PBKDF2 key derivation
Derive 256 bits using PBKDF2-HMAC-SHA-256 with an explicit salt and iteration count. Your inputs stay in this browser tab.
Your result
A little input. A useful result.
Your result will appear here.How to use pbkdf2 key derivation
Derive 256 bits using PBKDF2-HMAC-SHA-256 with an explicit salt and iteration count. This free tool runs locally after you choose to start.
- Enter your own values, or start with the visible example.
- Adjust password (never stored), salt as hexadecimal (16–64 bytes), iterations (100,000–1,000,000) as needed.
- Choose the action button. Review the result, then copy text or download a file when available.
- Choose Clear all when finished to remove inputs and results from the interface.
Limits, without the small print.
All cryptography runs locally in Web Crypto. Never paste live secrets into a device you do not trust. Inputs are not stored or sent. A compromised browser or served application can read inputs. A fixed example salt is for verification only. Real password records require a new random salt.
One job runs at a time. You can cancel it; jobs stop after 30 seconds. Browser and device capabilities affect performance.
Understand the safeguards →What this tool does
Derive 256 bits using PBKDF2-HMAC-SHA-256 with an explicit salt and iteration count.
Example input
Salt as hexadecimal (16–64 bytes): 00112233445566778899aabbccddeeff Iterations (100,000–1,000,000): 600000
What to expect
Choose Run to calculate the example in your browser. The result can be copied or cleared.
A couple of useful answers.
Does pbkdf2 key derivation upload my data?
No. This tool processes your input in a browser worker. Your text and files are not sent to an application server. The static host receives page and asset requests; see our privacy explanation.
Is this tool free for work and study?
Yes. No account, paid API, usage subscription or watermark fee is required. You remain responsible for your content rights and checking results. Hosting providers and their free tiers are separate from this open-source software.
What should I check before relying on the result?
All cryptography runs locally in Web Crypto. Never paste live secrets into a device you do not trust. Inputs are not stored or sent. A compromised browser or served application can read inputs. A fixed example salt is for verification only. Real password records require a new random salt. Review important outputs against the source, especially financial, legal, identity, medical and research calculations.