Scrypt KDF

Derive raw key material with scrypt KDF

Scrypt KDF (RFC 7914) is a memory-hard password-based key derivation function. It stretches a password with a salt and work factors N, r, and p so that guessing passwords is expensive in both CPU time and memory.

This page outputs only the raw derived bytes as Hex or Base64. For a PHC-encoded password hash string ($scrypt$...) plus verify flow, use the Scrypt Hash Generator instead.

Compared with PBKDF2, scrypt is designed to be harder to accelerate with GPUs or ASICs because of its large sequential memory access. Prefer Argon2id for new password-based KDF designs when you are not required to use scrypt. For PHC password storage, use the Argon2 Hash Generator.

How to use this scrypt calculator

1. Enter the password or input material and select its encoding.
2. Optionally enter a salt and choose the salt encoding. An empty salt is treated as zero-length bytes.
3. Choose cost N (a power of two), block size r, and parallelism p.
4. Set the output length in bits (must be divisible by 8).
5. Derive and copy the result as Hex or Base64.

Result example

With UTF-8 password password, UTF-8 salt NaCl, N=1024, r=8, p=16, and 512-bit output, the Hex digest is fdbabe1c9d3472007856e7190d01e9fe7c6ad7cbc8237830e77376634b3731622eaf30d92e22a3886ff109279d9830dac727afb94a83ee6d8360cbdfa2cc0640.

Parameter guidance

• N is the CPU/memory cost and must be a power of two. Larger N uses more RAM and time.
• r is the block size. 8 is common.
• p is parallelization. Browser defaults often keep p=1.
• Higher parameters improve resistance to guessing, but they can freeze or exhaust memory in the browser. Use the memory estimate in Settings as a guide.

Frequently asked questions

Why does my result differ from another tool?

Compare the exact password bytes, salt bytes, N, r, p, and output length. Encoding differences such as UTF-8 versus Hex change the derived result even when the visible text looks the same.

Is this the same as the Scrypt Hash Generator?

No. This page returns raw key material for KDF use. The Scrypt Hash Generator packages a digest into a PHC string for password storage and verification.

Should I use scrypt or PBKDF2?

Use scrypt when you want a memory-hard password KDF and your protocol expects scrypt parameters. Prefer Argon2 KDF for new password-based designs when you are not required to use scrypt. Use PBKDF2 when you need broad interoperability with older systems. Use HKDF only when the input is already high-entropy keying material, not a password.