Does a cracker need to know the number of iterations a hashing algorithm uses to compute a hash?

If they don't know it, how do they figure it out? How much longer does it take to figure it out, than if they didn't know?

I can only guess that they try a number of the most common passwords, and try it with different iterations, and see what amount of iterations returns the most correct passwords. Would this even work though?

  • I'm not a security expert, but it seems to me that a good security system should be difficult to defeat even if the algorithm is open-source. Feb 7, 2014 at 21:31
  • 1
    this has most likely been already asked and answered at Security.SE - they've got about 500 questions in the 'hash' tag
    – gnat
    Feb 7, 2014 at 21:42
  • 1
    @gnat: Which one of those 500 answers this question? :) Feb 7, 2014 at 21:56
  • @RobertHarvey if you're curious, migrate and see how regulars will close it as a dupe there, possibly along with voting down for apparent lack of effort. What is considered a reasonably high iteration count?
    – gnat
    Feb 7, 2014 at 21:59

2 Answers 2


The usual attack models assume that the attacker knows the exact algorithm used and the only unknown is (in the case of hashing-to-hide-plaintexts) the plaintext. In short, the enemy already knows the system.

Sometimes this gives the attacker too much credit, but that's better then underestimating them. Since password hashes are typically retrieved by breaking into a production server, it's likely that the application source code (which includes a full specification of the hashing procedure used) was grabbed at the same time. In other cases, the source code is open to begin with.

  • Even if the source code wasn't grabbed, the algorithm and iterations used to create a password hash will often be saved together with it in the database - this makes it easy to change hashing strategy without immediately recalculating all hashes. Jul 12, 2019 at 7:16

Unless you implement hashing algorithm on server side, and use some non-standard algorithm, Everything about hashing algorithm is known to hacker. if implemented on client side, it can be reverse engineered, even if you use non-standard algorithm, or obfuscate a standard algorithm.

  • 5
    A non-standard algorithm implemented on the server does not hinder an attacker. That belief is security through obscurity and the reasons it's bad are too numerous to list in a single answer let alone comment.
    – user7043
    Feb 7, 2014 at 21:39
  • 2
    One of the most fundamental concepts behind security is to use algorithms that are just as effective even if they are known to the attacker.
    – user16764
    Feb 7, 2014 at 22:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.