PBKDF2 Iteration Calculator
Pick a PBKDF2 iteration count from a target login delay, then check it against the OWASP floor and an attacker's GPU rig.
About PBKDF2 Iteration Calculator
PBKDF2 cost is purely linear in the iteration count, so you set it by dividing the delay you can afford by the cost of one iteration. Because the same linear factor slows the attacker, doubling iterations doubles their cracking time — but it buys nothing against custom hardware, which is why memory-hard KDFs replaced it. OWASP's 2024 floors are 600,000 iterations for PBKDF2-HMAC-SHA-256 and 210,000 for SHA-512; anything materially below that leaves a stolen hash database economically crackable.
Formulas
PBKDF2 Iteration
iterations = target seconds × server iterations per second; attacker guesses per second = rig hash rate ÷ iterations.
- iterations
- PBKDF2 c parameter
- target seconds
- Login delay you are willing to pay
- rig hash rate
- Raw PRF calls per second on the attacker's hardware
Offline cracking time
crack time = 2^(entropy − 1) ÷ guesses per second, using half the keyspace on average.
Worked example
With the default values below, PBKDF2 Iteration Calculator returns Recommended Iterations of 750,000. Change any input above and every figure here is recalculated in your browser.
Inputs used
- PBKDF2 pseudorandom functionone of PBKDF2-HMAC-SHA-1, PBKDF2-HMAC-SHA-256, PBKDF2-HMAC-SHA-512
- PBKDF2-HMAC-SHA-256
- Server PBKDF2-SHA-256 iterations per second (one core)minimum 10,000 iter/s
- 3,000,000 iter/s
- Target derivation timeaccepts 10–5,000 ms
- 250 ms
- Attacker rig raw hash rateminimum 1,000,000 hash/s
- 10,000,000,000 hash/s
- Password entropyaccepts 10–128 bits
- 40 bits
Results
- Recommended Iterations
- 750,000
- Resulting Derivation Time
- 250.0 ms
- OWASP 2024 Minimum
- 600,000 iterations
- Attacker Guesses per Second
- 13,333
- Crack Time (log₁₀ years)
- 0.1
- Assessment
- Meets the OWASP floor of 600000 iterations
Step by step
- 1Values used
- 2PBKDF2 Iteration
- 3Offline cracking time
- 4Recommended Iterations= 750,000
- 5Resulting Derivation Time= 250.0 ms
- 6OWASP 2024 Minimum= 600,000 iterations
- 7Attacker Guesses per Second= 13,333
- 8Crack Time (log₁₀ years)= 0.1
- 9Assessment= Meets the OWASP floor of 600000 iterations
Assumptions and limits
- The result is derived only from the 5 inputs listed above. Anything not among them is not part of the calculation.
- In particular, this calculator does not take inflation, fees or charges or compounding frequency into account.
- Figures are rounded for display to 1 decimal place, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.
How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.
Frequently Asked Questions
How is PBKDF2 Iteration calculated?
iterations = target seconds × server iterations per second; attacker guesses per second = rig hash rate ÷ iterations. PBKDF2 cost is purely linear in the iteration count, so you set it by dividing the delay you can afford by the cost of one iteration. Because the same linear factor slows the attacker, doubling iterations doubles their cracking time — but it buys nothing against custom hardware, which is why memory-hard KDFs replaced it.
Why does PBKDF2 Iteration matter?
OWASP's 2024 floors are 600,000 iterations for PBKDF2-HMAC-SHA-256 and 210,000 for SHA-512; anything materially below that leaves a stolen hash database economically crackable.
What values do I need to enter?
This calculator takes 5 inputs: PBKDF2 pseudorandom function, Server PBKDF2-SHA-256 iterations per second (one core), Target derivation time, Attacker rig raw hash rate, Password entropy. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Why does SHA-512 need fewer iterations?
One PBKDF2-HMAC-SHA-512 iteration costs roughly twice as much as SHA-256 on 64-bit hardware, so 210,000 SHA-512 iterations impose about the same work as 600,000 SHA-256 iterations. SHA-512 also resists GPU acceleration slightly better.
Should I use PBKDF2 for new systems?
Only where FIPS 140 validation forces it. Argon2id or bcrypt should be the default because PBKDF2 needs almost no memory, which lets GPUs and ASICs run tens of thousands of guesses in parallel.