RFC 2898 · key stretching · WPA2 · KDF
PBKDF2 (Password-Based Key Derivation Function 2) applies a pseudorandom function (HMAC) repeatedly with a salt to derive a key. Deliberately slow to resist brute-force. Used in WPA2, 1Password, LastPass.
HMAC-SHA256 or HMAC-SHA512.Password box.Salt box — leave it empty to derive with an empty salt.Iterations count (default 100,000) and the Key length (128, 256, 384, or 512 bits).PBKDF2 derived key (hex), with the byte and iteration counts shown beneath it.Copy key to copy the hex key, or Clear to reset both inputs.Check that your own PBKDF2 code matches a reference output by using the same password, salt, iterations, and hash function and comparing the hex key.
WPA2, 1Password, and LastPass derive keys from passwords with PBKDF2. Match their parameters to reproduce or inspect a derivation.
Raise the iteration count and watch the derivation slow down — a hands-on feel for the security-versus-speed tradeoff of key stretching.
Pick HMAC-SHA256 or HMAC-SHA512 to reproduce the exact primitive your app or password manager uses, so derived keys line up.
PBKDF2 is defined in RFC 2898; OWASP recommends at least 310,000 iterations for SHA-256. Derive with those settings to follow guidance.
Everything runs in your browser via the Web Crypto API. Passwords and keys are never sent to or stored on a server.
PBKDF2 (Password-Based Key Derivation Function 2) is defined in RFC 2898. It repeatedly applies an HMAC pseudorandom function to a password plus salt, producing a key of any requested length.
A salt is a unique, ideally random value mixed into the derivation. It ensures the same password produces different keys, defeats precomputed rainbow tables, and stops identical passwords from hashing identically.
Key stretching runs thousands of HMAC rounds so each guess is expensive. That slowdown is the point: it makes brute-forcing a stolen hash far slower without bothering the legitimate user who derives once.
OWASP currently recommends at least 310,000 iterations for SHA-256, and higher is generally better as hardware speeds up. This tool accepts from 1 up to 10,000,000 iterations.
Both are valid HMAC primitives. SHA-256 is the most common default and matches most OWASP guidance; SHA-512 can be faster on 64-bit hardware but is used less often in the wild.
Not necessarily. PBKDF2 is not memory-hard, so GPUs can parallelize attacks. For new systems consider memory-hard functions like Argon2id or scrypt, which resist GPU and ASIC attacks better.
No. Derivation runs locally in your browser using the Web Crypto API. Your password, salt, and derived key are never transmitted to or logged by a server.