PBKDF2 Iteration Calculator
Pick a PBKDF2 iteration count from a target login delay, then check it against the OWASP floor and an attacker's GPU rig.
Inputs
Recommended Iterations
750,000
Resulting Derivation Time
250.0ms
OWASP 2024 Minimum
600,000iterations
Attacker Guesses per Second
13,333
Crack Time (log₁₀ years)
0.1
Assessment
Meets the OWASP floor of 600000 iterations
Step by step
Values used
PBKDF2 pseudorandom function = PBKDF2-HMAC-SHA-256; Server PBKDF2-SHA-256 iterations per second (one core) = 3,000,000 iter/s; Target derivation time = 250 ms; Attacker rig raw hash rate = 10,000,000,000 hash/s; Password entropy = 40 bits
PBKDF2 Iteration
iterations = target seconds × server iterations per second; attacker guesses per second = rig hash rate ÷ iterations.
Offline cracking time
crack time = 2^(entropy − 1) ÷ guesses per second, using half the keyspace on average.
Recommended Iterations
= 750,000
Resulting Derivation Time
= 250.0 ms
OWASP 2024 Minimum
= 600,000 iterations
Attacker Guesses per Second
= 13,333
Crack Time (log₁₀ years)
= 0.1
Assessment
= Meets the OWASP floor of 600000 iterations
How it works
PBKDF2 cost is purely linear in the iteration count, so you set it by dividing the delay you can afford by the cost of one iteration. Because the same linear factor slows the attacker, doubling iterations doubles their cracking time — but it buys nothing against custom hardware, which is why memory-hard KDFs replaced it. OWASP's 2024 floors are 600,000 iterations for PBKDF2-HMAC-SHA-256 and 210,000 for SHA-512; anything materially below that leaves a stolen hash database economically crackable.
Formulas
PBKDF2 Iteration
iterations = target seconds × server iterations per second; attacker guesses per second = rig hash rate ÷ iterations.
- iterations
- PBKDF2 c parameter
- target seconds
- Login delay you are willing to pay
- rig hash rate
- Raw PRF calls per second on the attacker's hardware
Offline cracking time
crack time = 2^(entropy − 1) ÷ guesses per second, using half the keyspace on average.
Frequently Asked Questions
How is PBKDF2 Iteration calculated?
iterations = target seconds × server iterations per second; attacker guesses per second = rig hash rate ÷ iterations. PBKDF2 cost is purely linear in the iteration count, so you set it by dividing the delay you can afford by the cost of one iteration. Because the same linear factor slows the attacker, doubling iterations doubles their cracking time — but it buys nothing against custom hardware, which is why memory-hard KDFs replaced it.
Why does PBKDF2 Iteration matter?
OWASP's 2024 floors are 600,000 iterations for PBKDF2-HMAC-SHA-256 and 210,000 for SHA-512; anything materially below that leaves a stolen hash database economically crackable.
What values do I need to enter?
This calculator takes 5 inputs: PBKDF2 pseudorandom function, Server PBKDF2-SHA-256 iterations per second (one core), Target derivation time, Attacker rig raw hash rate, Password entropy. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Why does SHA-512 need fewer iterations?
One PBKDF2-HMAC-SHA-512 iteration costs roughly twice as much as SHA-256 on 64-bit hardware, so 210,000 SHA-512 iterations impose about the same work as 600,000 SHA-256 iterations. SHA-512 also resists GPU acceleration slightly better.
Should I use PBKDF2 for new systems?
Only where FIPS 140 validation forces it. Argon2id or bcrypt should be the default because PBKDF2 needs almost no memory, which lets GPUs and ASICs run tens of thousands of guesses in parallel.