The nice thing with password managers is you only have to remember the one password. That means it's easy to make that password very strong. And then it just co

The nice thing with password managers is you only have to remember the one password. That means it's easy to make that password very strong. And then it just comes down to your key derivation. https://keepass.info/help/base/security.html#secdictprotect https://keepass.info/help/base/security.html#secdictprotect The documentation here is pretty unclear. I'm not a keypass user and I don't see what the default settings are. The recommendation though is "1 second" with Argon2 though, which seems like a good default. I did a quick search, https://research.redhat.com/blog/article/how-expensive-is-it-to-crack-a-password-derived-with-argon2-very/ https://research.redhat.com/blog/article/how-expensive-is-it... > cracking an eight-character passphrase [..] encrypted with Argon2 created on a modern laptop would require up to 75,121 powerful machines running for ten years and cost over 4 billion dollars. So 8 characters with settings leading to ~2 seconds on a laptop (twice the recommendation from keepass) will cost 4 billion. So we can say 2 billion for 1 second (obviously we're hand waving a lot). And that would still take 10 years. So basically, if you have a government adversary who really fucking hates you and has a lot of time and money to kill just bruteforcing your volume, go ahead and add a few more characters and consider bumping up the setting to 5 seconds instead of 1. I think every character you add should (hand waving, data dependent) increase the search space by 10x.