PBKDF2 key generator
Enter a password and a salt, choose the hash, the number of iterations and the key length, and get the derived key in hex or Base64. The browser's Web Crypto does the work, so the password never leaves this page.
Runs in your browser: nothing you enter is sent anywhere.
How to use it
- Enter the password and the salt. Press “Random 16-byte salt” to create one in the browser; it is written as hex.
- Choose the hash, the iterations and the key length.
- Read the derived key in hex or Base64. The line under it shows how long the derivation took.
How it works
PBKDF2 builds the key block by block. For block i: U₁ = HMAC(password, salt ‖ INT(i)), U₂ = HMAC(password, U₁), … up to the number of iterations, and the block is U₁ ⊕ U₂ ⊕ … ⊕ Uₙ. Blocks are joined and cut to the requested length. The tool calls crypto.subtle.deriveBits with PBKDF2, so the browser’s own implementation does the computation. Numbers can be typed with spaces or separators: 600 000, 600,000.
Example
RFC 6070 test vectors (HMAC-SHA-1, password password, salt salt, 20 bytes):
- 1 iteration:
0c60c80f961f0e71f3a9b524af6012062fe037a6
- 2 iterations:
ea6c014dc72d6f8ccd1ed92ace1d41f0d8de8957
- 4,096 iterations:
4b007901b765489abead49d926f721d065a429c1
With SHA-256, 1 iteration and 32 bytes the same input gives 120fb6cffcf8b32c43e7225256c4f837a86548c92ccc35480805987cb70be17b.
Tips
- Record the hash, iterations, salt and length with each stored key: without them the key cannot be checked.
- Raise the iteration count over time as hardware gets faster; rehash a password when its user next logs in.
- Do not reuse the derived key for several purposes; derive separate keys with different salts or use HKDF.
Frequently asked questions
What is PBKDF2?
Password-Based Key Derivation Function 2, defined in RFC 8018. It runs a pseudorandom function — usually HMAC with a SHA hash — thousands of times over the password and salt, so each guess costs an attacker the same work.
How many iterations should I use?
As many as your system can afford for each login. The OWASP Password Storage Cheat Sheet suggests 600,000 iterations for PBKDF2-HMAC-SHA-256, 210,000 for SHA-512 and 1,300,000 for SHA-1. The time shown under the result helps you judge.
Why does the salt matter?
A unique random salt per password means equal passwords get different keys, and precomputed tables do not work. Store the salt next to the hash; it does not need to be secret. 16 random bytes are a common size.
Which key length should I choose?
The hash's output size is the natural choice: 20 bytes for SHA-1, 32 for SHA-256, 64 for SHA-512. Longer keys are allowed but cost extra rounds without making the password harder to guess.
Should I use PBKDF2 or something else for passwords?
PBKDF2 is widely supported and FIPS-approved. Memory-hard functions such as Argon2id or scrypt resist GPU attacks better and are preferred where available; bcrypt is also common.