# Adaptive Hash Functions: How to tell how many iterations were used?

If an adaptive hash function like bcrypt or PBKDF2 is used in hashing passwords, the number of iterations used in the hashing process can be configured.

For a penetration tester or a malicious hacker, what are the ways to determine how many iterations were used in hashing passwords, assuming that they do not have access to source codes, only a database dump of the password hashes.

## migrated from security.stackexchange.comJul 27 '12 at 10:55

This question came from our site for information security professionals.

• I still think this fits security.SE better than crypto.SE. – CodesInChaos Jul 27 '12 at 11:12

The plain hash itself does not give any indication of the number of iterations. But with practical schemes, such as most crypt based ones, the number of iterations is stored alongside hash and salt in the database.