Is password-based AES encryption secure at all? For a few years I have put all my passwords in a text file and encrypted that file with a password using a software solution (Axcrypt) which uses AES-128. The password is not really strong, but I thought AES encryption would make it strong somehow.

But it always bothered me how this can be secure and now that I have read a little about encryption it seems to me that this actually has nothing to do with AES encryption. Because when using a password instead of directly providing the key, the AES encryption becomes completely irrelevant. It doesn't matter anymore how many billion years it takes to crack AES because the only thing that now needs to be cracked is my password. The attacker finds my file, downloads Axcrypt, and bruteforce/dictionary attacks it until it's cracked. The attacker won't need to bruteforce my file with 128bit keys, he bruteforces it with passwords.

So I have two questions:


Am I right? Is it completely pointless to use passwords to AES encrypt files? 
Axcrypt website recommends using a 22-characters-long password to achieve 128 bit security. Will a 22 character password be as secure as a randomly generated key? How?


(I know the actual key is derived from the password with an algorithm. I just can't understand how a password can be secure. The very existence of a password means the attacker will no longer have to deal with AES and keys, only with passwords)
You are correct in that the best strategy for an adversary would be to guess the password, as opposed to cryptanalysis of AES plaintext/ciphertexts. However, this does not make encryption pointless - password based key derivation is a challenge unto itself, separate from encryption, but one that does have practical solutions. 

We can strengthen this weak link by making it require a large amount of time to derive the key from the password. If an adversary can only test a handful of passwords per second, then the probability that they will be able to crack a given password drops dramatically. 

Granted, this is not a perfect solution - You might need to derive your key on a slow, old computer, while your adversary might have access to a distributed network armed with GPUs and FPGAs. So there is a balance to be had between how long it takes you to derive your key (which must be quick enough) and how long it takes an adversary to guess passwords (which must be slow enough). 

Typically a duration of 1 second per derivation attempt is considered appropriate. However, the actual time duration required to compute a hash does not remain constant, even if you iterate the function a constant number of times. This is due to the way computing power scales with time - the iteration count you use to secure your password today may not protect you nearly as well in a few years.

As to whether or not a 22 character password is equivalent in strength to an 128 bit key, this is not a question that can be answered with a simple "yes" or "no" - for example, if your 22 character password is 1010101...10, then no, it absolutely does not have nearly as much entropy as a uniformly random 128 bit value. If your 22 character password consists of 3-4 english words with spacing, it does not have nearly as much entropy as a 128 bit random value.