Hashes/Crypto
PBKDF2 Hash + Verify
Derive a key with PBKDF2 (RFC 8018) from a password, HMAC-SHA1/256/384/512, with a configurable iteration count.
PBKDF2 (RFC 8018) applies HMAC to a password and salt repeatedly to deliberately slow down computation — it's the oldest of the standardized algorithms for password hashing and encryption key derivation.
How to use it
- Derive: enter a password, pick an HMAC algorithm (SHA-1/256/384/512), and set the iteration count to get a derived key of the requested length.
- Verify: paste a password and an existing PBKDF2 hash to check whether they match, without recomputing it manually.
- More iterations means slower, more secure computation — tune the value to your server's response-time budget.
Common uses
- Deriving an encryption key from a user's password for a file container or a custom protocol.
- Checking a PBKDF2 implementation for compatibility across programming languages (the parameters must match exactly).
- Hashing passwords in systems that require a FIPS-compliant algorithm (PBKDF2 is NIST-approved).
Things to keep in mind
Unlike bcrypt and Argon2, PBKDF2 isn't memory-hard — it only requires CPU time, so it's less resistant to attacks on GPUs with many parallel compute units.
The recommended iteration count rises over time in NIST and OWASP guidance as hardware gets faster — check against current recommendations periodically.
Article about this tool: PBKDF2: the oldest key-stretching standard
Frequently asked questions
How is PBKDF2 different from bcrypt or Argon2 for password hashing?
PBKDF2 repeatedly applies an HMAC hash function to slow down brute-force attempts, but unlike bcrypt or Argon2 it isn't memory-hard, making it comparatively cheaper to crack using GPUs. It's still widely used and FIPS-approved, but Argon2 is generally preferred for new systems.
What does the iteration count control, and how high should it be?
The iteration count sets how many times the underlying hash is applied, directly trading speed for resistance to brute-force. Current guidance recommends hundreds of thousands of iterations for SHA-256, adjusted upward over time as hardware gets faster.
Why does PBKDF2 need a salt?
A salt ensures that identical passwords produce different output, preventing attackers from using precomputed rainbow tables and forcing them to attack each hash individually.
Does the underlying hash function PBKDF2 uses matter?
Yes. Older implementations often defaulted to HMAC-SHA1 — within HMAC's construction that's not a critical vulnerability, but modern guidance consistently recommends HMAC-SHA256 or stronger for a larger safety margin at negligible speed cost.
Where else is PBKDF2 used besides password storage?
PBKDF2 is widely used to derive cryptographic encryption keys from passwords — for example, in WPA2/WPA3 for Wi-Fi and in many encrypted file container formats.