4 ms·
You don't seem to understand the scale here. Normal, non-secure hash functions can be calculated at a rate of hundreds of millions per second, and can easily be
by taco_emoji 10y ago
You don't seem to understand the scale here. Normal, non-secure hash functions can be calculated at a rate of hundreds of millions per second, and can easily be brute-forced within a few hours. Current rule of thumb for PBKDF2 (for example) is to choose an iteration count corresponding to around two hashes per second, and the work is not parallelizable. That turns those hours of work into millenia.
If it really concerns you, proper practice is to store the iteration count alongside the hash and salt, so you can easily go through and add more iterations if you want as computers get faster.