Work out pbkdf2 iteration count instantly with clear inputs, formula shown and shareable results.
PBKDF2 buys resistance by repeating a fast hash many times, so the iteration count is chosen to consume a tolerable amount of server time — typically 200 to 500 ms. The attacker's effective guess rate is their raw hash rate divided by the iteration count, which is why iterations must rise as hardware improves. OWASP currently recommends 600,000 iterations for PBKDF2-HMAC-SHA256.
PBKDF2 tuning
iterations = hash rate x target time; attacker guesses per second = attacker hash rate / iterations
PBKDF2 uses negligible memory, so GPUs and ASICs parallelise it cheaply. Memory-hard functions such as Argon2id and scrypt raise the attacker's cost per guess far more effectively.
You can only rehash on next successful login, since the plaintext is required. Store the iteration count with each hash so old and new records verify correctly.