LessPass

Last reviewed Sep 13, 2026 · 758 words

Change one password with LessPass and you must remember, forever, that this one site is on "counter 2". That sentence is the whole decision. LessPass is a stateless password manager: it derives each site's password from your master password, the site name, your login, and a few options, so there is no vault to store, sync, back up, or steal. The 6,000-star GPL project is elegant and works offline anywhere. It is also the wrong primary tool for most people, and the reasons are structural, not bugs.

The maths: one secret in, every password out

Given example.com, [email protected], your master password, and a profile (length 16, lowercase, uppercase, digits, symbols, counter 1), LessPass runs 100,000 rounds of PBKDF2-SHA256 and renders the result into a password. Feed the same inputs to any device, the browser extension, the Android app, the CLI, or a web page you have never visited before, and you get the same output. Nothing is uploaded and nothing is written to disk. That is why the RAM figure for the self-hosted piece is a token 128 MB: the server is optional and holds no secrets.

Rotation is where the model breaks

Sites leak. When one does, the only knob you have is the counter. Bump it to 2, generate a new password, and now you must recall that this site sits at counter 2 while 200 others sit at 1. Sites with password rules force profile deviations too: a bank that caps at 12 characters and forbids symbols needs its own settings, and an account created before you adopted LessPass needs its old password stored somewhere that is not LessPass. The project's answer is saved profiles, synced through the optional server, and at that point you are running a small vault of metadata anyway, just without the secrets in it. Change your master password and every derived password changes at once, which means re-setting hundreds of accounts in a single sitting. That is the trap nobody mentions until they hit it.

The self-hosted server syncs profiles, not passwords

The optional backend is a Django app plus a database, shipped as a Docker image, and it exists only so your list of site profiles (name, login, length, counter, character sets) follows you between devices. If you run it, treat it as low-value data: nothing in it can recover a password without your master secret. It has no equivalent of Bitwarden's organisations, sharing, TOTP storage, secure notes, passkeys, or emergency access, because a deterministic generator has no place to put any of those. There is also no home for the large share of a real vault that is not a password: recovery codes, licence keys, the Wi-Fi passphrase, the passport number.

Who this actually suits

Two groups get real value. Travellers and people who work on shared or locked-down computers, where an extension cannot be installed and a vault cannot be synced, but a web page and a memorised secret work anywhere. And people who want a fallback layer: a handful of critical accounts derived from a secret they can regenerate on a bare machine when the main vault is unreachable. Both groups keep a conventional manager as the primary. Vaultwarden is the obvious primary for a self-hoster, and the KeePassXC versus Vaultwarden comparison covers the file-based alternative. If you were eyeing LessPass as a way out of 1Password, that page shows what most people move to instead.

The threat model shifts, it does not shrink

Deterministic derivation moves the risk from "vault file stolen" to "master password guessed". With no vault, an attacker who learns your master secret and your email can compute every password offline with no rate limit and no server to notice. The master password becomes the only defence, so it has to be long: a 5-word passphrase at minimum. A vault-based manager with 2FA on the server login has a second layer that LessPass structurally cannot offer.

What I'd do

Run Vaultwarden as the household's primary manager, with TOTP and emergency access, and keep LessPass installed as a memorised-secret fallback for a handful of accounts that must be recoverable from any browser on earth. Do not make it the only manager: the first leaked site turns "nothing to back up" into "a counter I have to remember", and the password managers category has better answers for the everyday case.