Generate a PBKDF2 Hash — Free Key Derivation Tool

Verify a PBKDF2 Password Hash Against a Stored Hash

The pbkdf2 hash verification panel re-derives a hash from a submitted plaintext password and compares it against a stored hash using a secure time-safe comparison algorithm that eliminates timing attacks. Paste the original stored hash string and enter the candidate password; the tool will display one of two outcomes:

• ✔ Password verified successfully — the re-derived hash matches the stored hash exactly.
• ✖ Password does not match — the plaintext password is incorrect or the hash has been tampered with.

During hash verification, the tool performs algorithm detection and hash parsing automatically — it reads the algorithm used, the rounds applied, the salt, and the output size directly from the stored hash string, so you never need to enter those parameters manually. Any outdated pbkdf2 parameters (e.g., 1000 iterations with SHA-1) trigger warnings alongside actionable recommendations to upgrade your protection configuration. This mirrors user login validation as it works in real-world backend systems, from Django to Spring Security to custom server-side services.

// Result status output
✔ Password verified successfully
// Weak parameter warnings (if applicable)
⚠ Iterations below OWASP minimum — consider upgrading to 310,000 for SHA-256

Why PBKDF2 Is a Trusted PBKDF2 Hash Generator and Verification Online Standard

PBKDF2 Security Analysis: Algorithm Strength, GPU Resistance, and Status

PBKDF2 — the Password-Based Key Derivation Function 2 — is a password-based key derivation algorithm defined in RFC 8018 (which supersedes RFC 2898, also known as PKCS #5 v2.0). It was originally developed by RSA Laboratories as part of their Public-Key Cryptography Standards (PKCS series), specifically PKCS #5, and was later standardized by the Internet Engineering Task Force. It replaced the earlier PBKDF1, which was limited to outputs of at most 160 bits — a constraint that made it unsuitable for modern strength requirements.

The core mechanism is key stretching: the algorithm applies an HMAC-based pseudorandom function (typically HMAC-SHA256 or HMAC-SHA512) iteratively — that is, iteratively applied — for the configured number of rounds. Each round feeds the output of the previous round back into the HMAC, making each password guess computationally expensive. This is what makes PBKDF2 cpu-hard: an attacker must spend meaningful CPU time on every single guess, dramatically slowing brute force and password cracking attempts.

The security summary below gives you a snapshot of how PBKDF2 compares to alternatives across the key axes of credential protection:

What Iteration Count Should You Use for PBKDF2-HMAC-SHA256?

The number of iterations is the primary lever for controlling brute-force resistance. Current guidance from the OWASP Password Storage Cheat Sheet and NIST SP 800-63B — the Digital Identity Guidelines for credential protection — recommends a minimum of 310,000 iterations for PBKDF2-HMAC-SHA256. For SHA-512, 210,000 rounds is the equivalent workload target given the higher per-round cost. The rounds value should be tuned to the highest number your server can sustain without exceeding an acceptable login latency (typically 100–300 ms). Early default implementations used 1000 iterations, which is far too low by modern standards and will trigger warnings in the Security Summary panel of this tool.

Real-World Use Cases for PBKDF2 Hashing Across Languages and Frameworks

The pbkdf2 hash tool above is useful for learning, testing, and debugging — but the same PBKDF2 logic runs inside many of the frameworks and developer tools you already use. Here are the most common development use cases:

• Credential storage in web applications — process every user password at registration; store only the pbkdf2 hash and never the original input.
• Symmetric key derivation from user passphrases — use PBKDF2 to produce output of the correct key size for AES or other symmetric ciphers, particularly when deployed on cloud hosting platforms where passphrase-based protection is needed.
• Token generation — derive high-entropy tokens from user-supplied seeds with configurable output sizes.
• FIPS 140-2 adherence — environments in regulated industries (finance, healthcare, government) that mandate FIPS-approved algorithms must use PBKDF2 rather than newer alternatives.
• Cross-language interoperability — PBKDF2 is natively available in server-side JavaScript (crypto.pbkdf2), Python (passlib, hashlib.pbkdf2_hmac), Java (SecretKeyFactory), PHP (hash_pbkdf2), and Go (golang.org/x/crypto/pbkdf2).

