PBKDF2 Key Derivation Generator & Verifier

PBKDF2 (Password-Based Key Derivation Function 2, defined in RFC 8018 / PKCS #5) turns a password into a key of any length by running a pseudorandom function, almost always HMAC, thousands or millions of times over the password and a salt. The iteration count makes every guess expensive for an attacker, and the salt makes each hash unique so precomputed tables do not work. It is used for password storage (Django's default hasher), Wi-Fi WPA2 keys, password managers, and to derive encryption keys from passphrases.

Choosing parameters: use a random salt of at least 16 bytes per password, HMAC-SHA256 or HMAC-SHA512, and the highest iteration count your login latency allows. The OWASP Password Storage Cheat Sheet currently recommends 600,000 iterations for PBKDF2-HMAC-SHA256, 220,000 for HMAC-SHA512 and 1,400,000 for the legacy HMAC-SHA1 (the 2023 edition listed 600,000, 210,000 and 1,300,000). Asking for a key longer than the hash output (for example 64 bytes from SHA-256) runs the whole iteration count again for every extra block, which costs you as much as it costs an attacker, so stored password hashes normally use exactly the digest length.

Verifying stored hashes: Django stores pbkdf2_sha256$iterations$salt$hash with a text salt and a standard Base64 hash. Python's passlib uses $pbkdf2-sha256$iterations$salt$hash, where the raw salt and hash are encoded in an "adapted" Base64 that uses . instead of + and drops the padding. Werkzeug and Flask use pbkdf2:sha256:iterations$salt$hexhash. The verifier detects all three, recomputes the hash with the embedded parameters and compares it with the stored value, which is handy when migrating users between frameworks.

PBKDF2 is not memory-hard, so GPUs and ASICs can test guesses far faster than a CPU. For new systems that do not need FIPS-140 compliance, OWASP prefers Argon2id or scrypt, and bcrypt is still a good choice. To compute plain digests use the hash generator, for message signatures use the HMAC generator, and create test passwords with the password generator. Avoid typing real production passwords into any web page.