LastPass – How to Set Profile Icon in LastPass

All encryption/decryption occurs on your computer, not on our servers. This means that your sensitive data does not travel over the Internet and it never touches our servers, only the encrypted data does.

[...]

Your encryption key is created from your email address and Master Password. Your Master Password is never sent to LastPass, only a one-way hash of your password when authenticating, which means that the components that make up your key remain local. This is why it is very important to remember your LastPass Master Password; we do not know it and without it your encrypted data is meaningless. LastPass also offers advanced security options that let you add more layers of protection.

Source: http://lastpass.com/help.php?topic=whysafe&nw=1&fromwebsite=1

In other words, your computer encrypts your passwords with your email and master password and sends that data to Lastpass. When you authenticate with your master password at Lastpass.com, Lastpass.com returns all your encrypted passwords, which are decrypted locally on your computer with your email and master password. Every communication happens over SSL, so anything intercepted is doubly useless (since everything is encrypted with not just the SSL keys but with your email and master password).

The best way to ensure this is to set up a script to monitor network activity and see if anything that is decrypted (including the master password) goes to lastpass.com. Based on what I've seen on forums, it seems other users have done this and found nothing suspicious.

In a nutshell: Your data is encrypted by the LastPass application with your master password on your computer and is sent encrypted to the LastPass server for storage. Your master password never leaves the computer. Their employees can not see your data without the password.

For further details take a look at the review epsiode and the following Q&A episode of Steve Gibson's Security Now! podcast on LastPass. (The podcast has 288 episodes and counting). If this man uses and trusts LastPass so can you.

By the way, I do to. I store my credit card PIN codes, bank account passwords, software licence keys, ebay, paypal and GMail logins with full confidence in LastPass.