Runs in your browser · nothing uploaded

PBKDF2 Key Deriver — Password → Strong Key (SHA-256)

Derive a cryptographic key from a password with PBKDF2-HMAC-SHA256. Tunable iterations, random or custom salt, hex or base64 output. Runs in your browser.

Loading tool…

More tools

All free, all private — everything runs in your browser.

Keys

AES Encryption Tool

Encrypt or decrypt with your own AES-128/256 key and IV in GCM or CBC mode. A raw, explicit bench for learning and development — runs entirely in your browser.

Keys

RSA Keypair Generator

Generate an RSA-OAEP keypair in your browser and export the public and private keys as PEM files. 2048, 3072, or 4096 bits. No upload, no server, free.

Files

File Encryptor

Password-protect any file before you email or share it. AES-256-GCM with a PBKDF2-derived key, performed locally by your browser — no upload, no signup. Free.

FilesPro

Bulk File Encryptor

Batch-encrypt many files with a single password into one downloadable .sealbox archive, and restore them all at once. AES-256-GCM per file, performed locally — no upload. SealBox Pro.

Text

Text Encryptor

Turn any message into a shareable encrypted string and back. AES-256-GCM with PBKDF2 key derivation, performed locally by your browser. No upload, free.

TextPro

Encrypted Notes Vault

Keep private notes encrypted with a master password, stored only on your device. The master password derives an AES-256-GCM key and is never stored. 100% client-side. SealBox Pro.

How to use PBKDF2 Key Deriver

  1. 1Enter the password to derive a key from.
  2. 2Generate a random salt or paste your own (hex), and set the iteration count (600,000 is the OWASP 2023 default).
  3. 3Pick the output length and format (hex or base64).
  4. 4Click Derive — the resulting key bytes were computed entirely in your browser and never leave it.

PBKDF2 Key Deriver FAQ

What is PBKDF2 and why does it matter?
PBKDF2 turns a human password into a full-strength cryptographic key by hashing it many times with a salt. The repeated work (the iteration count) makes brute-force guessing of the password vastly more expensive, which is why a password-derived AES key should always go through PBKDF2 rather than being the password itself.
How many iterations should I use?
OWASP's 2023 guidance recommends at least 600,000 iterations for PBKDF2-HMAC-SHA256, which is this tool's default. More iterations slow every guess — yours and an attacker's — so pick the highest value that stays tolerable for your use.
What is the salt for?
The salt is random public data mixed into the derivation so the same password produces different keys on different occasions. That defeats precomputed rainbow tables and hides equal passwords. Store it alongside the derived key's ciphertext — SealBox's file and text encryptors handle this for you automatically.