About the PBKDF2 Key Derivation Generator
PBKDF2 turns a password and a salt into a fixed-length key by applying a hash function many times. The iteration count makes the process slow enough to resist brute force, and the salt makes precomputed tables useless. It is widely deployed: WPA2 Wi-Fi, disk encryption, and password managers such as 1Password use it. This tool derives a key with the salt, iteration count, hash (SHA-256 or SHA-512) and length you set.
Because PBKDF2 is not memory-hard, high iteration counts are needed for adequate strength; current guidance suggests hundreds of thousands. For new systems, memory-hard Argon2 or bcrypt are generally preferred, but PBKDF2 remains the right choice for compatibility with the many standards that specify it.
The derivation runs locally, so your password is not transmitted. Use test values here. The output is the derived key in hexadecimal.
How to use
- Type the password.
- Set the salt, iterations, hash and key length to match the target system.
- Copy the derived key.
Common questions
- How many iterations should I use?
- Current guidance is at least several hundred thousand for SHA-256. Match the standard you are implementing.
- PBKDF2 or Argon2?
- Argon2 is memory-hard and preferred for new systems. PBKDF2 is required by many existing standards and remains fine with a high iteration count.
- Why do I need to provide the salt?
- PBKDF2 does not embed the salt in its output, so you supply it and must store it alongside the key.