Skip to main content
Tool Factory

Keys, Certificates & Tokens

PBKDF2 key Derivation

Derive PBKDF2 key from the supplied material. Enter the key material, choose the required format, then review the result.

Tool workspace

Your input stays in this browser.

Add the required input to continue.

Needs input

Run the tool when your input is ready.

Input

Defaults use PBKDF2-HMAC-SHA256 with 600000 iterations. Save the returned salt and parameters with the key.

Options

Leave blank for a new random salt. The result includes the salt in Hex.

Your result appears here

Derive PBKDF2 key from the supplied material. Enter the key material, choose the required format, then review the result.

This tool runs open-source code from CyberChef by GCHQ (Apache License 2.0). See open-source credits.

PBKDF2 key Derivation performs PBKDF2 for the supplied key or certificate data. The operation returns derived key bytes as the selected text or hexadecimal output.

The operation returns derived key bytes as the selected text or hexadecimal output. This result runs in the browser for this catalog category. Processing runs in the browser.

Key derivation separates password or input material from application keys; it does not replace secret storage or authentication.

Instructions

  1. Provide text or data for this tool.
  2. Use public password and salt values only. This applies to PBKDF2 key Derivation.
  3. Record the digest, iterations, length, and salt with the result. This applies to PBKDF2 key Derivation.
  4. Use a dedicated password policy before deriving production keys. This applies to PBKDF2 key Derivation.

Example

Input: Password "test password" with salt "public-salt" and a documented output length.

Settings: PBKDF2 key Derivation: Set the salt, digest, iteration or cost controls, and output length shown by the operation. Use text input for the public password fixture. Keep the salt and all parameters when reproducing the derived key.

Result: The operation returns derived key bytes as the selected text or hexadecimal output.

Limits

  • PBKDF2 key Derivation: A derived key is not a password and cannot restore a missing password.
  • PBKDF2 key Derivation: Security depends on salt uniqueness, cost parameters, and secret handling.
  • PBKDF2 key Derivation: The output does not establish identity or authorize a user.

Questions

What settings does the default derivation use?

The default uses HMAC-SHA256, 600000 iterations, and a 256-bit key. The iteration setting follows OWASP password-storage guidance. Advanced hash and iteration settings support compatibility tests.

Why does the result include a salt and parameters?

You need the same passphrase, salt, hash, iteration count, and key size to reproduce the key. A blank Salt generates 16 random bytes on each run. Save keyHex, saltHex, and parameters from the result.

How do I reproduce a known test vector?

Choose the passphrase format, enter an explicit salt with its format, and set the required parameters. Key size uses bits and must be a multiple of eight. The tool bounds combined derivation work to keep browser calculations manageable.