Mobile App Data-at-Rest (2D): PIN-Derived Key vs Offline Brute-Force

When a phone is lost or stolen, the only thing standing between an attacker and a mobile app's locally encrypted data is the key-derivation function protecting the encryption key — there is no server, no lockout counter, no network throttling to fall back on. This 2D multi-panel simulator models that exact offline scenario: pick a PIN length and character set to fix the keyspace, choose a key-derivation algorithm (PBKDF2-SHA256, scrypt or Argon2id) and its work factor, and pick the attacker's hardware tier, then watch the legitimate unlock latency and the attacker's offline guesses-per-second respond in real time across four linked panels — a pannable/zoomable guess-swarm field, a log-scale keyspace bar, the cost-vs-work-factor curve, and a live algorithm comparison chart. A memory-hard KDF like Argon2id resists parallel cracking hardware far better than PBKDF2 at the same work factor, and raising the work factor is always a direct trade against the app's own unlock speed — the same trade-off every mobile security engineer has to make when choosing how to protect local secure storage.