CalcVerse

PBKDF2 Runtime Calculator

PBKDF2 repeats HMAC once per iteration for each output block. Divide the total HMAC calls by the rate you benchmarked to get the time per login; divide an attacker’s rate by the iterations for their guesses per second.

Also called: PBKDF2 iteration calculator · Key stretching time calculator

  • Last updated
  • Formula tested against reference values

Your numbers

Example value. Check current guidance (e.g. OWASP Password Storage Cheat Sheet) for your hash.

HMAC hash

Example value: benchmark your own server, e.g. time 1,000,000 iterations.

Example value for a GPU rig. Enter your own threat model.

Result

Time per derivation
—ms

Calculating…

Output blocks
—
HMAC calls per derivation
—
Logins per second per core
—
Attacker guesses per second
—

How to use this calculator

  1. Enter or choose iterations.
  2. Enter or choose hMAC hash.
  3. Enter or choose derived key length.
  4. Enter or choose your HMAC calls per second (one core).
  5. Enter or choose attacker HMAC calls per second.
  6. The time per derivation updates as you type. Use Copy result or Share to keep it.

Method

Blocks = ⌈Key length ÷ Hash length⌉; HMAC calls = Iterations × Blocks; Time = HMAC calls ÷ Your rate; Attacker guesses/s = Attacker rate ÷ Iterations

Hash length
20 bytes (SHA-1), 32 (SHA-256), 64 (SHA-512)
Rates
HMAC computations per second, measured or estimated

Worked example

  1. A 32-byte key from SHA-256 (32 bytes) needs 1 block, so 600,000 HMAC calls.
  2. 600,000 ÷ 2,000,000 per second = 0.3 s = 300 ms per login.
  3. Attacker: 10¹⁰ ÷ 600,000 = 16,666.67 password guesses per second.

With these rates, 600,000 iterations cost 300 ms per login and limit the attacker to about 16,700 guesses per second.

What the result means

Pick the highest iteration count your login latency and server capacity can carry, then re-benchmark as hardware improves. Memory-hard functions such as Argon2id or scrypt resist GPU attacks better than PBKDF2.

Assumptions and limits

  • Each iteration costs one HMAC call; HMAC key padding is precomputed.
  • Rates are entered by you and scale linearly.
  • Real runtime also depends on the implementation, CPU frequency scaling and concurrent load.

Questions

Why not ask for a longer key to make it slower?

Asking for more bytes than the hash produces multiplies your cost, but an attacker can usually test a guess using the first block alone, so it gives no extra protection.

Is SHA-512 slower than SHA-256?

Per call on 64-bit CPUs, often not by much; on GPUs it is relatively slower. Benchmark the one you use and enter that rate.