I am encrypting my computer using Veracrypt. The default 500,000 derivations is quite slow, what would a "safe" balance be between security and speed? My password is more than 20 characters.
VeraCrypt tries each hash and cipher combination with your supplied password if PKCS5-PRF is set to auto-detection on the
enter password screen, i.e. it will try all. It will work until one of them work. It can do this in parallel. In the end, if none is working it will inform you that your password is incorrect.
Change it to the PKCS5-PRF that you selected during the setting the volume, it will not test the others. That will decrease the time.
In the attacker's eye, this will slow them, since they have to try all for each candidate passwords during brute-forcing possible passwords.
Also, the 500,000 derivations is important against the password crackers. The higher the better and it will affect the attacker's time linearly. In recent years their capabilities are highly increased.
You could see each iteration as a try to verify passphrase. In that case you can simply take the 2-log of the number of iterations to see how many bits of security are added. So $\log_2(50000) = 15.6$ bits of security, which can more or less be added to the strength. A million repetition ads about $19.9$ bits of security.
Now a good password phrase with 4 words has around 40 bits of entropy (depending on the scheme and the actual passphrase of course). So the total would be around 60 bits for a million iterations. These are all "somewhere in this ballpark" figures, and password strength is a tricky subject. But if you think of it this way then you can at least make more informed decisions. Some kind of evaluation of strength is paramount.
As you may note, none of the schemes will likely give you anywhere near the (minimum) strength of 112 bits required most of the time for symmetric ciphers. This is why password based key derivation is frowned upon in general. And this is also why anybody that uses triple Veracrypt encryption with a passphrase kept in memory is fooling themselves.
Using a key pair with the private decryption key encrypted with a password is much stronger, especially if access to said private key is limited. It also allows you to encrypt without a passphrase. Of course, the drawback is that you need access to the keys and a computing device, where there may not be one...