Password Manager (LastPass)

LastPass Home

• LastPass makes your online life easier and safer by:
  
  • Helping you centrally and securely store personal and UVA passwords
  • Storing login information for frequently visited websites
  • Generating strong passwords for new accounts
  • Offering optional storage of credit card information for quick online transactions
• All sensitive data is encrypted locally on your device with a key that is not sent to or stored on LastPass servers.
• LastPass is available to:
  
  • UVA Academic division faculty, staff, and students
  • UVA Foundation employees with active @virginia.edu email accounts
  • UVA alumni with active @virginia.edu email accounts
• UVA Premium LastPass accounts are not available to UVA Health (209) staff at this time. Contact HIT Security if you have questions about LastPass usage for UVA Health.

Before creating a LastPass account, review these best practices to ensure your account stays secure.

• Your computer and other devices should have strong administrator passwords before accessing LastPass on them. If your device is lost or stolen, an administrator password could help protect against your device and accounts being compromised.
• Use multifactor authentication for logging into your LastPass account. This adds an extra layer of security to your LastPass master password and, as a result, all your accounts in your vault. Your LastPass account is not a NetBadge-protected resource and, therefore, will not be protected by UVA 2-Step Login (Duo) unless you follow the process to set this up. Learn how to install 2-Step Login (Duo) for LastPass.
• Remember your master password and keep it safe. Neither LastPass nor UVA ITS will be able to reset your password if you forget it.
• Set up a "timeout" feature to automatically log out of your account if it is inactive for a specific amount of time. To change the amount of time it takes to "timeout," click on the browser extension icon, go to "Preferences," and then "Security."
• Only share passwords in accordance with UVA's Acceptable Use Policy (IRM-002). Passwords for UVA resources should only be shared if the resources require authorized users to share one account and set of credentials. The credential sharing feature of LastPass must not be used to avoid the use of individual accounts and credentials.
• For accounts that require users to share one set of credentials, one authorized user at the University should be the account administrator, and that person is responsible for providing and revoking user access. This exception to UVA's Acceptable Use Policy (IRM-002) is only granted for those cases in which individual UVA accounts cannot be provisioned by the resource and LastPass is used.
• Do not use the LastPass sharing feature to obtain or attempt to obtain unauthorized access to IT resources, to circumvent or attempt to circumvent security controls on IT resources, or to allow anyone else to gain unauthorized access to an IT resource.
• Be compliant with UVA policy, standards, and procedures. If you are not sure if your use of LastPass is compliant, please email University Information Security at IT-Policy@virginia.edu.