[rrix2]

I want to believe that LastLass uses client side JS to decrypt based on your login credentials, not a plain text database.

[pas]

They do. It's not pretty, the whole thing is a mess from a lot of engineering aspects, but the basic security principles are solid.