Security and privacy

How PBKDF2 strengthens your 1Password account password

Learn how 1Password uses Password-Based Key Derivation Function 2 to make it harder for someone to repeatedly guess your account password.

About PBKDF2

Password-Based Key Derivation Function 2 (PBKDF2) makes it harder for someone to guess your account password through a brute-force attack.

PBKDF2 prevents password cracking tools from making the best use of graphics processing units (GPUs), which reduces guess rates from hundreds of thousands of guesses per second, to less than a few tens of thousands of guesses per second.

Cracking cost for different generation schemes

Generation schemeBitsCost (USD)Example
8 char, with lowercase, digits40.007702wd74wmq
7 char, with uppercase, lowercase, digits40.471,100zCm6hTb
3 syl, constant separator, capitalize one41.502,200austEerkkrug
3 word, constant separator42.484,300prithee-insured-buoyant
3 word, constant separator, capitalize one44.0713,000Dent-impanel-minority
9 char, with lowercase, digits45.0025,000azdr3oqxc
8 char, with uppercase, lowercase, digits46.2558,0008NhJqHPY
3 syl, digit separator, capitalize one48.15220,000Best0jogh2gno
3 word, digit separator49.13430,000swatch2forte1dill
10 char, with lowercase, digits50.00790,000fovav9v6ot
3 word, digit separator, capitalize one50.711,300,000saute7docket3Bungalow
9 char, with uppercase, lowercase, digits52.033,200,000siFc96vGw
11 char, with lowercase, digits55.0025,000,000aev7x9cgm3q
4 syl, constant separator, capitalize one55.2229,000,000paghdeygibFrom
4 word, constant separator56.6579,000,000align-caught-boycott-delete
10 char, with uppercase, lowercase, digits57.81180,000,000rm9gKDAyeY
4 word, constant separator, capitalize one58.65320,000,000gable-drought-Menthol-stun
12 char, with lowercase, digits60.00810,000,0008cjfqtzj7yx3
4 syl, digit separator, capitalize one65.1929,000,000,000ket5Nor0koul7toss
4 word, digit separator66.6179,000,000,000convoy2chant3calf9senorita
4 word, digit separator, capitalize one68.61310,000,000,000ultima2jagged9Absent7vishnu
5 word, constant separator70.811,400,000,000,000passion-ken-omit-verso-tortoise
5 word, digit separator84.1014,000,000,000,000,000slain9dynast5try6punch8licensee

How 1Password uses PBKDF2

1Password uses PBKDF2 in the process of deriving encryption keys from your account password. Learn more about the key derivation process in the 1Password Security Design White Paper   .

There are 650,000 iterations, or functions, of PBKDF2 in the current version of 1Password. This means anyone who tries to guess an account password needs to perform the same calculations. Any hacking attempts are virtually useless since your account password is combined with your Secret Key, which is only on your devices.

You still need a good password to protect you from an attacker who acquires your encrypted 1Password data from your device. Learn how to choose a good 1Password account password.

History of PBKDF2 in 1Password

1Password was the first password manager to use PBKDF2 with the introduction of the Agile Keychain format in 2007, which used PBKDF2-HMAC-SHA1.

Learn more

Published: