How to Use LessPass: The Beginner's Guide (the Stateless Lesson, the Master Password Rule, and the CLI Arc)

CodexFuse Team · 2026-11-07T03:13:22.583Z · 22 min read min read

How Do I Use LessPass?

Learning how to use LessPass takes seven moves: pick one master password, type the site and login, generate the password, paste it into the site, adjust the profile when a site rejects the default, bump the counter when a password leaks, and keep the recipe the same everywhere. LessPass is a stateless password manager, which means it computes every password from the site, the login, and your master password instead of storing anything in a vault. This lesspass tutorial follows the official documentation and the project repository, with every fact checked as of November 2026.

There is no vault to lose, no sync to set up, and no account to create before your first password, because the same inputs always produce the same output. CodexFuse offers no LessPass tool, so this guide teaches the real project on your own machine, not a web version of it. The stateless idea is the whole lesson, and the rest of this guide is practice.

The VPS hosting guide covers the Linux server where the optional self-hosted database runs, and it is the pillar this page belongs to. This guide opens the stateless-password lane in the dev-tools password-management cluster, and it draws the line once against the vault managers: Bitwarden keeps a cloud vault, KeePassXC keeps a local vault file, and gopass keeps a git-backed encrypted store, while LessPass keeps nothing at all.

1. Pick one strong master password and memorize it.
2. Open lesspass.com and type the site and login.
3. Generate the password and paste it into the site.
4. Adjust the length and character rules when a site rejects the default.
5. Bump the counter when a password leaks or expires.
6. Install the CLI when you want passwords in the terminal.
7. Store the profile, not the password, when a site needs custom rules.

What Is LessPass?

LessPass is a stateless open source password manager that generates a unique password for every site from four inputs: the site, the login, the master password, and a counter. The generation is a pure function, so the same inputs always return the same password, and nothing is stored anywhere. The project started on 10 December 2015, and the repository is still receiving commits, with the latest push 17 days before this guide was written.

The cryptography is deliberately boring: PBKDF2 with 100,000 iterations and HMAC-SHA-256 derives 32 bytes of entropy from the master password, using the site, login, and counter as the salt. The entropy is then rendered into a password that respects the length and character rules you chose, with at least one character from each enabled set. The design comes from an original idea in the Master Password app, and the code is free under the GNU General Public License version 3.

The project is quietly maintained rather than abandoned or fast-moving: the repository gets occasional commits, the extensions shipped version 11.0.10 in April 2025, and the Android app reached version 9.9.1 in September 2025. The hosted database is the one part that is truly gone, and the database section below covers what replaced it. A 2026 SafetyDetectives review ranks LessPass number 20 out of 51 password managers, and the project author has said an audit is needed, and no independent security audit is known to exist.

LessPass is a password generator no vault is needed for, and that is the whole point of the design. The site, the login, and the master password are the recipe, and the recipe is the only thing you must keep. Everything else in this guide is practice with that one idea.

Your First Password on the Web

Open lesspass.com in any browser and you get the generator immediately, with no account and no install. Type the site, type the login, type the master password, and the password appears at once. Copy it with the button or the keyboard and paste it into the site you are joining.

The defaults are a 16-character password with lowercase, uppercase, digits, and symbols all enabled, and that default works on most sites. The fingerprint shown while you type is a visual cue that your master password is the one you think it is, because the field itself is masked. Try the same inputs on another device or offline and you get the same password, because no server is involved in the generation.

The catch is that LessPass cannot adopt a password you already have, so switching means changing the password on every site to the one LessPass generates. That migration cost is the price of having no vault, and it is the first thing to accept before you commit. Consistency matters: a typo in the site or login silently produces a different password, so type the site exactly the same way every time.

The Master Password Rule

Your LessPass master password is the only secret in the whole system, so choose one long phrase you can remember for years and never write it into the same place as your logins. Every site password is derived from it, which means anyone who learns it can regenerate all of your passwords, and anyone who never learns it cannot. The rule is simple: the master password is the one password you must never forget and never share.

The hard truth is simple: lose your master password and every generated password is unrecoverable, because nothing is stored anywhere to reset or restore. There is no recovery email, no support reset, and no vault file to crack open, so the only way back into each account is that site's own forgot-password flow. This is a design consequence, not a bug, and the official project has no FAQ that states the rule in so many words.

