{
    "name": "PBKDF2 Runtime Calculator",
    "url": "https://calculators.geekmidst.com/calculators/pbkdf2-runtime-calculator",
    "markdown": "https://calculators.geekmidst.com/calculators/pbkdf2-runtime-calculator.md",
    "category": "IT, networking & security",
    "description": "Estimate how long one PBKDF2 key derivation takes on your server from the iteration count and your measured HMAC rate, and how far it slows an attacker.",
    "summary": "PBKDF2 repeats HMAC once per iteration for each output block. Divide the total HMAC calls by the rate you benchmarked to get the time per login; divide an attacker’s rate by the iterations for their guesses per second.",
    "also_called": [
        "PBKDF2 iteration calculator",
        "Key stretching time calculator"
    ],
    "applies_to": "Worldwide",
    "last_updated": "2026-10-29",
    "computation": "Results are computed in the visitor’s browser on the HTML page. This API describes the calculator; it does not compute results.",
    "inputs": [
        {
            "name": "iterations",
            "label": "Iterations",
            "type": "number",
            "default": "600000"
        },
        {
            "name": "hash",
            "label": "HMAC hash",
            "type": "segmented",
            "default": "sha256",
            "options": {
                "sha1": "SHA-1",
                "sha256": "SHA-256",
                "sha512": "SHA-512"
            }
        },
        {
            "name": "dk_bytes",
            "label": "Derived key length",
            "type": "number",
            "default": "32",
            "unit": "bytes"
        },
        {
            "name": "server_rate",
            "label": "Your HMAC calls per second (one core)",
            "type": "number",
            "default": "2000000"
        },
        {
            "name": "attacker_rate",
            "label": "Attacker HMAC calls per second",
            "type": "number",
            "default": "10000000000"
        }
    ],
    "outputs": [
        {
            "key": "runtime_ms",
            "label": "Time per derivation",
            "format": "number"
        },
        {
            "key": "blocks",
            "label": "Output blocks",
            "format": "integer"
        },
        {
            "key": "hmac_calls",
            "label": "HMAC calls per derivation",
            "format": "integer"
        },
        {
            "key": "hashes_per_second_per_core",
            "label": "Logins per second per core",
            "format": "number"
        },
        {
            "key": "attacker_guesses_per_s",
            "label": "Attacker guesses per second",
            "format": "number"
        }
    ],
    "formula": {
        "text": "Blocks = ⌈Key length ÷ Hash length⌉;  HMAC calls = Iterations × Blocks;  Time = HMAC calls ÷ Your rate;  Attacker guesses/s = Attacker rate ÷ Iterations",
        "variables": {
            "Hash length": "20 bytes (SHA-1), 32 (SHA-256), 64 (SHA-512)",
            "Rates": "HMAC computations per second, measured or estimated"
        }
    },
    "worked_example": {
        "inputs": {
            "iterations": "600000",
            "hash": "sha256",
            "dk_bytes": "32",
            "server_rate": "2000000",
            "attacker_rate": "10000000000"
        },
        "steps": [
            "A 32-byte key from SHA-256 (32 bytes) needs 1 block, so 600,000 HMAC calls.",
            "600,000 ÷ 2,000,000 per second = 0.3 s = 300 ms per login.",
            "Attacker: 10¹⁰ ÷ 600,000 = 16,666.67 password guesses per second."
        ],
        "result": "With these rates, 600,000 iterations cost 300 ms per login and limit the attacker to about 16,700 guesses per second."
    },
    "interpretation": "Pick the highest iteration count your login latency and server capacity can carry, then re-benchmark as hardware improves. Memory-hard functions such as Argon2id or scrypt resist GPU attacks better than PBKDF2.",
    "assumptions": [
        "Each iteration costs one HMAC call; HMAC key padding is precomputed.",
        "Rates are entered by you and scale linearly."
    ],
    "limitations": [
        "Real runtime also depends on the implementation, CPU frequency scaling and concurrent load."
    ],
    "rules": null,
    "faqs": [
        {
            "question": "Why not ask for a longer key to make it slower?",
            "answer": "Asking for more bytes than the hash produces multiplies your cost, but an attacker can usually test a guess using the first block alone, so it gives no extra protection."
        },
        {
            "question": "Is SHA-512 slower than SHA-256?",
            "answer": "Per call on 64-bit CPUs, often not by much; on GPUs it is relatively slower. Benchmark the one you use and enter that rate."
        }
    ],
    "sources": [],
    "related": [
        {
            "name": "Password Brute-Force Time Calculator",
            "url": "https://calculators.geekmidst.com/calculators/password-brute-force-time-calculator"
        },
        {
            "name": "Password Entropy Calculator",
            "url": "https://calculators.geekmidst.com/calculators/password-entropy-calculator"
        },
        {
            "name": "Password Generator",
            "url": "https://calculators.geekmidst.com/calculators/password-generator"
        }
    ],
    "disclaimer": null,
    "publisher": "GM¹X CalcVerse"
}