{
  "slug": "pbkdf2-derive",
  "name": "gizza-ai/pbkdf2-derive",
  "version": "0.1.0",
  "title": "PBKDF2 Key Derivation — derive a key from a password — gizza.ai",
  "description": "Derive a key from a password with PBKDF2-HMAC (SHA-1/256/512). Pick iterations, salt, length and hex/base64 output — all in your browser. Nothing is uploaded.",
  "tags": [
    "pbkdf2",
    "key derivation",
    "kdf",
    "pbkdf2-hmac-sha256",
    "derive key from password",
    "rfc 2898",
    "rfc 8018",
    "password based key derivation"
  ],
  "category": "security",
  "urls": {
    "page": "https://gizza.ai/tools/pbkdf2-derive/",
    "markdown": "https://gizza.ai/tools/pbkdf2-derive/index.md",
    "descriptor": "https://gizza.ai/tools/pbkdf2-derive/tool.json",
    "deep_link_example": "https://gizza.ai/tools/pbkdf2-derive/?password=The%20password%20%2F%20passphrase&mode=derive&salt=Unique%20random%20salt%20%28recommended%29&salt_encoding=utf8&iterations=100000&hash=sha256&length=32&encoding=hex&expected=hex%20or%20base64%20key%20to%20check%20against"
  },
  "cli": "gizza tool pbkdf2-derive \"The password / passphrase\"",
  "tool": {
    "description": "Derive a cryptographic key from a password using PBKDF2 (RFC 2898 / RFC 8018) with HMAC, or verify a password reproduces a key. Choose mode (derive default, verify), the hash (sha1, sha256 default, sha512), iteration count (default 100000), salt (with salt_encoding utf8/hex/base64), output length in bytes (default 32), and output encoding (hex default or base64); verify checks against the `expected` key. Deterministic — the same inputs always produce the same key. Runs locally; the password never leaves the device.",
    "parameters": {
      "additionalProperties": false,
      "properties": {
        "encoding": {
          "default": "hex",
          "description": "Output encoding of the derived key (derive mode): hex (default) or base64.",
          "enum": [
            "hex",
            "base64"
          ],
          "type": "string"
        },
        "expected": {
          "description": "The expected derived key (hex or base64, auto-detected) to check against (verify mode only). Its byte length sets the derived length.",
          "type": "string"
        },
        "hash": {
          "default": "sha256",
          "description": "HMAC pseudorandom function (default sha256). sha1 is for legacy compatibility only.",
          "enum": [
            "sha1",
            "sha256",
            "sha512"
          ],
          "type": "string"
        },
        "iterations": {
          "description": "Iteration count (default 100000). Higher is slower and more brute-force resistant; OWASP suggests 600000 for PBKDF2-HMAC-SHA256.",
          "maximum": 10000000,
          "minimum": 1,
          "type": "integer"
        },
        "length": {
          "description": "Derived key length in bytes (default 32).",
          "maximum": 1024,
          "minimum": 1,
          "type": "integer"
        },
        "mode": {
          "default": "derive",
          "description": "derive (default) produces a key; verify checks the password+params against the `expected` key.",
          "enum": [
            "derive",
            "verify"
          ],
          "type": "string"
        },
        "password": {
          "description": "The password (passphrase) to derive a key from, or to verify.",
          "type": "string"
        },
        "salt": {
          "description": "The salt. Defaults to empty; for real key derivation use a unique random salt per key.",
          "type": "string"
        },
        "salt_encoding": {
          "default": "utf8",
          "description": "How to interpret the salt string: utf8 text (default), hex, or base64.",
          "enum": [
            "utf8",
            "hex",
            "base64"
          ],
          "type": "string"
        }
      },
      "required": [
        "password"
      ],
      "type": "object"
    }
  }
}