this post was submitted on 17 Dec 2025
22 points (100.0% liked)
Explain Like I'm Five
19238 readers
12 users here now
Simplifying Complexity, One Answer at a Time!
Rules
- Be respectful and inclusive.
- No harassment, hate speech, or trolling.
- Engage in constructive discussions.
- Share relevant content.
- Follow guidelines and moderators' instructions.
- Use appropriate language and tone.
- Report violations.
- Foster a continuous learning environment.
founded 2 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
One thing not mentioned is that modern password hashing algorithms will iterate your password hundred of thousand of times. This makes cracking the hash much more time intensive. For example if 1 hash takes 1ms (most hash algorithms are way quicker), then 1000 iterations of that means it will take 1 second to compute your hash from the input. The server has to spend that time to validate your password when you login, but that's a small tradeoff to make brute force attempts which will now have to calculate 1000x hashes for each input.
We updated to the NIST recommendation of 600000 iterations a few years ago when it was released, with regular increases every year. Logins take upwards of 5 seconds but it's added security in the event the data is leaked.