Can each vault be decrypted with just the master password or do the hackers need to also break a unique key for each? What's stopping them from looping through

Can each vault be decrypted with just the master password or do the hackers need to also break a unique key for each? What's stopping them from looping through the 10k most common passwords and trying them all on every vault?