This question already has an answer here:
I am told that is quite easy to crack passwords when an attacker obtains a list of hashes of these passwords. This is quite easily compared to hashes of pre-computed common passwords, or brute-force compared or attacked with a dictionary based list or rainbowlist.
For this reason fast hashes as MD5 are deprecated. My question is if by applying the hash algorithm many many times one can really achieve storage of passwords that is harder to crack with all the above mentioned approaches, or is just an illusion?
It seems to me that the answer is yes, it's more secure. If I store the hash of a password that has been re-hashed N times, an attacker would have to know how many passes of hashing I did, or guess this number. Taking N large enough seems to me it would make an attack quite unfeasible, while storing the hash would be still a quick thing (imagine some tens of thousands of hash passes, it would be still matter of seconds I guess on a CPU)