PBKDF2 Key Derivation Calculator
Derive keys from passwords using PBKDF2-HMAC. Choose hash, iterations, salt, and key length. Verify existing hashes. All in-browser — no data upload.
Input Parameters
1K
10K
100K
600K
1M
WPA2
WPA2 Wi-Fi
OWASP 2023
JWT RS256
iOS Keychain
Derived Key
Hex
—
Base64
—
Parameters Summary
—
Time
—
Verify a Hash
About PBKDF2
PBKDF2 (Password-Based Key Derivation Function 2) is defined in RFC 2898. It derives a cryptographic key from a password by applying a pseudorandom function (typically HMAC) repeatedly. The key parameters are:
- Password — the input secret
- Salt — random bytes to prevent rainbow table attacks (minimum 16 bytes recommended)
- Iterations — number of HMAC rounds (higher = slower = more resistant to brute force)
- Hash — the HMAC hash function (SHA-256 is standard; SHA-1 is deprecated but still used in some protocols)
- Key length — output key size in bytes
Security recommendations (2026): OWASP recommends at least 600,000 iterations for PBKDF2-HMAC-SHA256 (or 1,300,000 for SHA-1). Always use a unique random salt of 16+ bytes per password. For new systems, consider Argon2id or scrypt as they resist GPU/ASIC attacks better than PBKDF2.
Common Use Cases
| Use Case | Hash | Iterations | Key Length |
|---|---|---|---|
| WPA2 Wi-Fi PSK | SHA-1 | 4,096 | 32 bytes (256 bit) |
| iOS Keychain (PBKDF2) | SHA-256 | 100,000 | 32 bytes |
| 1Password (OPSL format) | SHA-256 | 100,000 | 32 bytes |
| OWASP 2023 recommendation | SHA-256 | 600,000 | 32 bytes |
| JWT HS256 key from password | SHA-256 | 100,000 | 32 bytes |
| Android Keystore (pre-2019) | SHA-256 | 10,000 | 32 bytes |
WPA2 Wi-Fi Key Derivation
WPA2 uses PBKDF2-HMAC-SHA1 with 4,096 iterations to derive the Pairwise Master Key (PMK) from the Wi-Fi password and SSID:
PMK = PBKDF2-HMAC-SHA1(password=wifi_password, salt=ssid, iterations=4096, dkLen=32)WPA2 salt = SSID (case-sensitive). The SSID is the Wi-Fi network name. Two networks with the same password but different SSIDs produce different PMKs. Always include the SSID when deriving WPA2 keys.
For related tools, see HMAC Generator, Hash Digest Calculator, and AES / SM4 Encryption.