PBKDF2 generator — derive a key from a password with salt and iterations

How to use the PBKDF2 generator

1. Type the Password.
2. Enter a Salt, and set Salt is to Text or Hex. Leave it empty for a random 16-byte salt.
3. Choose the PRF: HMAC-SHA1, HMAC-SHA256 (default), HMAC-SHA384 or HMAC-SHA512.
4. Set Iterations (1 to 10,000,000; default 600,000) and Key length (1 to 256 bytes; default 32).
5. Pick Output as Hex or Base64 and press Derive key.

The result shows the derived key, the Salt (hex), the Iterations and, for SHA-1, SHA-256 and SHA-512, the OWASP minimum for this PRF.

What it does and when to use it

PBKDF2 turns a password into a key by running a keyed hash thousands of times. The repetition makes every guess slow for an attacker. It is used to store passwords in Django and many enterprise systems, to unlock Wi-Fi WPA2 keys, and to derive encryption keys for password managers and encrypted files. Use this page to reproduce a value from your code or test an implementation against known vectors.

For new password storage, the bcrypt generator is another choice. The SHA-256 generator shows the single hash that PBKDF2 repeats, and the hash identifier recognises Django’s pbkdf2_sha256$ strings.

How it works

The tool calls crypto.subtle.deriveBits from the browser’s Web Crypto API with your password (UTF-8), salt, iteration count and hash. Following RFC 8018 section 5.2, for each output block it computes HMAC(password, salt + block number), then HMACs that result again and again, XORing all the results together. Iterations sets how many HMAC calls go into each block. Blocks are joined and cut to the key length you asked for. Nothing leaves the page.

Worked examples

RFC 6070 test 1. Password password, salt salt, HMAC-SHA1, 1 iteration, 20 bytes gives 0c60c80f961f0e71f3a9b524af6012062fe037a6. The tool also warns that OWASP recommends at least 1,400,000 iterations with SHA-1.

RFC 6070 test 3. The same inputs with 4,096 iterations give 4b007901b765489abead49d926f721d065a429c1.

SHA-256 at the recommended count. Password password, salt salt, HMAC-SHA256, 1 iteration, 32 bytes gives 120fb6cffcf8b32c…cb70be17b. At 600,000 iterations the key becomes 669cfe52482116fda1aa2cbe409b2f56c8e4563752b7a28f6eaab614ee005178, and no warning appears because the count meets the OWASP minimum.

Limits and tips

• Asking for more bytes than the hash size (32 for SHA-256) runs the whole iteration count again for each extra block. That doubles your work but not an attacker’s, who only needs the first block to test a guess.
• High counts take a moment; the tool only runs when you press Derive key.
• Use a fresh random salt of at least 16 bytes for each password.