PBKDF2 Key Derivation
Derive keys from passwords and salt using PBKDF2.
Sensitive data: Anything you enter is processed in your browser only. It is never uploaded or logged on a server.
Deriving keys with PBKDF2
Password-based key derivation stretches low-entropy passwords into cryptographic keys suitable for AES. PBKDF2 iteration counts should follow OWASP guidance and increase over time as hardware improves. Unique salts per derivation prevent rainbow table reuse.
Iteration counts that were adequate years ago may be too low today. Document parameters beside stored hashes so migrations can rehash on login. Never reuse the same salt+password pair across different encryption contexts.
Browser PBKDF2 demos educate teams but production password storage should use established libraries with Argon2id where possible.
Derive test keys locally with synthetic passwords. Do not paste production master passwords into any tool, including client-side ones, during live incidents.
Reference Guide
Security tool - all processing runs locally in your browser. No data is sent to a server.
Operation: pbkdf2-derive
Paste input, click Run, and copy the result. For two-input tools, fill both fields before running.
Example Input
my-secret-password
Example Secondary Input
demo-salt
A sample loads automatically when you open this tool. Use Load Sample to reset it.