Hardening Reference
Where encryption costs you milliseconds, and where it does not
You want to know what the padlock costs you in time to first byte, and nobody will give you a number.
The short answer
Encryption turns readable data into something only the right key can restore — but the word covers three separate jobs with three completely different performance profiles.
In transit, TLS costs you a handshake and then almost nothing. At rest, storage encryption costs a little CPU and is largely invisible. Hashing costs a deliberate, tunable amount of CPU per password check, and that cost is the entire point of it. Treating the three as one thing is how people end up optimising the wrong one.
By the HostingFast team · Reviewed 12 August 2026
100+
Definitions on file
2 min
Typical time on one
Plain
English, no marketing
24/7
Engineers on the desk
The transport case is the one people worry about and the one that has quietly stopped mattering. TLS 1.3 completes its handshake in a single round trip, session resumption removes even that for returning visitors, and modern processors handle the symmetric encryption afterwards without meaningful effort. The measurable cost of HTTPS today is a fraction of the DNS lookup that preceded it.
The hashing case runs the other way. Password hashing is designed to be slow, because the attacker's cost scales with yours and a fast hash is a broken one. Tuning it downward to make a login feel snappier is one of the few places where a performance change makes you meaningfully less safe.
Three jobs, one word
Data in transit is protected by TLS between the browser and the server, and separately on SFTP and on authenticated mail submission. Data at rest is protected by the storage layer, which depends on the platform. Passwords are not encrypted at all — they are hashed, a one-way operation, so the original was never stored in a recoverable form in the first place.
Getting that third one right in your own application matters more than anything you can configure on a host, because a hashed password stays safe wherever the database ends up. If a site can email you your existing password, it is not hashing them, and that is the finding.
Measuring the handshake on your own site
curl will break the timings out for you: name lookup, TCP connect, TLS complete, first byte. Subtract the connect time from the TLS-complete time and you have the handshake in isolation, on your connection, to your server. Run it warm and cold, because a resumed session skips most of the work and will flatter you.
For most sites that number lands well inside the noise of everything else on the page. If it does not, the usual causes are a certificate chain with an extra hop, an old protocol version negotiating down, or a stapling failure sending the browser off to check revocation on its own.
Hashing is slow deliberately
A password hash with a cost factor is meant to take a noticeable fraction of a second. That is what makes an offline attack on a stolen database expensive rather than trivial. The right cost is the highest one your login flow can absorb without users noticing, reviewed occasionally as hardware improves.
Where this bites in practice is a login endpoint under a credential-stuffing flood: each attempt costs real CPU by design. That is another argument for rate limiting at the edge rather than letting the attempts reach the hashing function at all.
What you get here without configuring anything
Free SSL on every plan, issued as soon as the domain points at us and renewed automatically before expiry — the same DV-grade encryption a paid certificate provides. Paid certificates exist for wildcard coverage or organisation validation, not for stronger cryptography.
Neighbouring entries worth reading next: TLS, HTTPS, SSH and Two-Factor Authentication. The rate you sign up at is the rate you renew at, so none of this quietly becomes an annual line item.
Numbers where a number exists
When a term has a cost, this reference gives you the way to measure it on your own site rather than an adjective. When the honest answer is that the cost is below the noise floor, it says that too.
Free SSL on every plan, renewed before it can lapse, so the transport half of this page needs no work from you.
- Measure it yourself, with the command
- Costs quantified or dismissed honestly
- Terms linked to their neighbours
- Written by the support engineers
Why HostingFast
Standard on every plan
Three jobs separated
Transit, at rest, and hashing have nothing in common except a word. Their performance profiles are opposites.
The handshake, measured
Subtract connect time from TLS-complete time and you have your own number instead of an opinion.
Warm and cold, both
Session resumption skips most of the work, so a single warm test will flatter your setup.
Hashing cost defended
Slow is the feature. Lowering the cost factor to speed up a login is a security change in disguise.
The usual handshake faults
An extra chain hop, a downgraded protocol, or a stapling failure sending the browser off to check revocation.
Certificates, honestly priced
The free one is the same encryption. Paid ones buy wildcard coverage or organisation validation, not stronger maths.
Quick Start
From order to online
- 1
Time the handshake in isolation
Use curl's timing output and subtract the connect time from the TLS-complete time. That is your handshake, on your connection, right now.
- 2
Test cold as well as warm
A resumed session skips the expensive part. Test from a fresh connection or you will measure the flattering case and ship it.
- 3
Leave the hashing cost alone
If logins feel slow, rate limit the endpoint instead. Turning down the cost factor moves the problem to the attacker's advantage.
Built In
Loaded onto every plan
- DDoS filtering absorbed out at the network edge
- Staging environments for testing changes before they ship
- SSH, Git and Composer on the developer-focused plans
- 99.9% uptime as the target, monitored around the clock
- Human support on duty every hour of every day
- Softaculous on board for one-click application installs
- Browser webmail plus IMAP, POP and SMTP for any mail app
- Email addresses that run on your own domain name
- A renewal price identical to the price you signed up at
- Zero setup charges — there is no joining fee, ever
Frequently Asked
What people ask us most often
How do I measure what TLS costs on my own site?
Ask curl for its timing breakdown and read four numbers: name lookup, TCP connect, TLS complete and first byte. The handshake is the gap between connect and TLS complete. Do it from a cold connection as well as a warm one, because session resumption removes most of the work and a warm test will tell you the handshake is nearly free when for a first-time visitor it is not.
Is HTTPS still a performance cost worth arguing about?
No. TLS 1.3 handshakes in one round trip, resumption removes it for returning visitors, and the ongoing symmetric encryption is negligible on current hardware. Meanwhile HTTP/2 and HTTP/3 are only available over TLS, so in practice the encrypted path is the faster one. If HTTPS made your site slower, look for a redirect chain rather than for cryptography.
Should I lower my password hashing cost to speed up logins?
No — that is the one place where a faster setting is a weaker one. The cost factor is what makes an offline attack on a stolen database expensive. If logins feel slow under load, the problem is usually attempt volume rather than the hash, and the answer is rate limiting at the edge so guesses never reach the hashing function.
Is the free certificate weaker than a paid one?
Not cryptographically. It issues as soon as your domain points at us, renews itself before expiry, and provides the same domain-validated encryption a paid DV certificate does. Paid certificates buy wildcard coverage across subdomains or organisation validation in the certificate details. Neither changes the strength of the connection.
Keep reading
HTTPS
The encrypted transport itself: what the padlock covers, and what it never touches.
SSH (Secure Shell)
Key-based access to the command line, and why password authentication should be off.
Best LiteSpeed Hosting
The buyer's version: what to verify about a LiteSpeed platform before you sign.
CMS Hosting
Hardened, quick hosting for WordPress, Joomla, Drupal and the rest of the major platforms.
Web Hosting
cPanel hosting on NVMe with SSL, migration and a first-year domain included.
Changing hosts? Run through our checklist first.
A straightforward sequence for a switch your visitors never feel: which files move first, how to shift email across without losing a single message, the right moment to repoint DNS, and the two mistakes behind almost all the downtime we get asked to rescue.
Get the padlock without the tuning session.
Free SSL that renews itself, LiteSpeed and NVMe underneath, and a renewal price identical to the one you signed up at.
View CMS Hosting plans