Password hashing / KDF
PBKDF2
Password-Based Key Derivation Function 2, specified in PKCS #5 v2.1 (RSA Labs, 2000) and republished as RFC 8018 in 2017. PBKDF2 turns a password into a key by iterating an HMAC chain thousands or millions of times; the only cost lever is iteration count.
At a glance
| Output | Any length |
|---|---|
| Cost parameter | iteration count c |
| Internal primitive | HMAC over a base hash (SHA-256 / SHA-512) |
| Memory cost | None , trivially parallelizable on GPUs |
| Standard | RFC 8018 (PKCS #5 v2.1) |
| Status | Acceptable for legacy; prefer Argon2id / scrypt for new designs |
Recommended iteration counts (2026)
- PBKDF2-HMAC-SHA-256: ≥ 600,000 (OWASP 2023 floor).
- PBKDF2-HMAC-SHA-512: ≥ 210,000.
- PBKDF2-HMAC-SHA-1: ≥ 1,300,000 (HMAC layer still safe; bump c).
Calibrate so an interactive login takes 100–500 ms on real hardware.
Where it is used
- WPA2 / WPA3 PSK , PBKDF2-HMAC-SHA-1 over passphrase + SSID.
- iOS / macOS keychain , PBKDF2 with device-calibrated cost.
- 1Password (pre-Argon2) , PBKDF2-HMAC-SHA-256.
- LastPass , historically PBKDF2-HMAC-SHA-256 (raised in 2018).
- Microsoft Office encryption , PBKDF2 within OOXML password encryption.
Why it’s no longer the first choice
No memory cost. A modern GPU can attempt millions of PBKDF2-HMAC-SHA-256 candidates per second per device. Memory-hard alternatives like Argon2id force the attacker to commit RAM per candidate, flattening the GPU advantage.
Try it
The KDF Lab includes PBKDF2 with HMAC-SHA-256 or HMAC-SHA-512 selectable and an iteration-count slider.
References
- RFC 8018 , PKCS #5: Password-Based Cryptography Specification v2.1
- OWASP , Password Storage Cheat Sheet
- Argon2id · scrypt
Generate
Run pbkdf2 on your input
16 bytes
600,000