derive_key
Derive cryptographic key bytes from a password or secret using PBKDF2, scrypt, or HKDF. Specify salt, length, and params for reproducible key derivation.
Instructions
Derive raw key bytes from a password or secret via a KDF (PBKDF2/scrypt/HKDF).
Returns the key rendered per output_format, plus the kdf, length,
salt and params actually used — everything needed to repeat the
derivation. Fully deterministic: the same inputs always give the same key, so
an omitted salt means an empty one rather than a fresh random one. Use
pbkdf2/scrypt to stretch a human password, and hkdf only to expand a secret
that is already high-entropy (a shared secret, another key). To STORE a
password for later checking, use password_hash instead — its output is a
self-describing string built to be compared against.
Example: derive_key("hunter2", kdf="pbkdf2", salt="0011223344556677",
length=32) -> {"key": "a3f1...", "params": {"iterations": 600000, ...}}
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| kdf | No | Key-derivation function. 'pbkdf2'/'scrypt' stretch a low-entropy password (slow by design); 'hkdf' (RFC 5869) expands an already-high-entropy secret and is fast — do NOT use it on a password. Default 'pbkdf2'. | pbkdf2 |
| salt | No | Salt as hex. Omitted means NO salt (an empty one), which keeps the derivation reproducible — this tool never invents a random salt, since the key would be unrecoverable. For pbkdf2/scrypt pass a real salt (16 random bytes); for hkdf omitting it is the RFC default. Echoed back as `salt`. | |
| length | No | Derived key length in bytes (1..1024). Default 32. | |
| params | No | KDF parameters overriding the defaults: pbkdf2 {iterations:600000, prf:'sha256'}; scrypt {ln:14, r:8, p:1}; hkdf {hash:'sha256', info:''} where `info` is a UTF-8 context label that binds the key to a purpose. Default None. | |
| password | Yes | The password, secret, or input keying material, read as UTF-8. Never echoed back. | |
| output_format | No | How the key is rendered (bare hex, no 0x); default 'hex'. | hex |