LastPass operates on a zero-knowledge security model, where all encryption and decryption occurs locally on the user's device, not on our servers. Your sensitive vault data is only transferred to LastPass once encrypted and never travels over the internet unencrypted. The same is true for our partnership with Enzoic, our data breach monitoring partner.
Your passwords are never transferred or visible to anyone (because they remain encrypted) – only a hashed version of your email addresses for your vault item entries is provided to Enzoic to monitor it against their database of compromised email addresses. We only share your hashed email addresses with Enzoic, and even then, they are only used to monitor for security breaches.