Password Manager Vault KDF (Argon2id / PBKDF2) Crack-Cost Calculator (2026)

PBKDF2-HMAC-SHA256 requires less than `1 KB` of state memory per hash candidate, allowing an NVIDIA RTX 4090's `16,384 CUDA cores` to run tens of thousands of candidates in parallel entirely inside ultra-fast L1/register silicon without touching VRAM. **Argon2id** (winner of the Password Hashing Competition, RFC 9106) is **memory-hard**: if configured at `64 MiB` per hash, each candidate must allocate and pseudorandomly read/write a `64 MiB` memory block, immediately bottlenecking the GPU on memory capacity and GDDR6X bus bandwidth.

1Password uses a Two-Secret Key Derivation (2SKD) model: your vault encryption key is derived by combining your Master Password (run through PBKDF2-HMAC-SHA256) with a locally generated **128-bit Secret Key** (`A3-XXXXXX-...`) that is never stored on 1Password's servers. If an attacker steals the encrypted vault blob from 1Password's cloud, they do not have your Secret Key and face `2^(MasterEntropy + 128)` possibilities—making offline brute-forcing thermodynamically impossible.

On iOS, third-party AutoFill Credential Provider extensions are restricted by Apple's XPC memory jetsam limits (historically `~60 MB` to `120 MB` on older iOS versions, and tightly bounded on modern iOS). If your vault's Argon2id memory parameter exceeds the iOS AutoFill extension RAM ceiling, the OS kernel immediately kills the AutoFill popup when you try to log into an app. `64 MiB` with `3–4` iterations is the sweet spot for cross-platform compatibility.

For an entropy of `E` bits, an attacker must search `2^(E - 1)` candidates on average (50% probability). If a single rented RTX 4090 (`~$0.45/hour`) computes `R` hashes per second at your KDF settings, one GPU-hour tests `3,600 × R` candidates. Therefore, `Expected Cost ($) = (2^(E - 1) / (3600 × R)) × $0.45`.

As GPU SHA-256 throughput jumped over the past decade (an RTX 4090 computes over `21 billion` raw SHA-256 hashes per second), older defaults like `5,000` or `100,000` PBKDF2 iterations allowed an RTX 4090 to test `15,000 to 300,000` master passwords per second. Raising PBKDF2-HMAC-SHA256 to `600,000+` iterations slows a single RTX 4090 down to roughly `~2,500` guesses per second—or better yet, migrating to Argon2id drops it to `<50` guesses per second.