This would usually only be a mild, temporary barrier to cracking. Leaving off the number of rounds would be a thin layer of obscurity. The only way such a hash could even *work* would be if the software had a hard-coded or algorithmic way to determine the number of rounds. So that software could simply be reverse-engineered to discover the number of rounds. It would also be quite unusual. Most hash formats that use rounds include the number of rounds as part of the hash itself (the "1000" in this example, taken from [the list of hashcat example hashes][1]): sha256:1000:MTc3MTA0MTQwMjQxNzY=:PYjCU215Mi57AYPKva9j7mvF4Rc5bCnt This means that the easiest workaround is to simply generate a version of the hash with many numbers of rounds: sha256:1:MTc3MTA0MTQwMjQxNzY=:PYjCU215Mi57AYPKva9j7mvF4Rc5bCnt sha256:2:MTc3MTA0MTQwMjQxNzY=:PYjCU215Mi57AYPKva9j7mvF4Rc5bCnt sha256:3:MTc3MTA0MTQwMjQxNzY=:PYjCU215Mi57AYPKva9j7mvF4Rc5bCnt sha256:4:MTc3MTA0MTQwMjQxNzY=:PYjCU215Mi57AYPKva9j7mvF4Rc5bCnt sha256:5:MTc3MTA0MTQwMjQxNzY=:PYjCU215Mi57AYPKva9j7mvF4Rc5bCnt ... and then feed *all* of them to your cracking software. (Because the number of rounds in this hash format is designed to be variable, cracking software should be able to handle this just fine.) That being said, there's usually a practical upper limit to the number of rounds - beyond which it would take too long for interactive users to tolerate waiting for their password to be verified. 100,000 rounds would be pretty unusual, [but not impossible][2]. But if this is some custom, bespoke application, an unusually high number of rounds *might* be tolerable. So if it's some bespoke application, trying to "hide" the number of rounds might make it a *little* harder for the attacker. So if an attack on rounds from 1 to 50,000 didn't yield any results in a day or two, I'd be inclined to think that it's a different hash type - and would probably be trying to grab the software/firmware that generates/verifies the hashes and reverse engineering it. [1]: https://hashcat.net/wiki/doku.php?id=example_hashes [2]: http://www.insanitybit.com/2013/02/25/lastpass-ups-pbkdf2-round-limit/