Question 1

How many iterations should I use?

Accepted Answer

OWASP 2024 recommends 600,000 iterations for PBKDF2-HMAC-SHA256, 210,000 for PBKDF2-HMAC-SHA512. Lower values are forbidden by current guidance — older recommendations of 1,000 or 10,000 iterations no longer provide meaningful protection against modern GPU brute-force. Higher iteration counts are fine as long as you can tolerate the login latency. Django 5.1 defaults to 870,000 iterations.

Question 2

Is PBKDF2 a good password hashing algorithm?

Accepted Answer

PBKDF2 is the slowest of the four major password hashing algorithms (PBKDF2, bcrypt, scrypt, Argon2) when run against a GPU. It uses only computation, no memory — that makes it easy to parallelize on GPUs and ASICs. Argon2 and scrypt require memory, which makes parallel attacks much more expensive. Bcrypt sits in the middle. Use PBKDF2 when you specifically need FIPS-validated cryptography (it's the only one of the four that's NIST-approved per SP 800-132) or when interoperability with legacy systems requires it. For new systems, Argon2id is the OWASP first choice.

Question 3

Why does PBKDF2 need a salt?

Accepted Answer

Without a salt, two users with the same password produce the same hash — a single rainbow table attack can crack all of them at once. A unique salt per password makes precomputed tables useless and forces the attacker to brute-force each password independently. The salt doesn't need to be secret — it's typically stored alongside the hash in plaintext. What matters is that it's unique per password and at least 16 bytes (128 bits) of random data. This tool generates 16-byte salts via crypto.getRandomValues.

PBKDF2 Generator

Frequently Asked Questions