[p0w3n3d]

How long should the password be to make this safe from brute force attack?

[mthoms]

The FAQ recommends a minimum of 16 chars. Obviously it depends on your threat model.

[yoble]

Especially with 600k PDBKF2 iterations, 16 alphanum chars should be very safe.

There's a (warning: very detailed) issue covering the topic of PBKDF2 iterations and password length over here, if you feel like diving into that rabbit hole: https://github.com/robinmoisson/staticrypt/issues/159