I actually use KeePass myself with a few hundred thousand of iterations. Here's my comment in this same thread: https://news.ycombinator.com/item?id=6864466 h

I actually use KeePass myself with a few hundred thousand of iterations. Here's my comment in this same thread: https://news.ycombinator.com/item?id=6864466 https://news.ycombinator.com/item?id=6864466 I agree that if you pre-hash your passwords 1 million times yourself, then it's much safer than using the password directly. You're basically slowing down the bruteforce attack by a factor of a million, which is equivalent to adding log2(1M) = 20 more bits. 53 bits is definitely not enough to protect anything important. I, personally, use 30 character passwords for anything mildly important, like email, which is around 170 bits. For bitcoins I go 40 characters - that's around 230 bits.