RevealTheme logo

密码哈希生成器(PBKDF2)

使用PBKDF2-SHA256在你的浏览器中生成安全的密码哈希。比MD5或简单SHA更强,工作因子可调。

如何使用本工具

  1. 1

    Type or paste the password you want to hash.

  2. 2

    Optionally set a salt (leave it blank for a secure random one) and choose an iteration count.

  3. 3

    Click Hash. The salted PBKDF2-SHA256 digest is derived entirely in your browser.

什么是密码哈希生成器(PBKDF2)?

Bcrypt是一种流行的密码哈希算法,但它需要服务器端的库。本工具使用PBKDF2(Password-Based Key Derivation Function 2,基于密码的密钥派生函数2)生成强度相当的哈希,这是一种由NIST推荐、迭代次数可调的算法。bcrypt和PBKDF2都会刻意减慢暴力破解攻击的速度;适当的迭代次数会使每次尝试耗时约250毫秒。

常见使用场景

  • Learn how salted, iterated password hashing works by watching the output change with the salt and work factor.

  • Generate test hashes to seed a development database without wiring up your real auth code.

  • Produce a reference digest to confirm your server-side PBKDF2 implementation matches for the same inputs.

  • Demonstrate to a team why MD5/SHA-1 password storage is unsafe versus a deliberately slow KDF.

  • Create a one-off credential for a script or prototype where pulling in a full auth library is overkill.

  • Benchmark how iteration count affects hashing time on your hardware to pick a sensible work factor.

常见问题

这是真正的bcrypt吗?
不是:这是PBKDF2-SHA256,在安全保障上与之类似。若需要字面意义的bcrypt格式,请使用服务器端工具(Node的bcrypt npm包或PHP的password_hash())。
我应该使用多少次迭代?
对于SHA-256,超过10万次是OWASP目前的指导建议。迭代越多,对你和攻击者来说都越慢。

相关工具