Pick a PBKDF2 iteration count from a target login delay, then check it against the OWASP floor and an attacker's GPU rig.
PBKDF2 cost is purely linear in the iteration count, so you set it by dividing the delay you can afford by the cost of one iteration. Because the same linear factor slows the attacker, doubling iterations doubles their cracking time — but it buys nothing against custom hardware, which is why memory-hard KDFs replaced it. OWASP's 2024 floors are 600,000 iterations for PBKDF2-HMAC-SHA-256 and 210,000 for SHA-512; anything materially below that leaves a stolen hash database economically crackable.
PBKDF2 Iteration
iterations = target seconds × server iterations per second; attacker guesses per second = rig hash rate ÷ iterations.
Offline cracking time
crack time = 2^(entropy − 1) ÷ guesses per second, using half the keyspace on average.
iterations = target seconds × server iterations per second; attacker guesses per second = rig hash rate ÷ iterations. PBKDF2 cost is purely linear in the iteration count, so you set it by dividing the delay you can afford by the cost of one iteration. Because the same linear factor slows the attacker, doubling iterations doubles their cracking time — but it buys nothing against custom hardware, which is why memory-hard KDFs replaced it.
OWASP's 2024 floors are 600,000 iterations for PBKDF2-HMAC-SHA-256 and 210,000 for SHA-512; anything materially below that leaves a stolen hash database economically crackable.
This calculator takes 5 inputs: PBKDF2 pseudorandom function, Server PBKDF2-SHA-256 iterations per second (one core), Target derivation time, Attacker rig raw hash rate, Password entropy. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
One PBKDF2-HMAC-SHA-512 iteration costs roughly twice as much as SHA-256 on 64-bit hardware, so 210,000 SHA-512 iterations impose about the same work as 600,000 SHA-256 iterations. SHA-512 also resists GPU acceleration slightly better.
Only where FIPS 140 validation forces it. Argon2id or bcrypt should be the default because PBKDF2 needs almost no memory, which lets GPUs and ASICs run tens of thousands of guesses in parallel.