# PBKDF2 default iterations acording to OWASP **URL:** \ **Category:** Feature Requests\ **Created:** [January 16, 2023, 10:03am UTC](https://vaultwarden.discourse.group/t/pbkdf2-default-iterations-acording-to-owasp/2235 "2023-01-16T10:03:20Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![rexx.fha](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rexx.fha](https://vaultwarden.discourse.group/u/rexx.fha)\ **Post date:** [January 16, 2023, 10:03am UTC](https://vaultwarden.discourse.group/t/pbkdf2-default-iterations-acording-to-owasp/2235/1 "2023-01-16T10:03:20Z")
In 2021, OWASP recommended to use 310,000 iterations for PBKDF2-HMAC-SHA256 and 120,000 for PBKDF2-HMAC-SHA512. ([Password Storage - OWASP Cheat Sheet Series](https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html)) Please update the default settings ---
**Author:** ![cksapp](https://avatars.discourse-cdn.com/v4/letter/c/b9e5f3/32.png) [@cksapp](https://vaultwarden.discourse.group/u/cksapp)\ **Post date:** [January 16, 2023, 2:49pm UTC](https://vaultwarden.discourse.group/t/pbkdf2-default-iterations-acording-to-owasp/2235/2 "2023-01-16T14:49:01Z")
Bitwarden, and conversely Vaultwarden uses PBKDF2 on both the client and server side. With 100,000 iterations server side, along with a default, but configurable 100,001 interactions on the client side. As further described below, > **[Encryption | Bitwarden Help Center](https://bitwarden.com/help/what-encryption-is-used/#pbkdf2)** > > Learn how Bitwarden salts and hashes password Vault data before sending it to the Cloud for secure storage. Vaultwarden packages up the standard web-vault along with some patches to make it work with their server. Vaultwarden also tries to match the upstream as much as possible where able, though you can make a [request](https://community.bitwarden.com/c/feature-requests) for this in the official Bitwarden forums. ---
**Author:** ![gerardv514](https://avatars.discourse-cdn.com/v4/letter/g/439d5e/32.png) [@gerardv514](https://vaultwarden.discourse.group/u/gerardv514)\ **Post date:** [January 23, 2023, 10:17pm UTC](https://vaultwarden.discourse.group/t/pbkdf2-default-iterations-acording-to-owasp/2235/3 "2023-01-23T22:17:05Z")
Is there any implications, steps to follow, and recommendations on increasing the interations? If set to 100,000 can we increase to a recommended number. ---
**Author:** ![brobro](https://avatars.discourse-cdn.com/v4/letter/b/b38774/32.png) [@brobro](https://vaultwarden.discourse.group/u/brobro)\ **Post date:** [January 24, 2023, 10:48pm UTC](https://vaultwarden.discourse.group/t/pbkdf2-default-iterations-acording-to-owasp/2235/4 "2023-01-24T22:48:04Z")
The latest update seems to have 350000 iterations as standard. It may only be applied after changing your master password (without need to rotate key). You can change the value on the admin page and/or in a docker ENV value. ---
**Author:** ![gerardv514](https://avatars.discourse-cdn.com/v4/letter/g/439d5e/32.png) [@gerardv514](https://vaultwarden.discourse.group/u/gerardv514)\ **Post date:** [January 24, 2023, 11:15pm UTC](https://vaultwarden.discourse.group/t/pbkdf2-default-iterations-acording-to-owasp/2235/5 "2023-01-24T23:15:59Z")
Is there a difference Between the iterations under each vault account settings vs the iterations on the admin page? If you change one does it change the other or are they each separate fields? ---
**Author:** ![cksapp](https://avatars.discourse-cdn.com/v4/letter/c/b9e5f3/32.png) [@cksapp](https://vaultwarden.discourse.group/u/cksapp)\ **Post date:** [January 25, 2023, 9:40pm UTC](https://vaultwarden.discourse.group/t/pbkdf2-default-iterations-acording-to-owasp/2235/6 "2023-01-25T21:40:18Z")
> [@gerardv514](#): > > Is there any implications, steps to follow, and recommendations on increasing the interations? If set to 100,000 can we increase to a recommended number. I would recommend taking a backup of your vault just in case, but as I understand really the only danger would come from some type of catastrophic failure should you also decide to **Rotate the account encryption key** as noted [Increasing KDF interations - #10 by mgibson - Password Manager - Bitwarden Community Forums](https://community.bitwarden.com/t/increasing-kdf-interations/48059/10) It is apparently recommend to only increase in increments of 50,000 iterations to verify compatibility with clients > **[Master pass stopped working after increasing KDF](https://community.bitwarden.com/t/master-pass-stopped-working-after-increasing-kdf/49693/2)** > > Hey @ddejohn can you confirm where you have tried to login and what you changed it to? It is recommended to only change iterations of 50,000 at a time as indicated in the UI to ensure compatibility