For server-side JavaScript developers, the pbkdf2-password-hash open source module offers a clean promise-based interface. Install it via npm:

$ npm install --save pbkdf2-password-hash

The module exposes two primary methods — hash() for generation and compare() for credential verification. Below is the full function signature and example usage:

import passwordHash from 'pbkdf2-password-hash';

// hash(password, [salt], [opts])
// opts.digest    = 'sha512'   (digest algorithm)
// opts.iterations = 120000   (hash rounds)
// opts.keylen    = 64        (output size bytes)
// opts.saltlen   = 32        (salt length bytes)
// Returns a Promise that resolves to a formatted hash string

// Generates random salt automatically — salt opts are optional
passwordHash.hash('password').then((hash) => {
  // hash === 'sha512$120000$64$hBKkXNgl006Vd...==$zkq/ubSJ...'
  console.log(hash);
});

// Custom iterations and algorithm
passwordHash.hash('password', undefined, {
  iterations: 310000,
  digest: 'sha256',
  keylen: 32,
  saltlen: 16
}).then((hash) => {
  // hash === 'sha256$310000$32$...salt_b64...$...hash_b64...'
});

// With explicit opts.keylen and custom salt input
passwordHash.hash('password', 'my-hex-salt', {
  iterations: 100,
  digest: 'sha1',
  keylen: 16,
  saltlen: 16
}).then((hash) => {
  // hash === 'sha1$100$16$fwzPKhZjCQSZMz+hY7A29A==$KdGdduxkKd08FDUuUVDVRQ=='
});

// compare(password, passwordHash)
// Performs a time-safe comparison to prevent timing attacks
// Returns Promise<boolean>

import passwordHash from 'pbkdf2-password-hash';

const storedHash = 'sha512$120000$64$hBKkXNgl006Vd...==';

passwordHash.compare('password', storedHash).then((match) => {
  // match === true → ✔ Password verified successfully
  // match === false → ✖ Password does not match
  console.log(match ? '✔ Match' : '✖ No match');
});

The compare function automatically handles hash parsing, algorithm detection, and hash recompute — it extracts the salt opts, rounds count, and output size from the stored hash string, re-derives the hash using the submitted input, and performs a secure time-safe comparison. A match returns true; a mismatch returns false. You can run the tests with $ npm test. The license is MIT; releases and contributors are listed in the repository on GitHub. The packages page lists all published versions.

For the Python module passlib, the storage format encodes hashes as $pbkdf2-algo$rounds$salt_b64$hash_b64. The passlib format is also compatible with Django, which uses a closely related pattern: pbkdf2_algo$rounds$salt$hash_b64. Both formats embed all parameters inline, so the pbkdf2 decoder built into the verification tool can parse and verify without any additional stored metadata. The sha256 digest is the default in both frameworks; switching to sha512 requires a single configuration change.

The Stanford Javascript Crypto Library (SJCL) and CryptoJS also provide browser-side implementation options, though server-side processing is strongly preferred for production credential storage. The following sample shows how SJCL performs client-side derivation with a sha256 digest, a hex codec for the salt input, and an output size parameter in bits rather than bytes — a common gotcha in SJCL integrations:

// SJCL: keyLength parameter is in BITS; keysize input is in bytes
var input = 'Testing 123',
    salt  = 'de052f55e045f5d5d6038a44ddb1c6fb27e71960ccb7f9827457955dec96d7d1',
    keyLength  = 32 * 8,  // output size bits = 256
    iterations = 1000;    // rounds (legacy — increase for production)

var saltBits = sjcl.codec.hex.toBits(salt);
var output   = sjcl.codec.hex.fromBits(
  sjcl.misc.pbkdf2(input, saltBits, iterations, keyLength)
);
// result output:
// c2e770ad377b0632afaa4c68c3e5234298f01a5e733d6902a92e9be56b8cc937

Note that the email address is a common choice for an early-generation salt string in tutorials — for example, using the user's email as a deterministic salt input. This is acceptable only when combined with a strong random secondary salt; a pure email-based salt offers zero randomness and undermines salt randomness entirely. Always use CSPRNG-generated binary data as your primary salt and store it alongside the output digest and salt values.

Frequently Asked Questions About PBKDF2 Hash Generation and Verification

$pbkdf2-sha256$310000$salt_b64$hash_b64

pbkdf2_sha256$310000$salt$hash_b64