It’s useless without the password. Master-Key in der Cloud?! - #10 by overheadhunter
Everything can be bruteforced. Its a matter of time and energy. But it unlikely because you need a lot of time and energy for Cryptomator. How Cruptomator is protected from Brute force attacks? - #2 by infeo
I recommend not to change the location of the Masterkey File.