They also give zero justification or explanation for why they selected 2^36 as the complexity that is assumed for the reader's password. It's too bad, as their

They also give zero justification or explanation for why they selected 2^36 as the complexity that is assumed for the reader's password. It's too bad, as their own page on PBKDF2 (https://support.1password.com/pbkdf2/ https://support.1password.com/pbkdf2/) shows what the complexity and cost is of various password models, but they don't use any of that data, and just stick with the $100 / 36 bits number. Based on their own page, I would probably estimate the complexity of the average user's password at around 50 bits (3 word, digit separator, capitalize one), but that would result in a $1 million dollar crack cost, largely wiping out their own argument.