I've heard of password cracking attacks using a list of commonly used passwords. Suppose in my situation, I can never be sure about the strength of the password, that a user inputs to my interface. So if I compute the SHA 256 hash of the user inputted password, then hash the hash again n times will that increase its overall probability of NOT being cracked ? If so what should be a reasonable value of n. Thanks everyone in advance!!!

  • 3
    $\begingroup$ Congratulation, you partially reinvented iterated password hashing as practiced for half a century, and still practiced (with some critical improvements, including salting) in e.g. PBKDF2. But there has been theoretical progress since, like bcrypt, scrypt, Argon2, Balloon hashing. The functionality is available as a library or built in some languages. Don't roll your own crypto ! $\endgroup$ – fgrieu Jan 13 at 11:24

What your describing is the core of many password hashing algorithms like bcrypt or pbkdf2. However, these are all complicated functions which don't just iterate. They are very commonly used with salt. If you would hash a password as you described n times, a reasonable choice would be bigger then 100.000.

However this is only for storing the password. If you would do this for, say, a website, it would take about 2 seconds. And if you're clients arent finding it nice to wait that long, you should lower it.

| improve this answer | |
  • 1
    $\begingroup$ Please review your post before hitting the button, that last sentence has a certain, uh, lack of words? $\endgroup$ – Maarten Bodewes Jan 13 at 13:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.