A master password change is total: changing the master password changes every site password, so it means regenerating and resetting the password on every site you use. The 2016 announcement post lists a master password change as a known limitation, and no fix has shipped since. Pick the master password as if you will keep it forever, because in practice you will.

The Counter: How Password Rotation Works

The LessPass counter is the rotation mechanism, and it lives in the options next to the length and character rules. The counter starts at 1, and incrementing it to 2 produces a completely different password from the same site, login, and master password. The counter is part of the salt, so the change is total: nothing from the old password survives into the new one.

Rotation is a three-step habit: open the profile, raise the counter by one, and save the new generated password on the site before you close the tab. The profile must record the counter, because regenerating with the old counter gives you the old password and the login fails. The repository tests show the effect plainly: the same site, login, and master password give one password at counter 1 and a different password at counter 2, and the algorithm section below reproduces both.

# Same site, login, and master password, counter 1
lesspass example.org [email protected] --counter 1
# Rotate after a leak: counter 2, a new password
lesspass example.org [email protected] --counter 2
# Shorter password, digits only, counter 1
lesspass example.org [email protected] --digits --no-lowercase --no-uppercase --no-symbols --length 8

The counter also solves the shared-password problem in a small way: two people who know the same master password can use different counters for the same site and get different passwords. The feature is simple, and that simplicity is why it survives: one number, one new password, no vault update. Keep a note of the counter per site, because the generator will never tell you which counter you used last.

Password Profiles: Length and Character Rules

A profile is the recipe for one site: the length, the four character rules, the counter, and any excluded characters. The defaults are 16 characters with lowercase, uppercase, digits, and symbols all on, and a counter of 1. Most sites accept the default, and the profile exists for the ones that do not.

The official blog gives a numbers-only bank as the classic example: a French bank login that accepts six digits and nothing else, so the profile turns off every rule except digits and sets the length to 6. The generator guarantees at least one character from each enabled set, so a profile with only digits on can only produce digits. Community experience puts the share of sites that reject the default at about 1 percent, and those sites are exactly why profiles exist.

# A numbers-only bank profile: six digits, counter 1
lesspass www.ingdirect.fr 38491092 --no-lowercase --no-uppercase --no-symbols --length 6
# No symbols, letters and digits only
lesspass example.org [email protected] --no-symbols

How Do I Install the LessPass CLI?

The LessPass CLI is the Python package lesspass on PyPI, currently version 10.2.1, released on 2 January 2023 and unchanged since. Install it with one command, and the lesspass command appears on your path. The package needs Python 3.6 or newer, and the documented install uses pip with the user flag.

The flags in the table below come from the project page, and the CLI help text comes from the PyPI page, not a live terminal run. The usage line is lesspass SITE LOGIN MASTER PASSWORD OPTIONS, with the site required and the login defaulting to an empty string. The master password can also come from the LESSPASS_MASTER_PASSWORD environment variable or from an interactive prompt, which is the safer habit.

# Install the CLI for your user only
python3 -m pip install --user lesspass
# Generate a password, master password prompted
lesspass example.org [email protected]
# Copy it straight to the clipboard
lesspass example.org [email protected] --copy
# No symbols, letters and digits only
lesspass example.org [email protected] --no-symbols
# Only digits, eight characters long
lesspass example.org [email protected] --digits --no-lowercase --no-uppercase --no-symbols --length 8

The CLI Arc: Prompt Mode, Aliases, and Saved Profiles

Prompt mode is the habit to build: run lesspass with the prompt flag and type the site, login, and master password interactively, so the secret never lands in your shell history. The copy flag puts the result straight on the clipboard, which needs pbcopy, xsel, xclip, or clip depending on your system. The fingerprint shown while you type is a visual cue that stays the same for the same master password, so a different fingerprint means a typo.

Aliases turn the CLI into a one-word habit: one alias per site, with the site and login baked in, and the master password always prompted. The profile save flag writes profiles to a local JSON file, and the help text warns that the file is not encrypted, so treat it like a list of site recipes, never a vault. The load flag reads that file back, and an optional database URL flag points the save and load at a self-hosted server instead.

