# Key Derivation Lab

> Derive keys with PBKDF2, scrypt, Argon2id and HKDF; compare costs with OWASP advice. Derives keys from a password and salt with PBKDF2 (SHA-1/256/512), scrypt, Argon2id and HKDF using the parameters you choose, and compares their memory and work settings with the OWASP Password Storage recommendations. With JavaScript on, PBKDF2, HKDF and scrypt run locally in your browser and show real timings.

Part of usefulweb.site (https://usefulweb.site/). Results are deterministic calculations from the inputs and the listed assumptions; the API returns exactly what the web page shows.

## Use it
- Human interface: https://keyderivationlab.usefulweb.site/ (interactive tool at https://keyderivationlab.usefulweb.site/tool)
- JSON API: POST https://keyderivationlab.usefulweb.site/api/v1/calculate with a JSON object of inputs (schema: https://keyderivationlab.usefulweb.site/api/v1/tool)
- OpenAPI: https://keyderivationlab.usefulweb.site/openapi.json
- MCP (Streamable HTTP): https://keyderivationlab.usefulweb.site/mcp - tool `key_derivation_lab`

## Inputs
- password (text, required): Password or input key material
- passwordFormat (select): Password is
- salt (text, required): Salt - Use a random, unique salt of 16 bytes per password in real systems.
- saltFormat (select): Salt is
- algorithms (multiselect): Functions
- keyLength (integer): Output length
- pbkdf2Iterations (integer): PBKDF2 iterations - Empty = OWASP value for each hash (SHA-1 1,300,000; SHA-256 600,000; SHA-512 210,000).
- scryptLogN (integer): scrypt cost N = 2^…
- scryptR (integer): scrypt block size r
- scryptP (integer): scrypt parallelism p
- argon2MemoryKiB (integer): Argon2 memory
- argon2Passes (integer): Argon2 passes (t)
- argon2Parallelism (integer): Argon2 parallelism (p)
- hkdfInfo (text): HKDF info (context)
- outputEncoding (select): Output

## Method
- PBKDF2 (RFC 8018) repeats HMAC with the chosen hash; its cost is the iteration count and it needs almost no memory, so GPUs attack it efficiently.
- scrypt (RFC 7914) needs about 128 × N × r bytes of memory per derivation, which makes large-scale guessing expensive. Argon2id (RFC 9106, winner of the Password Hashing Competition) is configured by memory m, passes t and lanes p; OWASP recommends it first.
- HKDF (RFC 5869) extracts and expands keys from input that is already random (for example a Diffie–Hellman secret); it is fast and must not be used to hash passwords.
- "Meets OWASP" compares your parameters with the minimums of the OWASP Password Storage Cheat Sheet (Argon2id m/t combinations; scrypt N×r ≥ 2^17×8; PBKDF2 1,300,000 / 600,000 / 210,000 iterations for SHA-1 / SHA-256 / SHA-512).
- Server and API results contain no timings, so the same input always gives the same result. With JavaScript on, the page derives PBKDF2 and HKDF with WebCrypto and scrypt with a built-in JavaScript implementation in your browser and shows how long each took on your device. Argon2 is not available in browsers, so it needs the server (you are asked first).

## Limits
- Never reuse the example salts. For real password storage use a maintained library that encodes parameters and salt (e.g. the PHC string format).