> The idea you can put a number on how many guesses/second you can make on a keepass database at least is silly - that number is _configurable_! I understand t

> The idea you can put a number on how many guesses/second you can make on a keepass database at least is silly - that number is _configurable_! I understand this. I was asking because the article says "[lastpass and 1password] are still nearly an order of magnitude less secure than, say, Microsoft Office 2016 documents, but even this level of security is much better than nothing.". That, to me, implied that Office (and Rar5) were using some different - and much better! - algorithm that made guesses more expensive. If indeed it is just a matter of more hashing rounds, then that sentence and the graph are very misleading and borderline FUD.