PBKDF2 Hash Generator

Generate PBKDF2 password hashes with configurable iterations, key length, and hash algorithm.

  1. Home
  2. Hash & Security
  3. PBKDF2 Hash Generator
Salt (hex) -
Derived Key (hex) -
Base64 -

What is PBKDF2?

PBKDF2 (Password-Based Key Derivation Function 2) is a key derivation function that applies a pseudorandom function (like HMAC-SHA256) many times to derive a cryptographic key from a password. It is widely used for password hashing and is recommended by NIST (National Institute of Standards and Technology).

The security of PBKDF2 comes from the iteration count — each iteration adds computational cost, making brute-force attacks slower. This tool uses the Web Crypto API's built-in PBKDF2 implementation, which is hardware-accelerated in modern browsers. The recommended minimum of 600,000 iterations follows OWASP 2023 guidelines.

How to Use

  1. Enter Password — Type or paste the password you want to hash. Click "Example" for a sample.
  2. Configure Parameters — Select the hash algorithm (SHA-256, SHA-384, or SHA-512), set iterations (default 600,000), and choose key length and salt length.
  3. Generate — Click "Generate Hash" to compute the PBKDF2 hash using the Web Crypto API.
  4. Copy Results — The generated hash, salt, derived key, and Base64 representation are all available for copying.

Frequently Asked Questions

What is the recommended number of iterations?

As of 2024, OWASP recommends at least 600,000 iterations for PBKDF2-HMAC-SHA256. For SHA-512, you can use slightly fewer iterations (around 400,000) as SHA-512 is slower per iteration. Higher iterations increase security but also increase computation time.

How is PBKDF2 different from bcrypt or argon2?

PBKDF2 is NIST-approved and widely available in many platforms and libraries. Bcrypt is memory-hard (resistant to GPU attacks) and includes salt by design. Argon2 is the most modern — it's both CPU-hard and memory-hard. PBKDF2 is pure CPU-hard, making it more vulnerable to GPU and ASIC-based attacks than bcrypt or Argon2 at similar iteration counts.

What hash format is used?

The tool outputs a PBKDF2 hash in the format pbkdf2:{algorithm}:{iterations}:{salt_base64}:{key_base64}. This format includes all parameters needed for verification — algorithm, iterations, salt, and derived key. To verify, parse the format and recompute PBKDF2 with the same parameters.

Apakah data saya disimpan?

No. Semua proses terjadi di browser Anda menggunakan Web Crypto API. Data tidak pernah dikirim ke server.