# Prompt for everything, nothing in shell history
lesspass --prompt
# A one-word alias for one site, master password always prompted
alias ghpw="lesspass --copy github.com [email protected]"
# Save the profile for this site to the local file
lesspass example.org [email protected] --save
# Load saved profiles from the local file
lesspass example.org [email protected] --load

Browser Extension and Mobile Apps

The browser extension is the fastest daily route: install it from the Chrome Web Store or Firefox Add-ons, click a password field, and press Ctrl-Shift-L to open it. Fill in the login and master password, press Enter, and the password is copied to the clipboard, ready to paste. Both stores ship version 11.0.10, updated on 7 April 2025, which is 579 days old, about 1.6 years.

One version wrinkle: the extension stores ship version 11.0.10 while the git tags lag behind, so trust the store listing for the current version. Firefox rates the extension about 4.58 out of 5 from roughly 81 ratings, and the Chrome listing declares that the developer collects no data. The mobile apps cover Android and iOS, with the Android app at version 9.9.1 from September 2025, and the iOS version was not verified at write time.

The extension and the mobile app store profiles locally on the device, so a saved profile follows you only as far as that device does. That is the trade for having no cloud: convenience lives on each device separately, and the recipe must be recreated or exported when you switch devices. The connected database used to bridge that gap, and the next section explains why it no longer exists.

The Optional Database and Self-Hosting

The headline fact is plain: the hosted LessPass Database shut down on 1 November 2024, which is 736 days ago, about 2.0 years, and new users cannot register for it. The December 2022 decommissioning post says the static web app, the web extension, and the mobile versions remain in place, and only the hosted database went away. The repository readme now says the server is reserved for existing users, and new users who want the connected version must self-host.

The database never stored passwords: it stored profiles only, meaning the site, login, length, character rules, and counter, and never the master password or the generated password. The author disclosed one more reason for the shutdown: the LessPass Database stored profiles unencrypted, and the December 2022 LastPass breach had shown how much unencrypted profile data can reveal. Self-hosting is the replacement, and the requirement is Docker and Docker Compose on your own machine.

# Clone the repository for a self-hosted install
git clone https://github.com/lesspass/lesspass.git

The Git beginner guide covers the clone step that starts any self-hosted install, and the repository is the source of the server code and its docs. Export tools exist for the old database users: the CLI from version 10.2.1, the Chrome extension from 9.6.8, and the Firefox extension from 9.6.9 can export profiles to a CSV that Bitwarden and Google Passwords accept. Third-party server implementations are listed on the repository wiki, and the author warns to use them with caution, since he cannot guarantee they support the latest API.

LessPass vs Bitwarden vs KeePassXC vs gopass

LessPass vs Bitwarden is the comparison most readers ask about, and the answer is a difference of kind, not quality: Bitwarden stores random passwords in an encrypted vault and syncs them, while LessPass computes passwords and stores nothing. The vault managers win on convenience features, and LessPass wins on having nothing to breach, sync, or lose. The table below puts the four managers side by side, and the sibling guides on this site cover each vault lane in full.

The Bitwarden beginner guide covers the cloud vault lane, and the KeePassXC beginner guide covers the offline file lane. The gopass beginner guide covers the git-backed lane, and gopass is the closest cousin: a terminal-first tool with a real encrypted store, where LessPass has no store at all. Pick the vault when you want autofill, audit, and passkeys, and pick LessPass when you want the smallest possible thing to trust.

The price gap is real but narrow: LessPass is free forever under the GPL, Bitwarden has a free tier with a Premium plan at 1.65 dollars a month billed annually, and KeePassXC and gopass are free open source tools. A 2026 SafetyDetectives review lists autofill, autosave, audit, emergency access, secure notes, and master password recovery among the features LessPass lacks, and that list is the honest buying guide. If any item on it matters to you, take the vault lane instead.

I Ran the Algorithm Myself

The strongest claim in this guide is also the easiest to check: the password generation is deterministic, so anyone can run the same algorithm and get the same password. I took the password module from the repository, ran it in Python on this machine, and reproduced both test vectors from the project tests exactly. The salt is the site plus the login plus the counter in hexadecimal, the key is the master password, and the derivation is PBKDF2 with 100,000 iterations of HMAC-SHA-256 over 32 bytes.

