Skip to main content
Tool Factory

Keys, Certificates & Tokens

HKDF key Derivation

Derive HKDF key from the supplied material. Enter the key material, choose the required format, then review the result.

Tool workspace

Your input stays in this browser.

Add the required input to continue.

Needs input

You can run the tool again after any change.

Options

Your result appears here

Derive HKDF key from the supplied material. Enter the key material, choose the required format, then review the result.

This tool runs open-source code from CyberChef by GCHQ (Apache License 2.0). See open-source credits.

HKDF key Derivation performs HKDF for the supplied key or certificate data. The operation returns derived key bytes as the selected text or hexadecimal output.

The operation returns derived key bytes as the selected text or hexadecimal output. This result runs in the browser for this catalog category. Processing runs in the browser.

Key derivation separates password or input material from application keys; it does not replace secret storage or authentication.

Instructions

  1. Provide text or data for this tool.
  2. Use public password and salt values only. This applies to HKDF key Derivation.
  3. Record the digest, iterations, length, and salt with the result. This applies to HKDF key Derivation.
  4. Use a dedicated password policy before deriving production keys. This applies to HKDF key Derivation.

Example

Input: Password "test password" with salt "public-salt" and a documented output length.

Settings: HKDF key Derivation: Set the salt, digest, iteration or cost controls, and output length shown by the operation. Use text input for the public password fixture. Keep the salt and all parameters when reproducing the derived key.

Result: The operation returns derived key bytes as the selected text or hexadecimal output.

Limits

  • HKDF key Derivation: A derived key is not a password and cannot restore a missing password.
  • HKDF key Derivation: Security depends on salt uniqueness, cost parameters, and secret handling.
  • HKDF key Derivation: The output does not establish identity or authorize a user.

Questions

What input does HKDF key Derivation accept?

HKDF key Derivation accepts binary data or a selected file.

Which settings does HKDF key Derivation provide?

HKDF key Derivation provides controls for Salt, Info, Hashing function, Extract mode, with salt, no salt, skip, L (number of output octets).

What does HKDF key Derivation return?

HKDF key Derivation returns text. A simple Hashed Message Authenticaton Code (HMAC)-based key derivation function (HKDF), defined in RFC5869.