# Is there a practical upper limit for password rehashing?

When using PBKDF2, is there a practical upper limit to the iteration count above which we lose security?

Note: If you answer “No”, that's fine. But if you answer: “There can't be an upper limit“, Consider the case of $2^{256}$ iterations using SHA-256.

-
See this question – mikeazo Jul 9 '14 at 22:57
See also this and this. – mikeazo Jul 9 '14 at 23:02

There is a limit above which you gain no security, but it isn't practical. It's on the order of $2^{128}$ iterations for PBKDF2-HMAC-SHA-2, or $2^{80}$ if you use SHA-1 as the HMAC hash. For an explanation, see the questions mikeazo linked in the comments.
Cycles, which you would notice about the same time, can technically "undo" previous iterations, but the unique iterations before the cycle begins are still strong, and the expected number of those is also close to $2^{128}$ for a 256-bit hash.