What iteration count does OWASP recommend for PBKDF2?

For PBKDF2-HMAC-SHA256, OWASP recommends at least 600,000 iterations to withstand high-performance GPU and ASIC password cracking clusters.

Are my passwords sent over the network?

No. All key derivation and hashing routines utilize the W3C Web Cryptography API directly in your browser. Zero passwords or hashes are transmitted.

Password Hasher & Verifier WebCrypto API

Derive salted cryptographic password hashes with OWASP-compliant iterations and evaluate entropy crack-times.

Plaintext Password 0 chars

Strength: Very Strong

Entropy: 78 bits

Crack Time: ~10,000 centuries

Algorithm

Iterations (OWASP Recommended)

Cryptographic Salt Generate Random 16B Salt

PHC Formatted Hash String -

Click 'Compute Password Hash' to generate...

Frequently Asked Questions

What is the PHC string format?

The Password Hashing Competition (PHC) format standardizes how password hashes store algorithm metadata, iteration counts, salt bytes, and derived hashes (e.g. $pbkdf2-sha256$i=600000$salt$hash) in a single portable string.

Why does PBKDF2 require hundreds of thousands of iterations?

Modern graphics cards (GPUs) can evaluate billions of simple hashes per second. Adding 600,000 iterations forces crackers to spend substantial compute time on each attempt, rendering dictionary attacks impractical.