The first vector uses the site example.org, the login [email protected], the master password password, all four character sets, a length of 16, and counter 1, and it produces WHLpUL)e00[iHR+w. The second vector keeps the same inputs, moves the counter to 2, turns symbols off, and shortens the length to 14, and it produces MBAsB7b1Prt8Sl. Both matched on the first run, which is the whole point of a pure function: the same recipe, the same password, on any machine.

import hashlib
from datetime import date

CHARACTER_SUBSETS = {
    "lowercase": "abcdefghijklmnopqrstuvwxyz",
    "uppercase": "ABCDEFGHIJKLMNOPQRSTUVWXYZ",
    "digits": "0123456789",
    "symbols": "!\"#$%&'()*+,-./:;" + chr(60) + chr(61) + chr(62) + "?@[\\]^_" + chr(96) + "{|}~",
}

def calc_entropy(profile, master_password):
    salt = profile["site"] + profile["login"] + hex(profile["counter"])[2:]
    hex_entropy = hashlib.pbkdf2_hmac("sha256", master_password.encode("utf-8"), salt.encode("utf-8"), 100000, 32).hex()
    return int(hex_entropy, 16)

def remove_excluded(string, exclude):
    return "".join(c for c in string if c not in exclude)

def get_set_of_characters(rules, exclude=""):
    pool = ""
    for rule in rules:
        pool += CHARACTER_SUBSETS[rule]
    return remove_excluded(pool, exclude)

def consume_entropy(generated_password, quotient, set_of_characters, max_length):
    if len(generated_password) == max_length:
        return [generated_password, quotient]
    quotient, remainder = divmod(quotient, len(set_of_characters))
    generated_password += set_of_characters[remainder]
    return consume_entropy(generated_password, quotient, set_of_characters, max_length)

def insert_string_pseudo_randomly(generated_password, entropy, string):
    for letter in string:
        quotient, remainder = divmod(entropy, len(generated_password))
        generated_password = generated_password[:remainder] + letter + generated_password[remainder:]
        entropy = quotient
    return generated_password

def get_one_char_per_rule(entropy, rules, exclude=""):
    one_char_per_rules = ""
    for rule in rules:
        available_chars = remove_excluded(CHARACTER_SUBSETS[rule], exclude)
        value, entropy = consume_entropy("", entropy, available_chars, 1)
        one_char_per_rules += value
    return [one_char_per_rules, entropy]

def render_password(entropy, profile):
    rules = [r for r in ["lowercase", "uppercase", "digits", "symbols"] if profile.get(r)]
    exclude = profile.get("exclude", "")
    set_of_characters = get_set_of_characters(rules, exclude)
    password, password_entropy = consume_entropy("", entropy, set_of_characters, profile["length"] - len(rules))
    characters_to_add, character_entropy = get_one_char_per_rule(password_entropy, rules, exclude)
    return insert_string_pseudo_randomly(password, character_entropy, characters_to_add)

def generate_password(profile, master_password):
    return render_password(calc_entropy(profile, master_password), profile)

p1 = {"site": "example.org", "login": "[email protected]", "counter": 1, "length": 16, "lowercase": True, "uppercase": True, "digits": True, "symbols": True}
print("vector counter 1:", generate_password(p1, "password"))
print("vector expected:", "WHLpUL)e00[iHR+w")
print("vector match:", generate_password(p1, "password") == "WHLpUL)e00[iHR+w")
p2 = {"site": "example.org", "login": "[email protected]", "counter": 2, "length": 14, "lowercase": True, "uppercase": True, "digits": True, "symbols": False}
print("vector counter 2:", generate_password(p2, "password"))
print("vector expected:", "MBAsB7b1Prt8Sl")
print("vector match:", generate_password(p2, "password") == "MBAsB7b1Prt8Sl")
today = date(2026, 11, 7)
def days(d):
    return (today - d).days
def yrs(d):
    return round(days(d) / 365.25, 1)
print("repo age days:", days(date(2015, 12, 10)))
print("repo age years:", yrs(date(2015, 12, 10)))
print("stars per fork:", round(6080 / 361, 2))
print("open issues per 100 stars:", round(37 / 6080 * 100, 2))
print("cli 10.2.1 age days:", days(date(2023, 1, 2)))
print("cli 10.2.1 age years:", yrs(date(2023, 1, 2)))
print("database shutdown days ago:", days(date(2024, 11, 1)))
print("database shutdown years ago:", yrs(date(2024, 11, 1)))
print("extension 11.0.10 age days:", days(date(2025, 4, 7)))
print("extension 11.0.10 age years:", yrs(date(2025, 4, 7)))
print("last push days ago:", days(date(2026, 10, 21)))
print("latest commit days ago:", days(date(2026, 10, 14)))
print("lowercase set size:", len(CHARACTER_SUBSETS["lowercase"]))
print("uppercase set size:", len(CHARACTER_SUBSETS["uppercase"]))
print("digits set size:", len(CHARACTER_SUBSETS["digits"]))
print("symbols set size:", len(CHARACTER_SUBSETS["symbols"]))
print("total pool size:", len(CHARACTER_SUBSETS["lowercase"]) + len(CHARACTER_SUBSETS["uppercase"]) + len(CHARACTER_SUBSETS["digits"]) + len(CHARACTER_SUBSETS["symbols"]))
print("pbkdf2 iterations:", 100000)
print("entropy bytes:", 32)
print("default length:", 16)
print("length min:", 5)
print("length max:", 35)
Output:
vector counter 1: WHLpUL)e00[iHR+w
vector expected: WHLpUL)e00[iHR+w
vector match: True
vector counter 2: MBAsB7b1Prt8Sl
vector expected: MBAsB7b1Prt8Sl
vector match: True
repo age days: 3985
repo age years: 10.9
stars per fork: 16.84
open issues per 100 stars: 0.61
cli 10.2.1 age days: 1405
cli 10.2.1 age years: 3.8
database shutdown days ago: 736
database shutdown years ago: 2.0
extension 11.0.10 age days: 579
extension 11.0.10 age years: 1.6
last push days ago: 17
latest commit days ago: 24
lowercase set size: 26
uppercase set size: 26
digits set size: 10
symbols set size: 32
total pool size: 94
pbkdf2 iterations: 100000
entropy bytes: 32
default length: 16
length min: 5
length max: 35

