100ms in table: PBKDF2-HMAC-SHA256 with an iteration count of 86,000; 5s: PBKDF2-HMAC-SHA256 with an iteration count of 4,300,000 (see page 13). If you're usin

100ms in table: PBKDF2-HMAC-SHA256 with an iteration count of 86,000; 5s: PBKDF2-HMAC-SHA256 with an iteration count of 4,300,000 (see page 13). If you're using the slowest possible algorithm/biggest number of iterations, you're still vulnerable to parallel attacks: imagine a huge number of cheap chips bruteforcing passwords. Scrypt tries to maximize the cost of such chips by requiring large amounts of RAM for computation. Again, this is explained in the paper.