Why the “PBKDF2 with 100,000 Rounds” Number Actually Matters, With Real Math
Here is what that number is protecting you from concretely. A single modern high-end consumer GPU (an Nvidia RTX 4090) can compute roughly 20 billion plain SHA-256 hashes per second. If your master password were hashed just once, a single machine could test tens of billions of dictionary guesses against it every second.
PBKDF2 (Password-Based Key Derivation Function 2) deliberately slows that guessing attack down by repeating the cryptographic hash function 100,000 times per guess. Based on published hashcat benchmark testing, that same RTX 4090 drops from tens of billions of guesses per second to somewhere in the range of 3 to 4 million guesses per second — a slowdown of roughly four orders of magnitude.
The Practical Takeaway for Your Master Password
Key stretching doesn’t make an inherently weak password impossible to crack — it makes guessing expensive in time and electricity. A 6-character master password can still be brute-forced. But a 16+ character passphrase pushes realistic cracking time from hours into centuries, even at millions of guesses per second. For the complete mathematical breakdown, see our in-depth analysis on How Long Would It Actually Take to Crack Your Password?
What We’d Tell You Not to Store Here
Vault is engineered for notes, credentials, and secrets you access occasionally: API keys, recovery codes, physical safe combinations, and sensitive document passwords.
It is not built to be your primary daily password manager with autofill across every site you visit on mobile and desktop; there are dedicated apps (like Bitwarden or 1Password) with native OS browser extension autofill that Vault does not try to replicate. Always use the right tool for the job.
Frequently Asked Questions
If I forget my master password, can you reset it?
No — and this is not a policy choice, it is a structural architectural law. We never have access to your master password or your unencrypted data. There is no server holding a master recovery key, so there is nothing on our end to reset. Losing your master password means losing access to what is stored permanently.
Is this the same as a browser’s built-in “Save Password” feature?
No. Browser-saved passwords are tied to that specific browser installation and frequently sync to Google or Apple cloud servers depending on your sync settings. Vault is a separate, deliberately isolated zero-knowledge cryptographic safe that you control directly.