PBKDF2 vs Argon2 - which is better?

  1. There is no reason to delay switching to Argon2id (unless you are using old devices that are significantly underpowered, or if your favorite browsers do not support WebAssembly).

  2. Your master password may or may not be sufficiently strong, depending on how it was created. If the two words were randomly selected from a diceware-type list (7776 words), and then supplemented with a random character string consisting of around 5 characters (mixed-case alphanumeric, plus special characters), then you should have sufficient entropy to protect your vault. However, if the words (and the added characters) were not selected with the help of a random number generator (or dice!), then your master password will not be sufficiently strong to withstand a brute-force attack.