the duplicate list anyway.
Checkout was in USD. $35.88 a year became $43.05 after 20% VAT, which he converted to £34.79. The session also expired while he was in a banking app looking up a card. He retyped the details.
Watchtower scored him 1029 and called it Fantastic. It also said 71 sites lacked 2FA that he believes already have it. The share-your-score link redirected to the homepage.
What I would copy
Do not trust a LastPass CSV that paints passwords into the page. If you need a file, treat that tab as a leak until you close it. Prefer the 1Password desktop importer, and know you are typing the LastPass secret into another vendor.
After import, search for android://, bare IPs, and sibling hostnames. Jake’s ~40 Uber-style dupes are the shape. Folders will be tags. Plan the tag list before you delete LastPass.
Keep LastPass readable until you can unlock a known login in 1Password on desktop and on Android. Jake deleted LastPass in 25 minutes. I would wait for that phone check.
The LastPass → 1Password playbook is the vault checklist. Use Jake’s post for the broken export and the 2FA prompt the happy-path docs underplay.