PBKDF2 Key Derivation Calculator
Derive keys from passwords using PBKDF2-HMAC. Choose hash, iterations, salt, and key length. Verify existing hashes. All in-browser — no data upload.
About PBKDF2
PBKDF2 (Password-Based Key Derivation Function 2) is defined in RFC 2898. It derives a cryptographic key from a password by applying a pseudorandom function (typically HMAC) repeatedly. The key parameters are:
- Password — the input secret
- Salt — random bytes to prevent rainbow table attacks (minimum 16 bytes recommended)
- Iterations — number of HMAC rounds (higher = slower = more resistant to brute force)
- Hash — the HMAC hash function (SHA-256 is standard; SHA-1 is deprecated but still used in some protocols)
- Key length — output key size in bytes
Common Use Cases
| Use Case | Hash | Iterations | Key Length |
|---|---|---|---|
| WPA2 Wi-Fi PSK | SHA-1 | 4,096 | 32 bytes (256 bit) |
| iOS Keychain (PBKDF2) | SHA-256 | 100,000 | 32 bytes |
| 1Password (OPSL format) | SHA-256 | 100,000 | 32 bytes |
| OWASP 2023 recommendation | SHA-256 | 600,000 | 32 bytes |
| JWT HS256 key from password | SHA-256 | 100,000 | 32 bytes |
| Android Keystore (pre-2019) | SHA-256 | 10,000 | 32 bytes |
WPA2 Wi-Fi Key Derivation
WPA2 uses PBKDF2-HMAC-SHA1 with 4,096 iterations to derive the Pairwise Master Key (PMK) from the Wi-Fi password and SSID:
PMK = PBKDF2-HMAC-SHA1(password=wifi_password, salt=ssid, iterations=4096, dkLen=32)For related tools, see HMAC Generator, Hash Digest Calculator, and AES / SM4 Encryption.
Understanding PBKDF2 Parameters
PBKDF2 applies a pseudorandom function (typically HMAC-SHA-256) to the password and salt iteratively. Each iteration feeds its output back as input to the next, creating a chain that cannot be shortcut — an attacker must perform every iteration to verify a guess. This is what makes PBKDF2 "computationally expensive" for brute-force attacks: each password attempt costs the same number of HMAC operations as the original derivation. The salt ensures that two users with the same password get different derived keys, defeating precomputed rainbow tables.
Why Iteration Count Matters
The iteration count is your primary defense knob. With 1,000 iterations, a consumer GPU can try roughly 500,000 passwords per second. At 600,000 iterations (OWASP 2023 recommendation for SHA-256), that drops to about 800 per second. The cost to the legitimate user is a one-time 100-300ms delay during login — noticeable but acceptable. The cost to an attacker is proportional: they must spend 600,000 HMAC operations per guess. The sweet spot balances user experience against the speed of modern hardware, which is why OWASP revises recommendations upward every few years as GPUs get faster.
PBKDF2 vs Argon2id vs scrypt vs bcrypt
PBKDF2 is the oldest and most widely supported KDF, but it has a fundamental weakness: it is memory-light. An attacker with a GPU or ASIC can parallelize millions of PBKDF2 computations simultaneously because each only needs a few hundred bytes of memory. scrypt addresses this by requiring a configurable amount of memory per derivation, making GPU parallelization expensive. Argon2id (the Password Hashing Competition winner) combines memory-hardness with resistance to side-channel attacks, making it the current best practice. bcrypt has a built-in adaptive cost factor and moderate memory requirements. For new systems in 2026, use Argon2id. For legacy systems or where Argon2 is unavailable (like browser-only Web Crypto API), PBKDF2 with 600,000+ iterations remains acceptable.
WPA2 PSK Derivation Deep Dive
WPA2-Personal (WPA2-PSK) uses PBKDF2-HMAC-SHA1 with 4,096 iterations to derive the 256-bit Pairwise Master Key (PMK) from the passphrase and SSID. The SSID serves as the salt — this is why two networks with the same password but different names produce different PMKs. This derivation runs on the device when connecting to Wi-Fi, not on a server, which is why the iteration count is relatively low (4,096): mobile devices need to connect within a few seconds. The low iteration count makes WPA2-PSK vulnerable to offline brute-force if an attacker captures the 4-way handshake — tools like hashcat can try millions of passwords per second on a GPU. WPA3 replaces this with SAE (Simultaneous Authentication of Equals), which provides forward secrecy and resists offline attacks.
Using PBKDF2 for Key Wrapping in Smart Card Systems
In some smart card deployment scenarios, PBKDF2 is used to derive a key encryption key (KEK) from an administrator password. The KEK then wraps (encrypts) the actual card master key for storage or transport. This adds a password-based access control layer: even if the encrypted key file is stolen, the attacker must brute-force the password (protected by PBKDF2's iteration count) to recover the master key. When using PBKDF2 for this purpose, use SHA-256 with at least 600,000 iterations, a 32-byte random salt, and store the salt alongside the encrypted key (the salt is not secret, just unique). Never use PBKDF2-SHA1 for new key wrapping — SHA-1's collision weakness, while not directly breaking HMAC, provides no reason to prefer it.