One of the most unfortunate things with the LastPass breach last year was that lots of accounts had the number of PBKDF2 iterations set to a low value (typically 1000). A low number of iterations makes brute forcing the master password easier.
This value would have been set when the user's account was created, and for older accounts it wouldn't have been increased unless users changed the setting manually.
LastPass is now setting it a lot higher by default, but that doesn't help the vaults leaked in the breach.
https://support.lastpass.com/s/document-item?language=en_US&...
The experience of one victim mentioned suggests it's economical to crack at least 50 bit entropy passwords for at most a $3.5 mil payout.
50 bits isn't great, but it's not terrible either.
(Edit: looked more in to how to calc password entropy. Luckily I'm good. Thanks a lot for this info tho.)
If you’re concerned Steve Gibson did a good rundown on the security now podcast