Password hashing
A password hash costs you once for each login and costs the attacker once for each guess. At 25 ms, one attacker core makes about 40 guesses/s instead of 1 million, and a 60 logins/s peak still fits on 2 vCPU.
See it on the board
The same traffic runs on two boards. The simulator measured both when this page was built.
| Measure | Goal | Fast hash | Slow, memory-hard hash |
|---|---|---|---|
| Throughput (Guesses) | under 100 req/s | 10,000 req/s Fail | 41 req/s Pass |
| p99 latency (Logins) | under 500 ms | 71 ms Pass | 192 ms Pass |
| Availability (Logins) | at least 99.9% | 100% Pass | 100% Pass |
| Monthly cost | 34 USD/mo | 34 USD/mo | |
| Error rate | 0% | 0% |
Key numbers
| Number | Value |
|---|---|
| Checks per second, one auth part | 10,000 ops/s |
| CPU time for one API call | 0.3 ms |
| Default memory for one request | 64 KB |
Limit 1/s per account · all codes tried in 12 days
How it works
A site never stores passwords. It stores a hash of each one. If a thief copies the password table, the thief must guess passwords and hash each guess to compare it with the table. How fast the thief can guess depends on how fast the hash runs.
A fast hash such as plain SHA-256 is made to be quick. One core can try about a million guesses each second, and a GPU many times more. Most passwords fall in minutes.
A slow hash is built to be costly. It uses CPU time, and a memory-hard design also uses a block of memory for each guess, which limits parallel guessing on GPUs. In the mini board a hash takes 25 ms and 19 MB of memory. One attacker core then makes about 40 guesses/s, well under the limit of 100.
You pay the same price at each login. Customers sign in at 20 logins/s and at 60 logins/s from 0:10. Each login costs 25 ms of CPU and 19 MB of memory. A box with 2 vCPU and 4 GB serves the peak, and login p99 stays under 500 ms.
Set the cost from your own hardware and your peak. Use a unique salt for each password. Raise the cost over time as hardware gets faster.
In the levels you pick the hash settings that fit both the login peak and the attacker limit.