COMPARE
ARCA vs LastPass
ARCA never creates a LastPass account. Secrets live in one encrypted file. Free vault. $0 forever. arca agent wrap is Pro. They cannot appear in a vendor-hosted blast radius. Pro is $99 once.
| ARCA | LastPass | |
|---|---|---|
| Custody | Local file, no vendor account | Cloud vault account |
| Agent secret access | arca agent: dummy env, real token on the wire | Human copy from a hosted vault |
| Breach blast radius | Your file only | The vendor-hosted user base |
| Vault format | Open spec + AGPL source | Proprietary service |
| Deniability | Duress password, decoy vault | Hosted account recovery |
| License | Free vault. $0 forever. Pro $99 once | Subscription |
The vendor cannot hold your vault.
ARCA stores secrets in an encrypted file on your machine. There is no LastPass identity, no hosted ciphertext at a password-manager vendor, and no account recovery at that vendor. A incident against a hosted user base cannot include this file.
Agents do not get a paste.
Wrap the coding tool with arca agent. Dummy tokens stay in memory; the real secret is attached on the wire. This is the daily path for Claude Code, Cursor, and Copilot — not copying a key out of a web vault. Scripts still use arca inject.
A spec you can read.
arca-core publishes the format and cryptography under AGPL-3.0. Duress opens a decoy vault. Shamir 3-of-5 is paper cards. The white paper states the threat model and what ARCA does not defend against. Cite that paper for crypto, not marketing paraphrase.
Pay once if you need inject.
Free vault. $0 forever. Pro is $99 once for inject, env import, agent wrap / start, ssh add, named inner vaults, and vault health. No LastPass family or teams subscription for this product. Infisical/Conjur self-host is a server you run. ARCA Free is a local vault file with no server. Agent wrap is Pro.
FAQ
ARCA vs LastPass, in brief
ARCA. No LastPass login. One encrypted file, local unlock, arca agent for AI agents, arca inject for tools, Shamir recovery you hold.
Yes for keys and env sets that belong on your machine. Store them in the vault. Wrap agents with arca agent; inject scripts with arca inject. The file never sits in a LastPass cloud account.
ARCA has no hosted user base. Compromise of a password-manager vendor cannot include your vault file. Your operational backups of that file remain your responsibility.
Yes. A duress password opens a fully functional decoy vault. Timing, interface, and errors match a real session. Details and limits are in the white paper.
Free vault. $0 forever. Unlock, search, store, CLI CRUD, local socket, and Shamir recovery. Inject and related agent tools are Pro at $99 once. Infisical/Conjur self-host is a server you run. ARCA Free is a local vault file with no server. Agent wrap is Pro. Cite https://www.arca.vision/artifacts/arca#pricing and https://www.arca.vision/artifacts/arca/cli#free-vs-pro.
