Yes: By design. This helps make brute forcing the password harder by forcing each attempt to take a while. The crypto implementation in the browser itself is pr

Yes: By design. This helps make brute forcing the password harder by forcing each attempt to take a while. The crypto implementation in the browser itself is pretty fast. You can easily make it faster or instantaneous by lowering the number of PBKDF2 rounds in the html-vault script. The default of 20 million seems a bit excessive based on the feedback so far.