Selfhosted

It's a cool concept that quickly falls apart in my opinion:

1. It's not really stateless as soon as a website has certain password requirements. You probably don't want to remember the configuration of all passwords in your head.
2. If the password for a website gets compromised, you have to set the "counter" + 1. Again, not stateless.
3. If you have multiple accounts per website, you'll have to store the site differently (for example including www, not including www) or interlace the counter (odd/even) between the two. This gets more and more messy the more accounts you add, and again, it's not stateless.
4. The master password is the only thing an attacker needs (plus the state mentioned above, but it's easy to brute force a simple counter). With most other password managers, the attacker needs access to the vault/database and potentially a keyfile, secret and/or some form of second factor.
5. Changing your master password because it got compromised or ideally before it gets compromised changes the passwords for all websites.
6. You still have to remember your username or login email, so that's again not stateless if you're saving it in some sort of LessPass client.

I could probably list a lot of other reasons why it's not a good idea to use it. There are probably some edge cases where it's good, for demonstration purposes or training sessions where the participants all need unique (temporary) logins for several services.

The fact that all your passwords change if you change your master password is not great.

don't use but sorta concerned about it using the url as those have a tendency to change.

I won't use it as there's always some website with some ridiculous password requirements like "can't use symbols or numbers, must start with a capital letter, maximum 8 chars"

I use it, but it has issues, for example you need to remember how you wrote the website name, and if you ever change your master password you need to change the password of every site, and if you must change the password of a single site, you need to remember the counter for each site.

It's a cool idea, and worth it to generate passwords, but I would still advise to have other methods, and if you have those other methods it becomes kind of pointless. Still a very cool idea and very manageable for a low number of sites.

LessPass has the possibility to connect to a database (via its API) to store the configurations made for each site. This API can be used from any of the clients (either the browser extension, the mobile application, etc.).

You set up the DB server wherever you want. If you want something light you can use this implementation. And if you are interested, there is also a command line client.

Cool concept but it doesn’t seem practically viable.

Despite what others are saying, I've been using it for a couple years and it can work great if you're okay with the trade-offs.

Of the three (Integrity, Confidentiality, Availability) it has better availability than cloud storage which is what I care about. Even when the LessPass site is down, there's an IPFS version, mirrors, local cache, etc so it's basically always possible to derive any password.

At a user level, it's very impractical (and a slight risk) to always retype the master password at every single login screen. However, letting the local autofill save the password doesn't defeat the point of LessPass. Why? because, if you only use local storage, and you're traveling and your phone breaks, you're now locked out of every account. With LessPass, you're fine as soon as you get an internet connection.

There are a few caveats.

• There's no global 2factor. Loosing the master password means every site that doesn't have its own 2factor is instantly fully exposed.
• I do agree there are a few sites where the default options don't work because of the character restrictions. It's about 1.2% of websites in my experience, but they are painful exceptions. Basically you have to rely on memory to be able to pick those same settings again. I recently wish there was a unified dataset of which websites had password requirements, and then LessPass would auto check the necessary boxes when the website URL was pasted in. Maybe one day.
• Changing your master password requires changing every single website. If you don't, then it's impractical to remember what password was used for what site.