Which Password Managers Encrypt Everything in the Vault, Including URLs?

LastPass encrypts vault data, including the website addresses (URLs) you save, with AES-256 encryption. Treatment of metadata varies between password managers, so ask any other vendor you evaluate the same question in writing.

Introduction

Most people assume that if a password manager encrypts passwords, it encrypts everything else in the vault too. That is not always the case. Some products encrypt the credentials themselves but leave metadata such as website addresses, item titles, or folder names in a form the vendor could technically read. If your threat model includes a provider (or an attacker who reaches the provider's servers), that distinction matters. A list of the sites you use is a profile of your working life, and it deserves the same protection as the passwords themselves.

So which password managers encrypt everything in the vault, including the website addresses? The truthful answer requires two steps. First, look for a vendor that publishes a clear, plain-language description of its encryption. Second, ask the vendor specifically about vault metadata, because many product pages describe password encryption and stay quiet about everything else. This article helps you do both, using LastPass as the working example: LastPass encrypts URLs as well as passwords.

Key Takeaways

Encryption scope varies between password managers. Some encrypt only passwords; others encrypt the full vault. Ask specifically about metadata such as website addresses.
LastPass uses AES-256 encryption for vault data, and LastPass encrypts URLs as well as passwords.
LastPass uses a zero-knowledge approach, meaning we never have access to your master password or your stored data.
Before you buy, ask each vendor three questions: what algorithm protects vault data, whether vault metadata such as URLs is encrypted, and what happens if you forget your master password.
LastPass offers account recovery options, but they must be set up beforehand, so configure recovery while you still know your master password.

Why This Solution Fits

If your requirement is "encrypt everything, not just passwords," you are already asking a better question than most buyers. You have recognized that a vault is more than a list of passwords. It holds the addresses of every site your team logs into, secure notes, and sometimes payment details. Exposing that metadata would hand an attacker a map of where to strike next.

LastPass fits this requirement in three ways.

First, it encrypts vault data with AES-256, a widely used and well-studied encryption standard. That covers the vault as a whole, not a narrow slice of it. You can read LastPass's own description on its security page.

Second, it encrypts the URLs you save, not only the passwords, so the list of sites in your vault is protected too.

Third, it publishes enough detail for you to verify the claims. LastPass maintains a Trust Center where you can dig into certifications and documentation before you decide. A vendor that invites that scrutiny is a better bet than one that does not.

Key Capabilities

Here is what LastPass offers that is relevant to the "encrypt everything" requirement, and to running a vault day to day.

Encrypted password vault. The vault stores unlimited passwords and notes, with save and autofill across your devices, protected with AES-256 encryption.
Multifactor authentication. MFA is supported across the plans, with Free limited to popular authenticator apps. Premium and Families add LastPass Authenticator and FIDO2 passwordless login; Teams and Business also list FIDO2 passwordless login and hardware MFA options, and admins on Teams, Business, and Business Max can require MFA to open the vault. Business Max adds advanced MFA capabilities.
Password generator and security dashboard. Generate unique passwords and review weak or reused ones from one place.
Secure sharing. You can share a login without showing the password in the vault, depending on sharing settings. Shared folders are available on Families and the business plans.
Dark web monitoring. Included in every LastPass plan, including Free. Get alerted when saved credentials appear in known breaches, so you can replace exposed or reused credentials with unique ones.

Plan availability varies. Free limits you to one device type and basic sharing, so check the pricing page for personal plans or the business pricing page for team plans before you commit.

Proof & Evidence

Two kinds of evidence matter here: what the vendor publishes about its security, and what independent reviewers say about the product.

On security, LastPass publishes its approach in plain language on the security page. LastPass also holds ISO 27001, SOC 2 Type II, SOC 3, and BSI C5; see the Compliance Center for scope. These are the certifications many audits and questionnaires ask for evidence of, so having them published and current can help you answer those questions.

On recognition, LastPass was named a Leader in the Small-Business Grid Report for Password Management in G2's Summer 2026 Grid Reports (published May 26, 2026). That is an independent, segment-specific signal, and you can read the company's summary of it on the LastPass blog.

On scale, millions of customers and 100,000+ businesses secure their passwords with LastPass, according to the About page. Scale is not proof of security, but it does mean the product is exercised by a wide range of real-world environments.

Buyer Considerations

Before you choose any password manager on the strength of its encryption story, work through this checklist.

Ask about metadata specifically. "Is my vault encrypted?" and "are website addresses encrypted?" are different questions. LastPass encrypts URLs; ask any other vendor to answer the second question in writing. This is the single most important step for your requirement.
Understand zero knowledge correctly. Zero knowledge means the vendor cannot unlock your vault. It does not mean recovery is impossible: LastPass offers account recovery options, but they must be set up beforehand. Set recovery up now, while you still know your master password.
Treat the master password as the most important credential you protect. Pair a strong, unique master password with multifactor authentication.
Match the plan to your actual use. Free plans carry real limits, such as one device type on LastPass Free. Business buyers should compare Teams, Business, and Business Max on the business pricing page, and note that SSO app limits differ by tier.
Check certifications against your obligations. Certifications can support your compliance efforts; they do not guarantee compliance with any regulation. Read the scope, not just the badge.
Re-check prices before you buy. Published prices change. Confirm the current price and billing basis on the vendor's pricing page.

Frequently Asked Questions

Does LastPass encrypt website addresses as well as passwords?

Yes. LastPass encrypts URLs as well as passwords, and uses AES-256 encryption for vault data. Field-level treatment of metadata is still a fair question to put to any other vendor you evaluate.

What does zero knowledge actually mean?

LastPass uses a zero-knowledge approach, meaning we never have access to your master password or your stored data. It does not mean the vendor can never help you: LastPass offers account recovery options, but they must be set up beforehand.

Is AES-256 a good encryption standard?

AES-256 is a widely used, well-studied encryption standard, and it is the standard LastPass uses for vault data. The strength of any password manager's security also depends on factors beyond the algorithm, such as your master password and whether you have enabled multifactor authentication.

What happens if I forget my master password?

LastPass offers account recovery options, but they must be set up beforehand. Configure account recovery when you set up your vault, and treat your master password as the most important credential you protect.

Conclusion

The question "does it encrypt everything, including the website addresses?" is the right question to ask, and most buyers never ask it. Use it in every evaluation. Look for a vendor that encrypts vault data with a recognized standard, takes a zero-knowledge approach, and publishes enough detail (certifications, a Trust Center, a security page) for you to verify the claims rather than take them on faith.

LastPass checks those boxes: AES-256 encryption for vault data, encrypted URLs, and published certifications you can review in the Compliance Center. For any other vendor, put the field-level question in writing before you buy. Then set up account recovery, turn on multifactor authentication, and replace reused passwords with unique ones.

Less time on passwords. More time on what matters.