with your devices. For official support, contact... Though if you have newer more capable hardware this seems to be a non-issue as I have mine set to slightly over 1.5mil iterations of PBKDF2 and had maybe only a noticable 1-2 second additional delay in logging in to my vault. Unlock is unaffected. > [@gerardv514](#): > > Is there a difference Between the iterations under each vault account settings vs the iterations on the admin page? If you change one does it change the other or are they each separate fields? The web-vault iteration count would be for your individual vault prior to being sent to the server, there are an additional 100,000 iterations by default performed on the server side, which is what you see and can configure on the `admin` side. This this may have its own flaws as described ["Server-side hashing useless if the database is leaked" -- Security Consultant - Password Manager - Bitwarden Community Forums](https://community.bitwarden.com/t/server-side-hashing-useless-if-the-database-is-leaked-security-consultant/47597) but is being worked on and fixed by the official team upstream at Bitwarden. ---
**Author:** ![BlackDex](https://yyz2.discourse-cdn.com/free1/user_avatar/vaultwarden.discourse.group/blackdex/32/8_2.png) [@BlackDex](https://vaultwarden.discourse.group/u/BlackDex)\ **Post date:** [January 26, 2023, 10:10pm UTC](https://vaultwarden.discourse.group/t/pbkdf2-default-iterations-acording-to-owasp/2235/7 "2023-01-26T22:10:47Z")
Just as a note here. We have bumped the defaults at Vaultwarden to 600\_000 currently on `testing`. The web-vault part still needs an update to have that as a default. But apart from being able to update it your self via the web-vault, that should at least fix the main concern regarding the iterations. ---
**Author:** ![negeric](https://avatars.discourse-cdn.com/v4/letter/n/5daacb/32.png) [@negeric](https://vaultwarden.discourse.group/u/negeric)\ **Post date:** [February 1, 2023, 8:16pm UTC](https://vaultwarden.discourse.group/t/pbkdf2-default-iterations-acording-to-owasp/2235/8 "2023-02-01T20:16:00Z")
Looking through the psql schema under the users table, there are 2 columns: `password_iterations` and `client_kdf_iterations`. Changing my “KDF Iterations” in my Vault UI will change the value of `client_kdf_iterations`. Changing the `env` var `PASSWORD_ITERATIONS` does not change the `password_iterations` value in the DB, even after changing my master password, logging out and back in on all devices. Is this expected behavior? I believe the `password_iterations` field in the DB corresponds to the server side iteration. Version 2022.12.0 Thank you ---
**Author:** ![BlackDex](https://yyz2.discourse-cdn.com/free1/user_avatar/vaultwarden.discourse.group/blackdex/32/8_2.png) [@BlackDex](https://vaultwarden.discourse.group/u/BlackDex)\ **Post date:** [February 1, 2023, 11:43pm UTC](https://vaultwarden.discourse.group/t/pbkdf2-default-iterations-acording-to-owasp/2235/9 "2023-02-01T23:43:34Z")
As mentioned in my previous post, you need the `testing` version of the container, not `stable` ---
**Author:** ![paradoxx](https://avatars.discourse-cdn.com/v4/letter/p/919ad9/32.png) [@paradoxx](https://vaultwarden.discourse.group/u/paradoxx)\ **Post date:** [February 18, 2023, 2:08pm UTC](https://vaultwarden.discourse.group/t/pbkdf2-default-iterations-acording-to-owasp/2235/10 "2023-02-18T14:08:20Z")
Hi, I currently host Vaultwarden version 2022.12.0. Both the admin web server side and my Bitwarden clients all currently show a KDF iterations value of 100000. In order to increase to the [new default number of iterations](https://bitwarden.com/help/what-encryption-is-used/#pbkdf2), what should be the order of operation - do I need to change the server side value to 600000 first? Or does the 100000 in the admin panel represent the _additional_ iterations when stored on my server? I also see that it is recommended to increase by 50000. Going from 100000, that means I should do this 10 times. How strong is the recommendation to increase by 50k? Has anyone jumped from 100000 to 600000? ---
**Author:** ![paradoxx](https://avatars.discourse-cdn.com/v4/letter/p/919ad9/32.png) [@paradoxx](https://vaultwarden.discourse.group/u/paradoxx)\ **Post date:** [February 18, 2023, 2:35pm UTC](https://vaultwarden.discourse.group/t/pbkdf2-default-iterations-acording-to-owasp/2235/11 "2023-02-18T14:35:04Z")
Please excuse my haste! I just re-read your post. You have already provided the answer to my question stating that the additional 100,000 iterations on the server side is what we see on the admin side. So really, I just need to modify the KDF iterations from the web-vault. So far I’ve increased it by 50k and all my apps seem to work fine. Onwards!