About this online tool
hidevtool PBKDF2 workbench derives key material from a password and salt in your browser. Pick the PRF (HMAC hash), salt as hex or UTF-8 text, iterations, output bit length, and hex or Base64 encoding—nothing is uploaded.
Online PBKDF2 derive capabilities
What it does
PBKDF2 stretches a human password into fixed-length key bytes using a salt and many iterations. Wallets, VPN configs, and password-storage schemes often specify PBKDF2 with a particular hash and iteration count.
PRF (hash)
- SHA-256 — common default for new designs and Web Crypto defaults.
- SHA-512 — longer internal block; some specs require it.
- SHA-1 — legacy compatibility only; avoid for new secrets.
Salt & iterations
- Salt should be unique per password; use random salt when generating new keys.
- Hex salt accepts any even-length hex; UTF-8 salt uses the exact bytes of your text.
- Higher iterations slow brute-force; 100k–600k+ is typical for password storage today.
Output length
- 256 bits (32 bytes) is a common AES-256 key size.
- Match bit length and encoding (hex vs Base64) to your target tool or RFC test vector.
Security tips
- 1PBKDF2 output is sensitive—treat it like a password or raw key.
- 2Use a unique random salt for each user or secret; never reuse salts across databases.
- 3Prefer SHA-256 or SHA-512 with high iteration counts for new systems.
- 4This page is for derivation and testing—do not paste production master passwords on shared machines.
Common use cases
Reproduce RFC / docs vectors
Verify your backend PBKDF2 implementation against published test inputs.
Wallet & VPN keys
Derive key material when documentation lists PBKDF2 parameters explicitly.
Teaching & debugging
See how salt encoding and iteration count change the derived bytes.
Frequently asked questions
- Is this the same as bcrypt or scrypt?
- No. This page implements PBKDF2 only. Bcrypt and scrypt are different KDFs with their own parameters.
- Why does my output not match another site?
- Check PRF hash, salt bytes (hex vs UTF-8), iteration count, output bit length, and hex vs Base64. Any mismatch changes the result.
- Is data uploaded?
- No. Derivation runs entirely in your browser.