# What is PBKDF2?

> A standard algorithm that turns a password into a cryptographic key by hashing it many thousands of times to slow attackers down.

Last reviewed: 2026-09-01

## PBKDF2

Category: Cryptography

Also called: Password-Based Key Derivation Function 2

Canonical page: https://moolkey.com/glossary/pbkdf2

PBKDF2 is a key derivation function that converts a password into a cryptographic key by applying a hash function repeatedly, commonly 600,000 times. The repetition is the point: it costs you a fraction of a second once and makes an attacker pay that delay for every guess.

### Why the iteration count matters

Each doubling of the iteration count halves an attacker's guessing rate. Going from 1,000 iterations to 600,000 slows them by a factor of 600, which is worth roughly nine extra bits of password entropy without the user changing anything.

OWASP currently recommends at least 600,000 iterations for PBKDF2-HMAC-SHA256. Older software using 1,000 or 10,000 iterations is measurably weaker against modern GPUs.

### PBKDF2 versus bcrypt, scrypt, and Argon2

PBKDF2 is compute-hard but not memory-hard, which means specialised hardware can parallelise it efficiently. Argon2id and scrypt additionally require large amounts of memory per guess, which frustrates that hardware. PBKDF2's advantage is universal availability: it is built into the Web Crypto API in every browser, so it runs client-side with no dependencies.

Further reading: [Why 600,000 iterations](https://moolkey.com/blog/pbkdf2-600k-iterations-explained)

### Sources

- [OWASP: Password Storage Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html): Practical guidance for salts, peppers, PBKDF2, Argon2id, and password hashes.
- [NIST: Computer Security Resource Center glossary](https://csrc.nist.gov/glossary): Canonical terminology used across US computer security guidance.