Skip to content
FeaturesPricingAffiliateBlogHelpAboutContact
Get StartedSign In
Back to Blog
industry2026-05-236 min read

PBKDF2 200k isn't enough — why every account needs an atomic-counter lockout

PBKDF2 200k iter at ~250ms/attempt slows attackers, but a 100-IP residential-proxy pool runs 47,000 attempts in 12 hours. Worker IP-rate-limit alone can't deter it. thMenu's PR #548 H4 fix: D1_OPS migration 0076 pw_failures composite PK + atomic UPSERT.

th

thMenu Team

thmenu.com

Found this helpful? Share it.