It used to be random alphanumeric, eight characters. JTR tore through that. It's now ~15 random characters, not all ASCII. Possibly worse, 1Password used to ha

It used to be random alphanumeric, eight characters. JTR tore through that. It's now ~15 random characters, not all ASCII. Possibly worse, 1Password used to have a mistake in their key generation algorithm that means you could verify a password without the time-consuming key stretching, effectively making it thousands of times faster to crack. JTR doesn't use that method though.