HKDF

Derive key material with HKDF

HKDF (HMAC-based Extract-and-Expand Key Derivation Function, RFC 5869) derives bytes from existing high-entropy or protocol-provided input keying material such as a shared secret, PSK, or master secret. It is not a password hashing function. For passwords, prefer PBKDF2 or a dedicated modern password KDF.

This page supports three RFC 5869 operation forms:

• HKDF: Extract + Expand. Input is IKM. Uses optional salt and info, plus output length.
• HKDF-Extract: IKM + optional salt → PRK. Output length is always HashLen for the selected hash.
• HKDF-Expand: PRK + optional info → OKM. Input must be a PRK of at least HashLen bytes, not raw IKM.

hash is required. For Extract and full HKDF, empty or omitted salt is treated as HashLen zero bytes. info binds derived Expand/full-HKDF output to a protocol or application context and defaults to empty bytes when omitted.

This page outputs the derived bytes directly as Hex or Base64.

How to use this HKDF calculator

1. Choose Mode: HKDF, HKDF-Extract, or HKDF-Expand.
2. Enter the input bytes (IKM for HKDF / Extract, PRK for Expand) and select its encoding.
3. For HKDF or Extract, optionally enter a salt and choose the salt encoding.
4. For HKDF or Expand, optionally enter application/context info and choose its encoding.
5. Select the hash function. For HKDF or Expand, set the output length in bits (must be divisible by 8).
6. Derive and copy the result as Hex or Base64.

Result example

With Mode HKDF, Hex IKM 0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b, Hex salt 000102030405060708090a0b0c, Hex info f0f1f2f3f4f5f6f7f8f9, hash SHA256, and 336-bit output, the Hex digest is 3cb25f25faacd57a90434f64d0362f2a2d2d0a90cf1a5a4c5db02d56ecc4c5bf34007208d5b887185865.

The matching Extract PRK is 077709362c2e32df0ddc3f0dc47bba6390b6c73bb50f9c3122ec844ad7c2b3e5. Expanding that PRK with the same info and length reproduces the OKM above.

Important limitations

HKDF assumes the input is already suitable keying material. Do not feed low-entropy passwords into HKDF when you need password stretching. Expand rejects a PRK shorter than HashLen. Full HKDF / Expand output length must not exceed 255 * HashLen octets.

Frequently asked questions

Why does my result differ from another tool?

Compare the exact mode, input bytes, salt bytes, info bytes, hash name, and output length. Encoding differences such as UTF-8 versus Hex change the derived result even when the visible text looks the same.

Is an empty salt allowed?

Yes for HKDF and HKDF-Extract. Per RFC 5869, omitted or empty salt is replaced with HashLen zero bytes for Extract. Many protocols still recommend a random salt when one is available. HKDF-Expand does not use salt.

Should I use HKDF or PBKDF2?

Use HKDF when you already have high-entropy keying material and need to derive application-specific keys. Use PBKDF2 or a modern password KDF when the input is a password or other low-entropy secret.