Keep the cost of guessing high.

New Vault files use Argon2id with 64 MiB, three passes and one lane. These settings are stored in the KDBX4 header and travel with your encrypted file. This release keeps those parameters unchanged.

Measured here, not everywhere

September 21, 2026 · Apple M3 · macOS arm64 · Node 24.21.0. Five unlocks of an empty synthetic vault: median 219.4 ms, maximum 222.4 ms. Process peak resident memory: 136 MiB. That is a process high-water mark, not isolated Argon2 memory.

Read the raw aggregate measurements · Run the local browser benchmark

Physical 2 GB Android and old-laptop results are still pending. This Mac result does not establish a two-second guarantee for those devices.

The hardened import path independently authenticates the final empty KDBX block. With the current library API that performs a second KDF; these measurements include that cost. The on-disk parameters remain 64 MiB / three passes.

Before adapting anything

Run the same synthetic test on physical devices with device model, RAM, OS, runtime and battery mode recorded manually.
Measure at least five cold and five warm unlocks, total resident memory and failure behavior under memory pressure, then test a representative large vault.
Keep 64 MiB / three passes if the slowest supported device meets the target. If it fails, review measured alternatives and their attack-cost tradeoffs before changing creation defaults.
Never silently weaken an existing vault or downgrade parameters merely because a tab was slow. Any future profile must remain within documented KDBX compatibility limits and pass external-client round trips.

The browser benchmark runs only when you choose it. It uses sample data, opens no stored vault, and sends no results. Security parameter changes are not part of that test.