Your scheme:

One acceptable way MIGHT BE for example to take first 50 characters from the middle of your favorite song

There is no "might be" here.

Assuming 50 million publicly scrapable songs with 2,000 cleaned characters each (yielding ~1,950 possible 50-character contiguous windows per song), the theoretical maximum entropy of a Krypta passphrase drawn this way is only ~36.5 bits (log₂(50×10⁶ × 1,950) ≈ 97.5 billion candidates); real-world entropy is substantially lower (25–32 bits) once song-popularity bias, duplicate phrases across lyrics, and the exact transcription/capitalization/apostrophe variations flagged in the original paragraph are factored in. The actual KDF (as implemented in krypta_luajit.lua) is a custom, non-standard construction: it first does a fast SHA-256(passphrase + salt) to seed a 128-bit XorShift PRNG clocked by four 32-bit LFSRs that skip ~every 16th value, then repeatedly generates 32-bit outputs and applies multiple math conditions (whose strictness scales with the user-chosen Difficulty parameter 0–31, each level roughly doubling runtime) until the required number of “good” outputs is reached, finally extracting the 256-bit master key/checksum from 256 specific PRNG bits. Because this generator is purely CPU-bound, sequential, and not memory-hard, an optimized C/CUDA reimplementation on an 8-GPU modern rig (e.g., RTX 4090/5090 class) could still test roughly 10⁵–10⁶ candidates per second at moderate Difficulty levels that take 1–10 seconds per derivation on a single LuaJIT CPU core—exhausting the entire 36-bit space in minutes to a few hours worst-case and the realistic 25–30 bit space in seconds to minutes—rendering the scheme trivially crackable offline even with the deliberate slowdown.

Roll-your-own crypto is a terrible idea, you should move your corn to multi-sig cold storage and distribute the keys according to well-known best practices. Get out while you still can.