How to use Password KDF
- 1. Enter a password. It never leaves this tab.
- 2. Pick PBKDF2, {SHA}, or bcrypt. PBKDF2 uses 100k iterations.
- 3. Hash or verify. Paste an existing hash to compare.
- 4. Copy the encoded string. Ready for a fixture, not for production policy.
About this tool
Password hashes belong in KDFs, not raw SHA-256. This tool runs PBKDF2-SHA256 via Web Crypto, Apache {SHA} (SHA-1 + Base64), and bcryptjs so you can mint a fixture or verify a hash without a server.
What is missing
Argon2 and scrypt are not shipped. bcrypt cost is capped at 12 to keep the tab responsive.
{SHA} is weak
It exists for htpasswd compatibility. Prefer bcrypt or PBKDF2 for new stores.
Code examples
PBKDF2 record
salthex:derivedhex