PBKDF2 Playground
Derive keys with PBKDF2-HMAC-SHA-1/256/512 using your salt, iterations and key length. Hex, Base64 and passlib output, RFC 6070 vectors verified.
PBKDF2 (RFC 8018) is computed with the browser’s Web Crypto API. OWASP recommends 600,000 iterations for HMAC-SHA-256 and 210,000 for HMAC-SHA-512. PBKDF2 is not memory-hard, so prefer Argon2id for new systems.
Verify a password against a hash
Runs entirely in your browser. Your data is never uploaded.
What is PBKDF2 Playground?
Compute PBKDF2 (RFC 8018) with HMAC-SHA-1, SHA-256 or SHA-512, any iteration count, salt and output length. Results are shown in hex, Base64 and the passlib $pbkdf2-sha256$ format, and the verifier also accepts Django pbkdf2_sha256$ hashes.
How to use PBKDF2 Playground
- Enter the Password.
- Choose the Hash function (PRF), Iterations and Key length (bytes).
- Enter a Salt and its encoding, or leave it empty for a random salt.
- Click Hash and copy the hex, Base64 or encoded result.
Example
Password password, salt salt, HMAC-SHA-1, 4096 iterations, 20 bytes
4b007901b765489abead49d926f721d065a429c1 $pbkdf2-sha1$4096$c2FsdA$SwB5AbdlSJq.rUnZJvch0GWkKcE
The hex value is RFC 6070 test vector 3.
When to use PBKDF2 Playground
Use it to derive keys for testing, reproduce RFC 6070 vectors, or verify Django and passlib hashes. For new password storage, prefer Argon2id or scrypt, which are memory-hard.
How PBKDF2 Playground works
PBKDF2 computes blocks T_i = U_1 ⊕ U_2 ⊕ … ⊕ U_c, where U_1 = HMAC(password, salt ‖ INT(i)) and U_j = HMAC(password, U_{j−1}), and concatenates them to the requested length. The browser's Web Crypto API (deriveBits) performs the computation. The passlib format stores iterations, salt and hash in adapted Base64 (+ replaced by .).
Common Use Cases
- Verifying a Django pbkdf2_sha256 hash during migration
- Reproducing RFC 6070 test vectors
- Deriving AES keys from a passphrase for testing
- Comparing iteration counts and timings
FAQs
How many iterations should I use?
OWASP recommends 600,000 for HMAC-SHA-256, 210,000 for HMAC-SHA-512 and 1,300,000 for HMAC-SHA-1.
Is PBKDF2 still acceptable?
Yes, especially where FIPS validation is required, but it is not memory-hard, so GPUs crack it faster than Argon2id or scrypt.
Why does the key length matter?
Requesting more bytes than the hash output (e.g. more than 32 for SHA-256) makes PBKDF2 compute extra blocks, multiplying the defender's cost without slowing attackers.