HackerReposA FIELD GUIDE TO OPEN SOURCE
ProSponsor the shelf♧ 0
← Back to top all-time
lastpass
lastpass-cli
C2014–2023
lastpass / lastpass-cli

lastpass-cli

LastPass command line interface tool

Command Line
Explore on GitHubRead Hacker News discussions
17Distinct people
21Mentions
0Explicit recommenders
2.9KGitHub stars
REPOSITORY AT A GLANCE

What to know before exploring

What it is

LastPass command line interface tool

GitHub

Where it is used

No documented product use was verified in the last source check.

What people are saying

No recommendation phrase was found in the indexed comments.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

No other repository is repeatedly linked in the same discussions.

This week on Hacker News

Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 12:54:37 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by year21 dated mentions

Observed mentions: 2014-10-22 20:32:45 UTC to 2023-01-25 18:16:15 UTC.

012342014-01-01 00:00:00 UTC to 2015-01-01 00:00:00 UTC (exclusive): 2 mentions; 1 submissions, 1 comments20142015-01-01 00:00:00 UTC to 2016-01-01 00:00:00 UTC (exclusive): 4 mentions; 0 submissions, 4 comments2016-01-01 00:00:00 UTC to 2017-01-01 00:00:00 UTC (exclusive): 2 mentions; 0 submissions, 2 comments2017-01-01 00:00:00 UTC to 2018-01-01 00:00:00 UTC (exclusive): 3 mentions; 0 submissions, 3 comments2018-01-01 00:00:00 UTC to 2019-01-01 00:00:00 UTC (exclusive): 4 mentions; 0 submissions, 4 comments20182019-01-01 00:00:00 UTC to 2020-01-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments2020-01-01 00:00:00 UTC to 2021-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2021-01-01 00:00:00 UTC to 2022-01-01 00:00:00 UTC (exclusive): 2 mentions; 0 submissions, 2 comments2022-01-01 00:00:00 UTC to 2023-01-01 00:00:00 UTC (exclusive): 2 mentions; 0 submissions, 2 comments2023-01-01 00:00:00 UTC to 2024-01-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments2023

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges
UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
PeriodStart (UTC)End (exclusive, UTC)MentionsSubmissionsComments
20142014-01-01 00:00:00 UTC2015-01-01 00:00:00 UTC211
20152015-01-01 00:00:00 UTC2016-01-01 00:00:00 UTC404
20162016-01-01 00:00:00 UTC2017-01-01 00:00:00 UTC202
20172017-01-01 00:00:00 UTC2018-01-01 00:00:00 UTC303
20182018-01-01 00:00:00 UTC2019-01-01 00:00:00 UTC404
20192019-01-01 00:00:00 UTC2020-01-01 00:00:00 UTC101
20202020-01-01 00:00:00 UTC2021-01-01 00:00:00 UTC000
20212021-01-01 00:00:00 UTC2022-01-01 00:00:00 UTC202
20222022-01-01 00:00:00 UTC2023-01-01 00:00:00 UTC202
20232023-01-01 00:00:00 UTC2024-01-01 00:00:00 UTC101

