Create the hash for a test admin account
Generate a pbkdf2-sha256$… value to insert a user straight into a development database or a seed file, without writing a script.
Security & privacy
PBKDF2 password hash and verify
Compute a PBKDF2 hash with a random salt, SHA-256 or SHA-512 and the OWASP-recommended iteration count, in the pbkdf2-sha256$… format, then verify a password against it. Local processing.
- Clipboard
OWASP recommends 600,000 iterations for SHA-256 and 210,000 for SHA-512: the more there are, the more each attacker guess costs.
PBKDF2 hash
Holds the algorithm, iterations, salt and hash: everything needed to verify later.
Was this tool useful?
How does this tool work?
This tool derives a PBKDF2 hash from a password with a random salt and the recommended iteration count, then verifies a password against an already encoded value. It is for developers implementing or debugging password storage, preparing a test account or wanting to understand the effect of salt and iterations.
PBKDF2, defined in RFC 8018 (PKCS #5 v2.1), applies an HMAC function to the password and salt, then feeds the result back into HMAC hundreds of thousands of times, so every attacker guess costs as much as a legitimate login. The tool offers HMAC-SHA-256 with 600,000 iterations by default and HMAC-SHA-512 with 210,000 iterations, the minimums from the OWASP Password Storage Cheat Sheet. The random salt (8 to 128 bytes, 16 by default) makes each hash unique even when two users share a password, which defeats rainbow tables. The derived key length ranges from 16 to 128 bytes, 32 by default; as a reference, PBKDF2-HMAC-SHA-256 of "password" with salt "salt", 1 iteration and 32 bytes is 120fb6cffcf8b32c43e7225256c4f837a86548c92ccc35480805987cb70be17b.
The result is encoded on one line: pbkdf2-sha256$600000$<salt>$<hash>, with the salt and hash in Base64URL. This string holds everything needed to verify a password later: algorithm, iterations, salt and expected digest. In verification mode, the tool reads these parameters, recomputes the derivation with the password you enter and compares both digests in constant time, so timing does not reveal at which byte they differ. The computation uses the Web Crypto API (deriveBits), so the password never leaves your device.
How to use this tool
Enter the password and parameters
Type the password, choose SHA-256 or SHA-512, then adjust the salt size, iteration count and key length if needed.
Derive the hash
The tool draws a random salt, computes PBKDF2 and shows the encoded value pbkdf2-sha256$iterations$salt$hash, ready to copy.
Verify a password
Paste an existing encoded value and the password to test: the result tells you whether it matches, with the algorithm and iterations read from the value.
Use cases
Debug a failing login
Paste the hash stored in the database and the expected password: the tool tells you whether they match, so you know whether the problem is the password or the verification code.
Measure the cost of iterations
Compare the computation time with 210,000 or 600,000 iterations on your machine to pick a setting that keeps logins comfortable while slowing down offline attacks.
Tips and best practices
- Do not go below the recommended iterations to save a few milliseconds: 600,000 for SHA-256 and 210,000 for SHA-512 are minimums, to be raised regularly as hardware gets faster.
- There is no point exceeding 32 key bytes with SHA-256 or 64 with SHA-512: beyond that, PBKDF2 computes a second full block, doubling your cost without slowing an attacker, who only needs the first block to test a password.
- The pbkdf2-sha256$… format looks like those of Django, passlib or Werkzeug but is not identical: separators and the encoding of salt and hash differ, so check the format your library expects before importing a value.
Frequently asked questions
Is PBKDF2 still secure in 2026?
Yes, as long as you use a high iteration count and a unique salt. Its weakness is that it uses no memory, which makes it easier to accelerate on GPUs than Argon2id or scrypt. OWASP therefore recommends Argon2id first and PBKDF2 mainly when FIPS-140 compliance is required.
What is the difference between PBKDF2, bcrypt and Argon2?
All three are slow functions designed for passwords. PBKDF2 only tunes computation time; bcrypt adds a little memory but truncates passwords at 72 bytes; Argon2id, winner of the Password Hashing Competition, tunes both time and memory. PBKDF2's advantage is that it is available everywhere, including Web Crypto and FIPS-validated modules.
How many PBKDF2 iterations should I use?
The OWASP Password Storage Cheat Sheet recommends at least 600,000 iterations for PBKDF2-HMAC-SHA256 and 210,000 for PBKDF2-HMAC-SHA512. NIST SP 800-63B simply asks for a cost as high as server performance allows. In practice, aim for about 100 ms of computation per login on your server.
Does the salt need to be secret?
No, the salt is stored in clear next to the hash, which is exactly what the pbkdf2-sha256$… value does. Its job is to be unique and random for each password, to prevent precomputed tables and to hide the fact that two users share a password. An additional secret kept outside the database, called a pepper, is a separate, optional protection.
Can the password be recovered from a PBKDF2 hash?
No, PBKDF2 is one-way: all an attacker can do is guess passwords and recompute the derivation for each one. Iterations make every guess expensive, but a common password will still be found quickly. The final strength therefore also depends on the quality of the password.
Can I type a real password into this tool?
The computation happens only in your browser with Web Crypto: neither the password nor the hash is sent anywhere. As a precaution, still prefer a test password when you generate examples or share a screenshot.
Related tools
Keep going with these tools
Tools similar or complementary to this one.
Works well with
Generate strong random passwords from 8 to 128 characters, with the entropy shown.
Security & privacyFeaturedUse this tool
Check how strong a password is: entropy, weak patterns, estimated time to crack and advice.
Security & privacyFeaturedUse this tool
Check whether two hashes or checksums match, regardless of case, spaces or colons.
Security & privacyUse this tool
Read next
GuideBest practicesIntermediate
Encryption, hashing and HMAC: understand the differences
Learn when to use encryption, hashing, HMAC or key derivation for confidentiality, integrity, authentication and password handling.
23 September 20263 min
GuideBest practicesIntermediate
OAuth 2.0, PKCE, JWT, JWK and JWKS: understand their roles
Understand how OAuth 2.0, PKCE, JWT, JWK and JWKS fit together: authorization, tokens, public keys and verification.
23 September 20262 min
GuideBest practicesBeginner
JWT: understand structure, signature, expiration and common mistakes
Learn what a JWT contains, why decoding is not verification, how claims such as exp, nbf, iss and aud work, and common security mistakes.
29 August 20261 min
GuideBest practicesBeginner
Subresource Integrity (SRI): verify external resource integrity
Understand how SRI hashes help detect unexpected changes to static third-party scripts and stylesheets, and where SRI does not apply.
29 August 20261 min