PBKDF2 Hash Generator

Turn a password and salt into a PBKDF2 derived key with the hash function, iteration count and key length you choose. Results appear as hex and Base64 together with ready-to-use encoded strings, the first steps of the calculation and matching Python and Node.js code. The key is computed by your browser's Web Crypto API and never leaves the page.

Last updated: October 24, 2026

How to use the PBKDF2 Hash Generator

1. Enter the password as plain text (encoded as UTF-8) or switch to Hex for raw bytes.
2. Set the salt: keep the random 16-byte salt, press New random salt, or type your own as text, hex or Base64.
3. Choose the hash, iterations and key length, or pick a preset such as OWASP SHA-256 (600,000 iterations) or Wi-Fi WPA2 (SHA-1, 4,096 iterations, 32 bytes).
4. Press Generate key (it also updates as you type) and copy the hex, Base64 or encoded string you need.
5. To check a stored value, paste it into Expected key: the tool tells you whether it matches.
6. Open the steps and code panels to see how the key was built and to reproduce it in Python or Node.js.

How PBKDF2 works

PBKDF2 is specified in RFC 8018 (PKCS #5 v2.1). It takes a password P, a salt S, an iteration count c and a desired key length dkLen, and uses HMAC with a hash function as its pseudorandom function (PRF). With hLen = the hash output size:

1. Split the output into blocks: l = ⌈dkLen ÷ hLen⌉. A 32-byte key with HMAC-SHA256 needs one block; a 64-byte key with HMAC-SHA256 needs two.
2. First round of each block: U₁ = HMAC(P, S ‖ INT(i)), where INT(i) is the block number i as a 4-byte big-endian integer (00000001 for the first block).
3. Iterate: U_j = HMAC(P, U_j−1) for j = 2 … c.
4. Fold: T_i = U₁ ⊕ U₂ ⊕ … ⊕ U_c (bitwise XOR of every round).
5. Output: DK = T₁ ‖ T₂ ‖ … ‖ T_l, cut to the first dkLen bytes.

The total cost is c × l HMAC calls (each HMAC is two hash compressions or more). Because the password is the HMAC key in every round, an attacker who wants to test one guess must repeat all c rounds too. The salt makes every user's work unique, so one precomputed table cannot cover many accounts.

Recommended settings

Figures are from the OWASP Password Storage Cheat Sheet as revised in 2023 and are meant to be raised as hardware gets faster. NIST SP 800-132 (2010) sets 1,000 iterations as the floor and asks for a random salt of at least 128 bits. Keep the key length at or below the hash output size when you store password hashes; for encryption keys, derive exactly what the cipher needs (32 bytes for AES-256).

Test vectors to check an implementation

If your code disagrees with these values, the usual culprits are: the salt typed as text when the system expects hex bytes (or the reverse), a trailing newline in the password, a different text encoding than UTF-8, or comparing a hex string with a Base64 one.

Where PBKDF2 is used

• Password storage: Django's default hasher (pbkdf2_sha256), Werkzeug/Flask, passlib, and many FIPS-validated systems.
• Wi-Fi: WPA2-Personal turns your passphrase into the 256-bit pre-shared key with PBKDF2-HMAC-SHA1, 4,096 iterations and the network name as the salt.
• Encrypted files and vaults: password-protected archives, disk encryption and password managers derive their encryption key from the master password with PBKDF2 or a newer function.
• Browsers: the Web Crypto API exposes PBKDF2 natively, which is what this page uses.

For brand-new password storage without compliance constraints, a memory-hard function such as Argon2id or bcrypt resists GPU cracking better than PBKDF2 at the same time cost.

Frequently asked questions

Related tools