crypto_pbkdf2
Derive a PBKDF2 password hash from a plaintext password using a chosen HMAC digest, iteration count, and key length, returning the derived key and a self-describing encoded hash.
Instructions
PBKDF2 Hash Generator. Derive a PBKDF2 password hash from a plaintext password using a chosen HMAC digest, iteration count, and key length, returning the derived key plus a self-describing encoded hash. Use this to create a new hash; use crypto_pbkdf2_verify to check a password against one. PBKDF2 is the legacy/FIPS-friendly KDF — prefer crypto_argon2 (memory-hard) or crypto_bcrypt for new password storage, and crypto_scrypt for memory-hard derivation. Runs locally on the input you provide: read-only, non-destructive, contacts no external service, rate-limited (5 requests/min anonymous). When no salt is supplied a random 16-byte salt is generated, so output is non-deterministic. Returns the derived key (hex and base64), a passlib-style $pbkdf2-... string, the salt, the resolved parameters, and a strength analysis.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| password | Yes | The plaintext password (passphrase) to derive a key from. Required and non-empty. | |
| algorithm | No | HMAC digest backing the derivation. sha256/sha512 recommended; md5 and sha1 are cryptographically weak. | sha256 |
| iterations | No | Number of PBKDF2 rounds. Higher is slower and stronger. | |
| length | No | Derived key length in bytes. | |
| salt | No | Optional salt string (8–128 characters). If omitted or empty, a random 16-byte (32 hex char) salt is generated and returned. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| password | No | The plaintext password (echoed from the request). | |
| hash | No | Derived key encoded as lowercase hex. | |
| base64Hash | No | Derived key encoded as base64. | |
| formattedHash | No | Passlib-style encoded hash: $pbkdf2-<algorithm>$<iterations>$<salt>$<base64DerivedKey>. | |
| algorithm | No | Resolved digest token: sha1, sha256, sha384, sha512, or md5. | |
| algorithmName | No | Human-readable algorithm name, e.g. SHA-256. | |
| iterations | No | Iteration count used. | |
| length | No | Derived key length in bytes. | |
| salt | No | Salt used (supplied value or the generated 32-hex-char salt). | |
| saltLength | No | Character length of the salt. | |
| security | No | Strength analysis of the chosen parameters. | |
| generatedAt | No | ISO 8601 timestamp of generation. | |
| verified | No | Self-check that the generated formattedHash verifies against the password (always true on success). |