Seven Mistakes Beginners Make

The pattern behind every row is the same: LessPass remembers nothing, so you must remember the recipe. The site, the login, the master password, the counter, and the profile rules are the whole system, and any one of them drifting produces a different password. Write the recipe down per site, in a place only you can reach, and the stateless design stops feeling fragile.

Sources

The LessPass repository on GitHub (github.com/lesspass/lesspass) gives the stars, forks, open issues, license, creation date, latest push, and latest commit quoted in this guide, and the repository README states the server-access update and the Master Password inspiration. The official blog post LessPass How Does It Work, dated 19 October 2016 on blog.lesspass.com, explains the pure-function design, the PBKDF2 settings, and the counter, and the decommissioning post dated 29 December 2022 gives the shutdown date and the export routes. The PyPI page for lesspass (pypi.org/project/lesspass) lists version 10.2.1, the install command, and the full flag table.

The Chrome Web Store listing and the Firefox Add-ons version history give extension version 11.0.10 and the 7 April 2025 update date, and the Android listing gives version 9.9.1 from September 2025. The DeepWiki pages for the LessPass repository index the password generation code and the profile defaults, and the repository test vectors reproduced in this guide come from that indexed code. SafetyDetectives published the LessPass Review 2026, which ranks the project number 20 out of 51 password managers and lists the missing vault features.

The password module itself (cli/lesspass/password.py in the repository) was fetched and run for this guide, and both test vectors matched exactly on the first run. The comparison prices and features for Bitwarden, KeePassXC, and gopass come from their project pages and the 2026 open source manager roundups cited in the research pack. Per the standing rule for this site, no Facebook promotion applies to this article.

Frequently Asked Questions

Is LessPass really free?

Yes, LessPass is free and open source under the GNU General Public License version 3, with no paid tier and no account needed for the web generator. The browser extension, the mobile apps, and the CLI are free too, and the only cost is the server you run if you choose to self-host the optional database.

What happens if I forget my master password?

You lose access to every generated password, because nothing is stored anywhere to recover or reset. The only way back into each account is that site's own forgot-password flow, so choose a master password you can keep for years.

How do I change a password without changing my master password?

Raise the counter by one in the profile or with the counter flag, and the generator produces a completely different password. Save the new password on the site first, and record the new counter, because regenerating with the old counter gives you the old password.

Does LessPass work offline?

Yes, the generation needs no server and no network, so the web app, the extension, and the CLI all work offline once installed. The same inputs always produce the same password, with or without a connection, which is the whole point of the stateless design.

Is LessPass safer than a vault password manager?

It is safer in one way and weaker in another: there is no vault to breach, sync, or lose, but there is also no autofill, no audit, and no recovery. Readers who need those features should take the vault lane, and readers who want the smallest thing to trust should take LessPass.