My reason for not using LastPass is because it is proprietary. In fact, there has been an XSS attack on them in the past which was somewhat successful. I use KeePassX because it allows me to avoid laying trust on any proprietary entity. At present if LastPass were to have another security flaw (and hey, security flaws on web-facing servers are all too common) you'd be out of luck. With KeePassX security is local. The worst case for me is someone stealing my database and trying to bruteforce the password (hah, like that'll happen). This requires them to have physical access to my computer. Anyone can take a guess at your password because it's a web based service.