# PBKDF2 Runtime Calculator

> Estimate how long one PBKDF2 key derivation takes on your server from the iteration count and your measured HMAC rate, and how far it slows an attacker.

Category: IT, networking & security · Applies to: Worldwide · Last updated: 2026-10-29
Interactive calculator: https://calculators.geekmidst.com/calculators/pbkdf2-runtime-calculator

PBKDF2 repeats HMAC once per iteration for each output block. Divide the total HMAC calls by the rate you benchmarked to get the time per login; divide an attacker’s rate by the iterations for their guesses per second.

Also called: PBKDF2 iteration calculator, Key stretching time calculator.

## Inputs
- Iterations (default 600000)
- HMAC hash (options: SHA-1, SHA-256, SHA-512; default sha256)
- Derived key length (unit bytes; default 32)
- Your HMAC calls per second (one core) (default 2000000)
- Attacker HMAC calls per second (default 10000000000)

## Results
- Time per derivation
- Output blocks
- HMAC calls per derivation
- Logins per second per core
- Attacker guesses per second

## Formula

```
Blocks = ⌈Key length ÷ Hash length⌉;  HMAC calls = Iterations × Blocks;  Time = HMAC calls ÷ Your rate;  Attacker guesses/s = Attacker rate ÷ Iterations
```

Where:
- Hash length: 20 bytes (SHA-1), 32 (SHA-256), 64 (SHA-512)
- Rates: HMAC computations per second, measured or estimated

## Worked example
1. A 32-byte key from SHA-256 (32 bytes) needs 1 block, so 600,000 HMAC calls.
2. 600,000 ÷ 2,000,000 per second = 0.3 s = 300 ms per login.
3. Attacker: 10¹⁰ ÷ 600,000 = 16,666.67 password guesses per second.

**Result:** With these rates, 600,000 iterations cost 300 ms per login and limit the attacker to about 16,700 guesses per second.

## What the result means

Pick the highest iteration count your login latency and server capacity can carry, then re-benchmark as hardware improves. Memory-hard functions such as Argon2id or scrypt resist GPU attacks better than PBKDF2.

## Assumptions and limits
- Each iteration costs one HMAC call; HMAC key padding is precomputed.
- Rates are entered by you and scale linearly.
- Real runtime also depends on the implementation, CPU frequency scaling and concurrent load.

## Questions

### Why not ask for a longer key to make it slower?

Asking for more bytes than the hash produces multiplies your cost, but an attacker can usually test a guess using the first block alone, so it gives no extra protection.

### Is SHA-512 slower than SHA-256?

Per call on 64-bit CPUs, often not by much; on GPUs it is relatively slower. Benchmark the one you use and enter that rate.

## Related calculators
- [Password Brute-Force Time Calculator](https://calculators.geekmidst.com/calculators/password-brute-force-time-calculator)
- [Password Entropy Calculator](https://calculators.geekmidst.com/calculators/password-entropy-calculator)
- [Password Generator](https://calculators.geekmidst.com/calculators/password-generator)

Source: GM¹X CalcVerse — https://calculators.geekmidst.com/calculators/pbkdf2-runtime-calculator