PBKDF2 Key Generator.

Secure Password-Based Key Derivation. Derive cryptographic keys from passwords using PBKDF2 with adjustable iterations, salt formats, and hash algorithms. Perfect for password storage, API secrets, and encryption keys.

PBKDF2 Key Generator

Derive cryptographically strong keys from passwords using PBKDF2. Configure iterations, key length, salt format, and hashing algorithm to match security policies or platform requirements.

SHA-256
100,000 iterations
32 bytes

Derivation Settings

Provide a password or passphrase and a salt value, then configure the PBKDF2 parameters to derive a deterministic cryptographic key.

Show

PBKDF2 requires a unique salt per password to prevent rainbow table attacks.

100,000 rounds
Re-derive key on any change

Derived Key Output

PBKDF2 output is deterministic: the same password, salt, iterations, key length, and hash algorithm will always produce the same key.

HEX encoded
No key yet

Security Recommendations

• Use a unique, randomly generated salt (at least 16 bytes) for every password you hash.

• Prefer SHA-256 or stronger hash functions for new systems.

• Increase iterations regularly to keep pace with faster hardware (100k–600k iterations is common for modern applications).

• Store the salt alongside the derived key; it is not secret.

• Consider peppering (additional server-side secret) for high sensitivity applications.

Use cases

Real-world uses.

Password Hashing
Hash user passwords before storing them in a database, combining a unique salt and high iteration count.
API Secret Derivation
Create deterministic API keys, JWT signing secrets, or HMAC keys from a master password plus per-service salts.
Security Benchmarking
Measure PBKDF2 performance on production hardware to tune iteration counts for authentication workflows.
Multi-Tenant Applications
Generate tenant-specific encryption keys by combining organization identifiers with user credentials.
Legacy Migration
Validate PBKDF2 parameters when migrating from older password hashing schemes to modern standards.

How it works

Four steps.

  1. 01

    Enter a strong password or passphrase that you want to derive a key from.

  2. 02

    Provide a unique salt or generate a random one. Pick the correct salt format (Base64, Hex, or text).

  3. 03

    Set iterations, key length, hash algorithm, and desired output encoding.

  4. 04

    Click Derive Key to generate the PBKDF2 output and copy the result for your application.

Features

Advanced PBKDF2 Features.

Everything you need to tune PBKDF2 for production systems: choose hash algorithms, measure iteration performance, generate salts, and export deterministic keys.

  • Configurable Hash Algorithms

    Choose between SHA-1, SHA-224, SHA-256, SHA-384, and SHA-512 to meet platform or compliance requirements.

  • Flexible Key Lengths

    Derive keys from 128-bit up to 512-bit, ideal for AES keys, JWT signing secrets, API credentials, and more.

  • Iteration Benchmarking

    Adjust PBKDF2 rounds from 1K to 2M and track derivation time to find the right balance between security and performance.

  • Secure Salt Generation

    Generate cryptographically random salts in Base64, Hex, or raw text to prevent rainbow-table attacks.

  • Deterministic Output

    Ensure consistent key derivation by locking down password, salt, iterations, hash algorithm, and output format.

  • Security Presets

    Preconfigured iteration counts and salt lengths aligned with OWASP Password Storage guidelines.

FAQ

Questions.

Can't find an answer? Send us your question.

What is PBKDF2 used for?

PBKDF2 (Password-Based Key Derivation Function 2) hardens passwords by combining them with a salt and hashing them many times. It is commonly used for password storage, generating encryption keys, and deriving secrets for APIs or tokens.

How many iterations should I use?

OWASP recommends using the highest iteration count that keeps authentication under 500ms on your infrastructure. For modern systems, 100k–600k iterations is typical, but you should benchmark on your own hardware.

Can I reuse the same salt?

No. Always generate a new random salt per password. Salts do not need to be secret, but they must be unique to prevent attackers from using precomputed tables.

Is SHA-1 still safe for PBKDF2?

SHA-1 is considered legacy and collision-prone. Use SHA-256 or stronger hash functions unless you must maintain compatibility with an older system.

How do I store the derived key?

Store the derived key and salt together, usually in your database alongside metadata like iterations and hash algorithm. Never store the original password.

Why is the output deterministic?

PBKDF2 is deterministic: the same inputs produce the same output. This property is required for password verification—hash incoming passwords with the same parameters and compare results.

Related tools

More Security & Privacy tools.

All 21 Security & Privacy tools →

Built by Infyways

Need more than a tool.

These utilities are made by the Infyways studio. When a free tool is not enough, we build the real thing.