PBKDF2 Key Derivation
Derive a key from a password with PBKDF2, choosing the salt, iteration count, digest and output length.
Password
Salt
Turning a password into a key
PBKDF2 stretches a password into a key of the length you need, by running HMAC over it tens of thousands of times. The repetition is the point: it makes each guess expensive for an attacker who has stolen your database.
A salt — unique per user, not secret — stops one precomputed table from cracking every account at once. Never reuse a salt, and never omit it.
- OWASP currently suggests at least 600,000 iterations for PBKDF2-HMAC-SHA-256.
- Key length should match what consumes it: 32 bytes for AES-256, 16 for AES-128.
- For new systems, Argon2id is a better choice; PBKDF2 remains the one available in Web Crypto and required by many standards.
Frequently asked questions
Why is a high iteration count slow here?
Because it is supposed to be. The derivation runs on your device, so 600,000 iterations takes a noticeable moment — exactly the cost an attacker pays per guess.
Is PBKDF2 still acceptable?
Yes, with a high iteration count and a per-user salt. It is FIPS-approved and available everywhere, which is why it is still specified even though Argon2id resists GPU attacks better.