Your password manager does not encrypt your vault with your master password. It cannot - a human-typed phrase is the wrong shape and the wrong strength to be a cryptographic key.
Instead it runs that phrase through a key derivation function, or KDF, which turns it into a fixed-length key. And the KDF is built to be slow on purpose.
Why slowness is the feature
If deriving the key took a microsecond, an attacker holding a stolen vault could try billions of candidate passwords per second. Making the derivation take a fraction of a second changes nothing for you - you type your password once - and multiplies the attacker's cost by the same factor for every single guess.
That is the whole design. The delay you barely notice is the delay the attacker pays, over and over.
The number that controls it
How slow the derivation is depends on a work factor: iterations for PBKDF2, or memory and passes for Argon2.
The OWASP Password Storage Cheat Sheet now puts Argon2id at the top of its recommendations, with a minimum of 19 MiB of memory, 2 iterations and 1 degree of parallelism. Where FIPS-140 compliance is required, it recommends PBKDF2 with 600,000 iterations or more, using HMAC-SHA-256.
The historical progression is the part worth pausing on. The recommended PBKDF2 count has gone from 10,000 iterations in 2010 to 600,000 today - a sixtyfold increase, because attacker hardware got faster while the mathematics stayed the same.
The setting nobody revisits
Here is the practical consequence, and it is the reason this article exists.
Your account was configured on the day you created it, with that day's default. If you opened it years ago, the work factor stored with your account may still be the value that was considered adequate then - not the value considered adequate now. Recommendations moved; your account did not follow on its own.
Most serious managers expose the setting, and several have migrated their default to Argon2id. Changing it is usually a matter of one field in the security settings, and it re-derives your key on the next unlock.
Two cautions before you touch it. Raising the work factor makes unlocking slower on your slowest device - the old phone, not the desktop - so test there. And export a backup of your vault first: this operation re-encrypts, and an interruption at the wrong moment is not the place to discover you had no copy.
What actually protects the vault
The order matters more than any single number.
A long, unique master password comes first. No work factor rescues a weak phrase; it only multiplies the time needed to break it, and multiplying a very small number leaves a small number.
Then the KDF settings, which decide what a stolen vault costs to attack.
Then everything else - two-factor authentication protects the account on the provider's servers, but it does not protect an exported vault file that an attacker already holds. Only the master password and the KDF do.
The short version
Your master password is not the key; it is the input to a deliberately slow function that produces the key. That function has a work factor, current guidance is Argon2id or PBKDF2 at 600,000 iterations, and the value on your account is probably the default from the day you signed up. It is worth looking at once.
★ Audit Cure53 2024 · ✓ Plan gratuit · Cross-platform
Get NordPass30-day money-back guarantee · Free plan available→Frequently asked questions
What is a KDF in a password manager?
A key derivation function turns your master password into a cryptographic key. A typed phrase is the wrong length and the wrong strength to encrypt a vault directly, so the manager runs it through a function such as PBKDF2 or Argon2id, which produces a fixed-length key. The function is deliberately slow, because that slowness is what makes guessing expensive.
How many KDF iterations should I use?
Current OWASP guidance puts Argon2id first, with a minimum of 19 MiB of memory, 2 iterations and 1 degree of parallelism. Where FIPS-140 compliance is required, it recommends PBKDF2 with 600,000 iterations or more using HMAC-SHA-256. For comparison, the recommended PBKDF2 count was 10,000 in 2010 - the figure rises as attacker hardware gets faster.
Why is a slow function a good thing?
Because you pay the delay once, when you unlock, and an attacker pays it on every candidate password. A derivation taking a fraction of a second is unnoticeable to you and multiplies the cost of a brute-force attack by the same factor for each of billions of guesses. Speed would only ever help the attacker.
Should I change the KDF setting on an old account?
It is worth checking, because your account holds the default from the day it was created and recommendations have risen considerably since. Two cautions: a higher work factor makes unlocking slower on your slowest device, so test there rather than on a fast desktop, and export a backup of your vault first, since the change re-encrypts it.
Does two-factor authentication make the KDF less important?
No, they protect different things. Two-factor authentication protects your account on the provider's servers. It does nothing for an exported or stolen vault file, which an attacker can work on offline at their own pace. Against that file, only the strength of your master password and the KDF work factor matter.