[throwaway15908]

But an attacker can never tell if the current guess to crack the token is the right one. Its just random noise in the end.

[pwg]

You have not explained how the token relates to decrypting the vault.

You have also not explained how the vault is encrypted (I'm assuming it is encrypted somehow, otherwise an attacker simply downloads the vault and has your credentials).

You can't expect us to give you anything but generic statements if you don't explain how your system works.

[throwaway15908]

Ok, fine. I still dont feel comfortable, but here is the link.

https://github.com/proxemy/dotfiles/blob/master/scripts/toke...

The vault is regular kdbx with an additional password file.

Thank you for your time btw.