---
title: "PBKDF2 Generator - Derive Keys Online | CanDoYa"
description: "PBKDF2 generator to derive hex or Base64 keys from a password with configurable salt, hash, iterations and length. Runs locally in your browser."
url: https://candoya.com/tools/pbkdf2-derive/
locale: en
type: browser-tool
---

# Free PBKDF2 Generator

Category: Developer

## What is a PBKDF2 generator?

A PBKDF2 generator turns a password or passphrase into fixed-length key material by repeatedly applying an HMAC hash with a salt. Set the salt, hash, iteration count and output length to reproduce the same bytes in another compatible system. This page performs the derivation locally with Web Crypto.

PBKDF2 is useful when an existing protocol or compliance requirement specifies it. A random salt prevents identical passwords from producing identical stored values, while the iteration count raises the cost of each password guess. Save the salt, hash, iterations and key length beside the result because all four parameters are needed for later verification.

## How to use it

1. **Enter the password** - Type the password or passphrase that will provide the input key material.
2. **Set the salt** - Use the generated 16-byte hexadecimal salt or paste the exact salt required by your protocol.
3. **Choose the parameters** - Select the HMAC hash, iteration count, output length and output encoding.
4. **Derive and copy** - Click Derive key, then copy the resulting hex or Base64 bytes.

## Who it's for

- **Protocol compatibility** - reproduce key material for systems that specify PBKDF2 parameters.
- **Test-vector checks** - compare browser output with Python, OpenSSL, Java or .NET implementations.
- **Password-storage experiments** - see how salts and work factors change a derived value.
- **Encryption prototypes** - derive fixed-length bytes for a local proof of concept before implementing key management.

## Expert note

PBKDF2 inputs are byte sequences, not abstract text. This tool encodes the password as UTF-8 and reads the salt as hexadecimal bytes, so cross-language results match only when the other implementation uses those same encodings and identical parameters.

## Frequently asked questions

### Is my password uploaded?

No. The browser uses its local Web Crypto implementation, and the password, salt and result remain in this tab. The page does not send them to a derivation service.

### Is this PBKDF2 generator free?

Yes. You can derive keys without an account, payment or usage limit. Very large iteration counts can take longer because the work happens on your device.

### What limits does the tool enforce?

The iteration count can range from 1 to 10,000,000 and the output can range from 1 to 1,024 bytes. Salts must be valid hexadecimal and at least 8 bytes long.

### Which PBKDF2 settings should I use?

Match the protocol you are implementing. For FIPS-oriented password storage, current OWASP guidance lists PBKDF2-HMAC-SHA-256 with 600,000 or more iterations, but production work factors should be benchmarked and reviewed as guidance changes.

### Why does PBKDF2 need a salt?

A unique random salt makes the same password derive a different value for each record. That blocks useful precomputed tables and forces an attacker to test guesses separately against each salt.

### Can I reproduce the output in Python or OpenSSL?

Yes. Use UTF-8 password bytes, decode the displayed salt from hex, and supply the same HMAC hash, iteration count and key length. Encoding the final bytes as hex or Base64 does not change the bytes themselves.

### Is PBKDF2 the best choice for a new password database?

Not always. OWASP generally prefers Argon2id, with scrypt as another memory-hard option. PBKDF2 remains useful when a standard, existing system or FIPS requirement calls for it.

## Related tools

- [HMAC Generator](https://candoya.com/tools/hmac-generator/)
- [SHA-256 Hash Generator](https://candoya.com/tools/sha-256-hash/)
- [Password Generator](https://candoya.com/tools/password-generator/)
- [File Hash Calculator](https://candoya.com/tools/file-hash/)
- [RSA Key Pair Generator](https://candoya.com/tools/rsa-key-pair-generator/)

---

*Markdown edition of <https://candoya.com/tools/pbkdf2-derive/>, published for AI agents and other automated readers. Index of key pages: <https://candoya.com/llms.txt>.*