How LastPass and Junify differ for shared accounts at work

LastPass is a password manager: employees keep logins in a vault, hand them out through shared folders and have them filled in. Junify lets people sign in to your company’s shared accounts without being shown the password. LastPass suits storing each employee’s own passwords. Junify suits giving several people the same account to work in.

What LastPass Business does

LastPass sells business plans called Teams, Business and Business Max, and the features differ by plan.

Shared folders are the main way to share. Each person in a folder gets their own permission level. Read Only stops them from adding, removing or changing items. Hide Passwords stops them from seeing a password while still letting them autofill it. Administrator lets them manage the folder and its members. LastPass recommends keeping both Read Only and Hide Passwords turned on.

The user activity report lists events with the person and time. They include signing in to the vault, changing an item, filling a form, exporting data and printing it. Admins can turn on policies that add each item’s URL, username and name to the report.

LastPass also offers:

• One-time codes for two-step verification, made in the vault and filled in where the site allows it. You can see the codes in the browser extension and the iOS and Android apps.
• In Business, sign-in to LastPass through an identity provider, such as Microsoft Entra ID, Okta or Google Workspace. Business also includes up to three single sign-on apps, where LastPass itself signs people in to other tools.
• In Business Max, SaaS Monitoring, which lists the apps and websites people sign in to through the browser extension. With SaaS Protect, admins can block an app or show a warning when someone tries to open it.

What LastPass leaves open for shared accounts

A hidden password can still be obtained

LastPass says a hidden password can still be obtained, and that this holds whether or not you let the recipient view it. So it recommends sharing a site-specific password you’re comfortable with the recipient obtaining. Does hiding a shared password keep it secret? compares how the main products handle this.

Removing someone means changing shared passwords

LastPass says that when an employee’s account is terminated, it “strongly recommends changing all shared passwords in the company.” Its reason: a person who created a password in their vault, or could see one shared with them, may have saved a copy outside LastPass. Until the password changes, they can still sign in to that tool on their own, outside the company. The full steps are in What to stop and what to change when someone leaves a shared password manager.

Autofill records come from the person’s app

LastPass’s servers don’t record three of the activity report’s events: filling a form, signing in with autofill and opening a secure note. The person’s own LastPass app reports them instead. LastPass doesn’t count the app as a trusted source, so a report can be changed or lost on the way. It says to use these events only for troubleshooting: “Do not rely on them as audit evidence or to meet compliance requirements.”

Records and removal stop at LastPass

Terminating someone ends their use of LastPass. We found no way, in LastPass’s help pages, to record what someone does on the service after autofill. We also found no way there to block downloads on that service or close a site the person already has open on their computer. SaaS Protect applies when someone tries to open an app, and we didn’t find whether it affects a site that’s already open.

Everyone needs a LastPass account

You can’t share a folder with someone who has no LastPass account; they must create one first. An admin can add users who don’t have an email address yet under a placeholder address. To start using LastPass, though, they still need an invitation sent to a working address.

Using LastPass and Junify together

The overlap is in shared folders. Logins that belong to one person stay in LastPass, along with its single sign-on apps and SaaS Monitoring if you use them. The shared-folder items that staff use for work move to Junify.

When you move an account, change its password on the service first. Store the new password only in Junify, and delete the item from the shared folder. If you skip the change, everyone who could use that folder still signs in with the old password.

Which one fits

The LastPass column draws on LastPass’s support articles and nothing else, so “not found” reports what we didn’t see there rather than what LastPass can’t do. The FTC’s comparative advertising statement, 16 CFR 14.15(c), supports brand comparisons when the basis is clearly identified, which is why we name ours.

LastPass alone is the better choice when everyone who shares a folder can have a LastPass account. You also need to be able to follow its advice to change shared passwords after each termination. It’s also the one to pick when you want single sign-on apps, SaaS Monitoring and the password vault in one product, or people need passwords on their phones.

Junify fits shared-folder logins you’d otherwise share with Hide Passwords on. It also fits when staff turn over often enough that changing every shared password is a burden. People with no LastPass account or company email can use it too, and you can block downloads and flag uploads while people use the service.