Security Tools
PBKDF2 Generator
Derive PBKDF2 keys from any password and salt in your browser. SHA-1, SHA-256, SHA-384, SHA-512, OWASP iteration presets, hex and base64 output, verify mode.
Modern default. Used by Django, AWS Cognito SRP, 1Password, Bitwarden, and macOS encrypted backups. OWASP minimum is 600,000 iterations.
Treated as a UTF-8 byte string. Unicode passwords work, but make sure the verifying system normalizes the same way.
Use a fresh random salt per record. 128 bits (16 bytes) is the common minimum.
Higher iterations make brute force more expensive but increase wall-clock time. PBKDF2 work scales linearly with this value.
Common: 256 bits for AES-256, 160 bits for HMAC-SHA-1 records, 512 bits for FileVault. Must be a multiple of 8.
PBKDF2 runs in your browser through the Web Crypto API. The password, salt, and derived key never leave this page.
PBKDF2-HMAC-SHA-256 derived key
Enter a password and salt to derive the key
How to use
- Pick a hash function: SHA-256 for new password storage, SHA-1 for WPA2 or legacy compatibility, SHA-384 or SHA-512 for stronger digests.
- Type the password and salt. Switch the salt encoding between UTF-8, hex, and Base64 when you need to match a stored record, or click Random 128-bit for a fresh per-record salt.
- Set the iteration count. Click Use OWASP minimum to load the current 2025 recommendation for the chosen hash.
- Set the derived key length in bits or bytes. 256 bits matches AES-256 and Django, 160 bits matches HMAC-SHA-1 records, 512 bits matches FileVault.
- Copy the derived key as hex, uppercase hex, Base64, or URL-safe Base64. Use the Copy summary button to grab every field at once.
- Switch to Verify expected key, paste a target hash, and the tool runs a constant-time comparison against the derivation.
About this tool
PBKDF2 Generator derives a fixed-length key from a password and a salt using PBKDF2 (Password-Based Key Derivation Function 2, RFC 8018 / PKCS #5 v2.1). It supports HMAC-SHA-1, HMAC-SHA-256, HMAC-SHA-384, and HMAC-SHA-512, with iteration counts up to five million and output lengths up to 4,096 bits. Every derivation runs natively in your browser through the Web Crypto API (crypto.subtle.importKey plus deriveBits), so the password, salt, and derived key never leave your device. The tool surfaces the result as hex, uppercase hex, standard Base64, and URL-safe Base64 at the same time so you can match whatever format Django, OpenSSL, OAuth tokens, JWT keys, or WPA2 PSK tooling expects. Verify mode runs a constant-time comparison against a pasted target digest (with friendly handling of Django pbkdf2_sha256 records) so you can confirm whether a stored hash was produced from the same password. Built-in OWASP iteration presets make it easy to align with current 2025 password storage guidance, and the RFC 6070 test vectors are one click away so you can sanity-check the implementation against published reference values.
Free to use. Works in your browser. No signup, no login.
Related tools
You may also like
HMAC Generator
Generate and verify HMAC-SHA1, SHA-256, SHA-384, and SHA-512 signatures.
Open tool
SecuritySHA-256 Hash Generator
Hash text or files with SHA-1, SHA-256, SHA-384, and SHA-512.
Open tool
SecurityMD5 Hash Generator
Compute MD5 checksums of text and files locally with hex and Base64 output.
Open tool
SecurityPassword Entropy Calculator
Bits of entropy, possible combinations, and brute-force time at four attacker rates.
Open tool
SecurityPassword Strength Checker
Live strength meter with entropy, crack times, and common-password detection.
Open tool
SecurityPassword Generator
Strong random passwords with length and character controls.
Open tool