Password Hash Tool

Derived a PBKDF2-HMAC-SHA256 hash with 1,000 iterations.

How it works

• Decoded the base64 salt.
• Ran PBKDF2-HMAC-SHA256 with 1,000 iterations to derive 32 bytes.
• Encoded the iteration count, salt and derived key as a PHC-style string.

• A password hash is only as strong as its parameters and salt; use a per-password random salt and a high iteration count.
• The password and derived key stay in your browser; nothing is sent or stored.

Methodology

1. Decode the salt and parameters from the supplied encoding.
2. For PBKDF2, run the RFC 8018 block construction over HMAC-SHA256 for the requested iteration count.
3. Compare a stored key with the derived key in constant time, without early exit, so a timing signal does not leak matching prefixes.
4. For bcrypt and Argon2, parse only the encoded structure and report its parameters, stating that this tool does not compute those primitives.

Usage

1. Choose derive, verify or inspect.
2. For derive, supply a per-password salt and an iteration count; the tool outputs a PHC-style encoding.
3. For verify, paste the stored encoding and the candidate password.
4. For inspect, paste a bcrypt or Argon2 encoding to read its parameters.

Examples

These are examples, not current values: they use fixed inputs, while the interactive tool computes live results in your browser.

Derive a PBKDF2 hash (1,000 iterations)

{
  "mode": "derive",
  "password": "correct horse battery staple",
  "saltBase64": "c2FsdHktU2FsdA==",
  "iterations": 1000
}

Verify a matching PBKDF2 hash

{
  "mode": "verify",
  "password": "password",
  "hash": "$pbkdf2-sha256$i=1$c2FsdA==$Eg+2z/z4syxD5yJSVsT4N6hlSMkszDVICAWYfLcL4Xs="
}

Inspect a bcrypt encoding

{
  "mode": "inspect",
  "hash": "$2b$12$LQv3c1yqBWVHxkd0LHAkCOYz6TtxMQJqhN8/LewdBPj4J/HS.iK2"
}

Limitations

What a password hash must do

Password storage hashes must be slow and salted. A per-password random salt stops an attacker from amortising one guess across many accounts, and a high work factor makes each guess expensive. PBKDF2 expresses that work as an iteration count; bcrypt as a cost factor; Argon2 as memory, iterations and parallelism.

This tool is a development aid. It does not store hashes, manage peppers or enforce lockout, and it must not be used to check real credentials in production.

Why the bcrypt/Argon2 limit is stated, not hidden

A verifier that returns 'valid' without actually running the primitive would be worse than no tool at all. The inspect mode reports the encoding and its parameters and explicitly declines to verify, which is the honest and testable behavior the security contract requires.