You can check the password iterations settings in your LastPass vault by going to Settings > Advanced Settings and scrolling down to Password Iterations.

That means when you enter your master password to unlock your vault, your computer has to run through the PBKDF process 100,100 times before your data is available.Īt least that is the theory - unfortunately it appears that a flaw in LastPass’ design means that when the default number of interations was increased, this was only applied to new customer accounts - existing customers were left using whatever was the default when they signed up.įor me, as a long time LastPass customer, I checked by vault settings today the PBKDF iterations was set to 500 - just 0.005% as strong as LastPass recommends for new customers - which itself is way less than the 300,000 iterations recommended by OWASP. Then less than a year later is was increased again to 5000 and then in February 2018 it was changed to 100,100 iterations.

LastPass changed the number of times the data was hashed from 1 to 500 in 2012. So the simple answer was to run the encryption multiple times.

But as computers got faster it became more viable to try to guess all possible permutations and the execution of the encryption function got quicker. In the olden days - back in the early 2000, computers were slow and passing your data through the PBKDF once was enough to consider it secure. The key factor in protecting encrypted data from a brute force attack (guessing all possible password variations) is the number of times the data is hashed (encrypted) using an algorythm called PBKDF. Further revelations relating to the LastPass Hack in December 2022 indicate that customers who have been using LastPass for longer are more at risk as the encryption applied to their vault has not been updated and improved over time in the way it was for new customers signing up for the service.

Lastpass encryption