PBKDF2.
What turns a human-sized passphrase into something worth attacking slowly.
PBKDF2 (Password-Based Key Derivation Function 2) makes guessing expensive by design: BurnPony runs a note's passphrase through 600,000 iterations of HMAC-SHA256 with the note's salt before folding the result into HKDF.
What it is
Human passphrases are the weak link in any system that accepts them — people choose short, guessable things. Iteration count is the countermeasure: each guess an attacker makes costs 600,000 hash operations, turning a fast dictionary attack into a slow one.
Why it matters
The number isn't arbitrary — 600,000 iterations of PBKDF2-HMAC-SHA256 aligns with current OWASP guidance, and the roadmap notes a possible future envelope version using memory-hard Argon2id.
Related terms
Common questions.
Does a passphrase replace the link's key?
No — it adds to it. The 32-byte fragment key is always required; a passphrase means an attacker needs both the link and the phrase.
Why does the viewer take a moment on passphrase notes?
That pause is the 600,000 iterations running in your browser. The cost you feel once per open is the same cost an attacker pays per guess.
Get BurnPony
Free self-destructing encrypted notes for iPhone. Recipients need only a browser. No accounts, no tracking.