Humans are inherently bad at choosing strong passwords. You took a word list for four dices (1296 words) and you randomly selected five words for your master password.Ĭhoosing a password with 50 bits entropy without it being randomized? No idea how one would do it. Or maybe you went for a diceware password.

Yes, such password is already rather hard to remember but you want your passwords to be secure. For example, it could be an eight character random password, with uppercase and lowercase letters, digits and even some special characters.

What’s the impact if you have an even lower iterations number configured? Let’s say you have a fairly strong master password, 50 bits of entropy. So the LastPass default is already factor three below the recommendation. The current OWASP recommendation is 310,000 iterations. The more iterations you have configured, the slower this guessing will be. In order to decrypt them, the perpetrators need to guess your master password. This setting is actually central to protecting your passwords if LastPass loses control of your data (like they did now). How did the low iteration numbers come about?.

Lastpass recently generated passwords