Wait. When I click "Security Check" in my LastPass Tools... menu (this is in Chrome), I get taken to an internet-hosted web page where I'm prompted to enter my master password. [1] I am not taken to a chrome:// page or some other client-side tool.

I take this to mean that I'm giving LastPass's web server my actual master password, and that they will do server-side decryption of my Vault and have server-side access to my passwords in cleartext.

Is that accurate?

[1] https://lastpass.com/index.php?securitychallenge=1&lang=en-U...