Home / Knowledge hub / PBKDF2
Knowledge hub
PBKDF2
An older password hashing method that repeats a hash many thousands of times.
What it means
PBKDF2 stands for Password-Based Key Derivation Function 2. It takes a password and a salt, then runs a hash or HMAC over them again and again, often hundreds of thousands of times. The result is stored instead of the password itself.
The repetition is the point. A single hash is so quick that an attacker with a stolen database can try billions of guesses. Each extra round multiplies the work for them, and for you, so a guess costs real time rather than almost none.
Why it matters
If your user table leaks, the hashing method decides how many of your customers' passwords are cracked by the weekend. Weak or unsalted hashes fall to common-word lists within hours. A well-tuned slow method buys time to force resets before the damage spreads.
PBKDF2 is old and widely supported, and it is often the choice when a compliance rule requires approved algorithms. It uses little memory, though, so attackers can run it cheaply on graphics cards. That is why newer designs such as Argon2 are preferred when you have the choice.
How it shows up
You meet it in framework defaults, older user tables and anything built around FIPS-approved algorithms. The stored value usually carries the algorithm name, the round count and the salt in one string, which makes it easy to see what an old account is using.
The mistakes repeat. A round count set years ago and never raised. A fast hash like plain SHA-256 where PBKDF2 was meant. One shared salt for everyone. Or no plan to upgrade old hashes at the next sign-in. Check the count against current OWASP guidance and see how old accounts get migrated.
Questions people ask
PBKDF2, answered
Is PBKDF2 still safe to use?
Yes, if the round count is high enough and each password has its own salt. OWASP lists it as acceptable where FIPS compliance is required.
If you are free to choose, OWASP prefers Argon2id, then scrypt, because they also make attackers spend memory.
How many iterations should PBKDF2 use?
Follow the current figure in the OWASP Password Storage Cheat Sheet, which depends on the underlying hash. For PBKDF2 with HMAC-SHA-256 it runs to hundreds of thousands.
Treat the number as something you revisit, because hardware gets faster every year.
What is the difference between PBKDF2 and bcrypt?
Both are deliberately slow and salted. bcrypt is built on a different cipher and has a 72-byte input limit in most implementations.
PBKDF2 is defined in a public standard, RFC 8018, and is easier to get approved in regulated settings.
Can PBKDF2 be used to make encryption keys?
Yes, that is what the name says. It turns a passphrase into a key of the length you need, which is useful for encrypting files with a password.
The same salt and iteration rules apply, and the salt must be stored beside the output.
How do we test whether our hashing is weak?
Look at the stored hashes and the code that creates them: algorithm, round count, salt handling. A database copy is not needed for that.
A pentest can also show whether a sign-in flow leaks which accounts exist or allows unlimited guessing, which makes hashing strength matter more.
Sources
Where this comes from
Related
Terms that sit next to this one
Salt
Random data added to each password before hashing so identical passwords differ.
Argon2
A modern password hashing function that is slow and memory-hungry on purpose.
bcrypt
A deliberately slow password hashing function with a built-in salt.
Hashing
A one-way transformation, so a password can be checked but never read back.
Key derivation function (KDF)
A function that turns a password or secret into a strong, fixed-size key.
How slow is slow enough?
Weak password storage, missing rate limits and sign-in flows that reveal which accounts exist all fall within what we test, and each finding comes with the exact request. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.