They are encrypting it locally. It isn't anything to doubt- it's been shown time and time again.
Nowhere in the payload that gets sent to them is your key. The only way you could consider your passwords compromised is if you think there's already a rainbow table out there to decrypt everything, which is ludicrous.
OK, I don't know how it works then.
The encryption happens in a browser extension or mobile app, or in client-side Javascript in the case of accessing it directly through their website.
There is an official, open-source lastpass CLI client: https://github.com/lastpass/lastpass-cli
So how come they don't have your raw passwords? Because of their web centric approach, I doubt that they are encrypting it locally. And regardless, LastPass is a proprietary thing, so you can consider your passwords to be compromised anyway.