What Hacker News says

21 sources
ramses0·Jan 25, 2023
The other difficulty is it appears there is little-to-no support for API/automation: https://github.com/lastpass/lastpass-cli/issues/602 https://github.com/lastpass/lastpass-cli/issues/624 https://github.com/lastpass/lastpass-cli/issues/604 ...their CLI tool is de-facto deprecated (unsupported) and has several unreliability issues (ie: `lpass ls/userls ...` reports differing amounts of values depending on when a user was added to the folder or not). Basically `lpass ls ... | xargs -n1 ...` cannot be trusted, and you can only get an accurate list of passwords (or users) from the actual GUI. It makes automation, auditing, reporting, near impossible.
In LastPass breach gets worse
Fire-Dragon-DoL·Dec 29, 2022
To perform a LastPass migration, there are 4 phases involved: 1. Export passwords 2. Export attachments 3. Export password history 4. Export form fills (THIS IS NOT POSSIBLE FROM MY UNDERSTANDING, form fills also appear to not be encrypted?!) # 1. Export passwords In the extension, go to Account Options -> Advanced -> Clear Local Cache, this WILL LOG YOU OUT. Then, log-in and Account Options -> Advanced -> Refresh Sites, this will update your local cache. Finally, begin the export process and follow the instructions, make sure to USE THE EXTENSION (not the website): Account Options -> Advanced -> Export -> LastPass CSV file. When saving the CSV, do not copy-paste the content of the HTML manually, instead use the popup to download the file that LastPass provides. You might need to allow popups for LastPass extension the first time
Read the rest
you perform the export, then perform another one to get the popup. # 2. Export attachments Use lastpass-cli to export attachments. A script is provided in version 1.3.4: https://github.com/lastpass/lastpass-cli/blob/v1.3.4/contrib... Keep in mind that the script works also on version 1.3.3, which is the one provided pre-compiled by Ubuntu, you just have to copy-paste the script to your local machine. # 3. Export password history This is not possible natively, you can use my modified PR, but it's not trivial, bash knowledge, familiarity with C syntax is expected: https://github.com/lastpass/lastpass-cli/issues/245#issuecom... Keep in mind that YOU SHOULD AUDIT THE SOURCE CODE, I modified an existing PR and it's hacked together, I brought it only to where I needed it to, to get the password history out for my specific use-case. # 4. Export form fills Unsupported from my understanding # Conclusion Tag the items or mark them in your new password manager with something to remind you that they were breached on lastpass in august 2022 and remove such mark when you change their password.
In I Lost All Faith in LastPass
jlgaddis·Nov 19, 2017
This is very cool. After going from KeePassX to LastPass to 1Password, I'm back to using (mostly) KeePassX (and occasionally LastPass since $work has LastPass Enterprise). I would very much love to be able to host a private instance that everyone at $work can use and a private one that myself and my family (for example) can use. Also, AgileBits has 80 employees now!? Wow, I guess that subscription model really is paying off for them. :/ Off-topic: The author, "jcs", is also an OpenBSD developer and the guy behind "Pushover" [0] ("receive unlimited push notifications on all of your devices") which is an awesome service some HN'ers might be interested in. (No affiliation, just a very happy user.) Edit: Somewhat related... for the LastPass users who are terminal junkies, like me, you might like "lastpass-cli" [0]. I actually use it in place
Read the rest
of the LastPass browser extension, along with several shell aliases: alias lp='lpass' alias lpl='lpass login user@example.com' alias lpls='lpass ls' alias lppw='lpass show -G --password --clip' alias lpsh='lpass show -G' alias lpst='lpass status' [0]: https://github.com/lastpass/lastpass-cli
In Switching from 1Password to Bitwarden
simias·Jun 1, 2017
I'm talking about the authentication to the lastpass server, not the decryption itself. Lastpass won't serve you the encrypted blob if you don't authenticate with their servers. To do this it computes a different key (using a different derivation function, but using the same "master" password as the encryption key) that it uses to log into the lastpass server. This key cannot be used to decrypt the blob because of the different derivation function, but the client asks the server how many rounds of the kdf to use for a given user by posting its email to https://lastpass.com/iterations.php . As you can see it defaults to 5000, but the client will gladly accept any value. Therefore the server can tell the client to send a key derived from only one iteration, it which case this code is run: https://github.com/lastpass/lastpass-cli/blob/623b34
Read the rest
4e898958... In other words if an hostile party gets access to the lastpass server they can instruct your client to send your master password protected by two rounds of sha256. If you have a strong password (as you should) it's not an issue, but clearly you can't count on thousands of rounds of the KDF as you might think.
In OneLogin suffers breach–customer data said to be exposed, decrypted

Showing the 15 most recent of 21 sources. Enable JavaScript to search and browse every indexed mention.

MAKE YOURSELF AT HOME

A few shortcuts

/
Search the collection
?
Open this guide
Esc
Close dialogs and navigation

Your saved repositories and interests stay in this browser.