Password managers do not encrypt your vault with the master password string directly. They run a key derivation function (KDF) that stretches a password into a cryptographic key, then use that key with a cipher such as AES-GCM. Two KDFs you will see often are PBKDF2 and Argon2id. AzAd Vault uses Argon2id. Here is what that choice means in plain language.
What PBKDF2 does well
PBKDF2 (Password-Based Key Derivation Function 2) applies a pseudorandom function such as HMAC-SHA-256 many times. Iteration count is the main cost knob. It is widely supported, standardized, and easy to implement across platforms. Many mature products still use PBKDF2 with high iteration counts, which remains meaningful protection when parameters are strong and salts are unique.
The limitation is that PBKDF2 is primarily CPU-bound. Attackers with GPUs or ASICs can often try guesses faster than a laptop can, so defenders raise iterations aggressively. That helps — but memory hardness is not PBKDF2’s strength.
What Argon2id adds
Argon2id won the Password Hashing Competition. It is designed to be costly in both time and memory, and the “id” hybrid resists certain side-channel and parallel-attack trade-offs better than pure data-dependent or data-independent variants alone. In practice, cracking farms that thrived on cheap GPU PBKDF2 attempts face higher memory requirements per guess.
Parameters still matter: memory size, iterations (or time cost), and parallelism must be set for the devices you support. Too aggressive and unlock feels sluggish on older phones; too weak and you leave margin on the table. Vendors should document defaults and keep them current as hardware evolves.
Salt and authenticated encryption
Regardless of KDF, each vault should use a unique salt so identical master passwords do not produce identical derived keys across users. After derivation, AzAd Vault encrypts payloads with AES-256-GCM, which provides confidentiality and integrity (tampering should fail decryption rather than yield silent corruption).
For more on the overall model, read what zero-knowledge encryption means and the security page.
Does KDF choice decide which manager to buy?
Prefer Argon2id or another modern memory-hard KDF when available, but do not ignore everything else. Platform fit, offline usability, clear free limits, honest recovery story, and sync design matter as much as the acronym on a marketing slide. A strong KDF with a weak master password still fails. A solid KDF with careless device hygiene still fails.
AzAd Vault combines Argon2id with on-device encryption, optional Google Drive ciphertext sync, and a concrete free allowance (500 items / 20 labels / 10 TOTP). Premium via Google Play expands limits and Chrome passkeys — not a different cryptography story. If you are comparing vendors, ask for KDF name, cipher mode, and whether plaintext ever hits their servers.
Bottom line: PBKDF2 with high iterations can still be acceptable; Argon2id is a stronger modern default for new systems. AzAd Solutions chose Argon2id so offline guessing is expensive in time and memory, then wrapped vault data in AES-256-GCM before any optional sync leaves your device.
Parameters beat buzzwords
Saying “we use Argon2id” is necessary but not sufficient. Memory cost, time cost, and parallelism must fit real devices. Unlock on a mid-range Android phone should finish quickly enough that users do not disable encryption features out of frustration. Windows desktops can usually afford higher costs; mobile sets the floor.
PBKDF2 with hundreds of thousands of iterations can still be responsible engineering when Argon2 is unavailable on a legacy stack. Conversely, Argon2id with tiny memory settings can underperform a carefully tuned PBKDF2. When you evaluate vendors, ask for current parameter ranges — not only the algorithm name on a landing page.
Interop and migration concerns
Changing KDFs mid-flight requires re-wrapping keys or re-encrypting vaults. Products document migration
carefully so older backups remain openable. AzAd Vault standardizes on Argon2id for current vaults;
keep encrypted .azvault backups when you upgrade apps so you can roll forward deliberately.
Importing from another manager does not import their KDF — you create a new AzAd Vault under your master password and algorithms. After import, the security properties are AzAd Vault’s, which is why verifying a few logins after migration matters more than matching competitor iteration folklore.
How this connects to everyday advice
The strongest KDF cannot rescue a four-word celebrity passphrase. Use a long random password or a high-entropy passphrase from a local generator. Combine Argon2id’s resistance with unique site passwords, TOTP or passkeys, and device lock screens. That stack — not a single acronym — is what “modern cryptography” means for households.
A note on checksums and integrity
KDF choice protects against password guessing on stolen ciphertext. Authenticated encryption (AES-GCM) protects against silent modification of that ciphertext. You want both. Hash algorithms used for file checksums are a different tool — do not confuse SHA-256 file hashing with password-based KDFs.
When AzAd Vault decrypts successfully, you gain confidence the blob matches what your key unlocks. Failed unlocks after a correct password may indicate corruption, wrong file, or truncated sync — restore from an older encrypted backup rather than repeatedly forcing guesses.