PBKDF2 Key Derivation
Derive cryptographic keys from passwords using PBKDF2-SHA-256 with configurable salt and iterations in your browser.
Derive keys with PBKDF2 in the browser
PBKDF2 (Password-Based Key Derivation Function 2) stretches a password or passphrase into a fixed-length cryptographic key using a salt and iteration count. RFC 8018 defines the algorithm; this tool uses the Web Crypto API so your password never leaves the device.
How to use it
- Enter the password or passphrase and a salt (UTF-8 text or even-length hex bytes).
- Set iterations (OWASP often recommends hundreds of thousands for SHA-256) and output length in bits.
- Choose SHA-256, SHA-384, or SHA-512 and copy the hex derived key.
Compare with HKDF Key Derivation when you already have keying material rather than a low-entropy password.
Frequently Asked Questions
Is my password sent to a server?
No. Derivation runs entirely in your browser via crypto.subtle.
What salt format is supported?
Plain text encodes as UTF-8. If the salt field is only hexadecimal digits with even length, it is parsed as raw bytes.
How is this different from hashing?
PBKDF2 is designed for passwords: slow iteration plus salt resists brute-force and rainbow tables. A single hash is not a key-derivation function.