PBKDF2 Generator & Verifier
Derive PBKDF2 bytes with an explicit HMAC hash and iteration count, export a complete record, and verify a candidate locally.
Reproduce bytes and parameters
PBKDF2 uses a password byte string, salt, HMAC hash, iteration count and output length. This tool supports SHA-1/256/384/512 through Web Crypto. Password input may be UTF-8, hex, Base64 or Base64url; empty passwords and internal NUL bytes are valid.
The JSON record is this tool’s explicit interchange wrapper, not a universal password-hash string. It includes algorithm=PBKDF2, version=1, hash, iterations, length, hex salt and derivedKey. Verification takes these parameters from the record and interprets the candidate bytes using the selected password encoding.
Production settings and published examples
Initial controls use SHA-256, 600000 iterations, 32 output bytes and a random 16-byte salt. These are editable starting values, not a universal security prescription. The Example button uses the deliberately small SHA-1 RFC 6070 vector for interoperability, with diagnostics; do not copy those test costs into a new password system.
Password bytes are capped at 16 KiB, salt at 1 KiB and output at 4096 bytes. Iterations are 1–5000000, and iterations×ceil(output length/HashLen) cannot exceed 10000000. A Worker can be cancelled and has a 30-second deadline. Encoded records are checked before costly work.
Reference
Questions & answers
Is SHA-1 selected for new records?
No. Initial controls select SHA-256. SHA-1 remains available to reproduce existing applications and published test vectors.
Does a mismatch mean the tool failed?
No. A completed verification returns matches=false when the candidate bytes do not derive the recorded key. Malformed records and excessive costs produce errors instead.
Is my input uploaded or saved?
Processing runs in your browser. The tool does not put keys, passwords or content in URLs or local storage, or send them to a processing API. Clear removes visible inputs and outputs; it does not guarantee secure erasure of browser-managed memory.