PBKDF2

What it is made of

Iterations

1000 – 10000000, default 600000

Hash

sha256 · sha384 · sha512

Runs in

Your browser and the server

What it is

The oldest of the three and the only one every platform has natively. Time-hard but NOT memory-hard, so dedicated hardware attacks it far better than it does scrypt.

Where it runs

Both lanes. By default the lab runs it in your own browser over the Web Crypto API, so nothing leaves your device — there is no upload, no size limit and no queue. The server lane is there when you want it, and it is the only way an agent or a script can reach the same engine.

What the cost buys

A key-derivation function exists to be SLOW. Its cost parameters are how much work an attacker must repeat for every guess, so raising them raises the price of a dictionary attack directly. They are stored in the file, so a file encrypted with an unusual cost still opens with nothing but the passphrase — which is the reason the container format had to record them rather than assume them.

Try it

Open the lab, choose this, and raise its cost. You will feel the derivation take longer, and that time is what an attacker pays for every guess they make. The lab is a Leumas membership away; everything on this page is free.