Skip to content

PBKDF2

Secure

PBKDF2 (Password-Based Key Derivation Function 2) applies a pseudorandom function (usually HMAC-SHA256) repeatedly to derive a key. It is widely supported and approved by NIST, but lacks memory-hardness.

What is PBKDF2?

PBKDF2 is a secure cryptographic hash algorithm that produces a Configurable (depends on underlying hash function) output. PBKDF2 (Password-Based Key Derivation Function 2) applies a pseudorandom function (usually HMAC-SHA256) repeatedly to derive a key. It is widely supported and approved by NIST, but lacks memory-hardness. It is classified as slow (intentional) in performance and commonly used for fips/nist compliance requirements and password hashing in environments requiring government-approved algorithms.

Output Length

Configurable (depends on underlying hash function)

Speed

Slow (Intentional)

Security

Secure

Performance

Configurable iteration count. With 600,000+ iterations (OWASP recommendation), it is slow enough for password hashing but still GPU-attackable.

Use Cases

Example Hash

Input:

MyPassword123

PBKDF2 Output:

a8f5f167f44f4964e6c998dee827110c (with SHA-256, 600000 iterations, varies by salt)

Try PBKDF2 Hash Generator

Generate PBKDF2 hashes from text or files. WASM-powered, free, and 100% in your browser.

Open Hash Generator →

Related Algorithms

bcrypt Secure
184 bits (60 character encoded string)
Argon2 Recommended
Configurable (typically 256 bits / 32 bytes)
scrypt Secure
Configurable (typically 256 bits / 32 bytes)

Related Reading

SHA-256 vs SHA-512 vs MD5: Hash Algorithm Comparison → How to Create a Strong Password in 2026 → What Is JWT and How It Works →