pbkdf2

This library provides the functionality of PBKDF2 with the ability to use any supported hashing algorithm returned from crypto.getHashes()

Usage

var pbkdf2 = require('pbkdf2')
var derivedKey = pbkdf2.pbkdf2Sync('password', 'salt', 1, 32, 'sha512')

...

For more information on the API, please see the relevant Node documentation.

For high performance, use the async variant (pbkdf2.pbkdf2), not pbkdf2.pbkdf2Sync; this variant has the oppurtunity to use window.crypto.subtle when browserified.

Credits

This module is a derivative of cryptocoinjs/pbkdf2-sha256, so thanks to JP Richardson for laying the ground work.

Thank you to FangDun Cai for donating the package name on npm, if you're looking for his previous module it is located at fundon/pbkdf2.

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog and this project adheres to Semantic Versioning.

v3.1.3 - 2025-06-20

Commits

• Only apps should have lockfiles 8b06730
• [lint] fix whitespace 9a76e2f
• [lint] fix parens/curlies/semis/etc 6fd84bf
• [meta] add auto-changelog 796c38d
• [Tests] fix tests in node 17 3661fb0
• Revert "[Tests] fix tests in node < 3" 7431b57
• [Tests] fix tests in node < 3 eb9f97a
• [Fix] ensure unknown algorithms throw + known ones match node 26d4fd3
• [Tests] add GHA, always run nyc 513906a
• [lint] fix a few more rules ab04da8
• [lint] switch to eslint 89694cf
• [Tests] add coverage d0d534b
• [Refactor] use to-buffer e3102a8
• [readme] improve badges fca0c9d
• [Tests] remove unused travis file a2c7d93
• [meta] switch from files to npmignore 7f31fbc
• [Tests] use .nycrc 8d628e8
• [Refactor] minor tweaks fc61005
• [Deps] update create-hmac, safe-buffer, sha.js ae2a7d0
• [Fix] pin create-hash, ripemd160 due to breaking changes e079968
• [Tests] fix tests in node 3 45fbcf3
• [meta] skip publishing benchmarks 19ea57b
• [Dev Deps] add missing peer dep 645e252

v3.1.2 - 2021-04-09

Commits

• handle nextTick 36457b9
• Check for process before accessing 449e510
• handle different returns fb82137

v3.1.1 - 2020-06-04

Commits

• style nit 6d994f2
• remove arrow 70ea270

v3.1.0 - 2020-06-03

Merged

• check if process.version is available #85

Commits

• fix style 1674cbd
• add support for all ArrayBuffers b888820
• Build type check into toBuffer 0b77ea9
• fix fixtures 6af65e7
• Add tests for Uint8Array bca4182
• fix encodings b1c669b
• minor fixes for Uint8Array support f61abc7
• fix tests ab62504
• Add Uint8Array support 3fbb793
• adjust node versions a572cbc
• update travis 4a4deed
• fix standard typo (that was not caught locally for some reason) 47c59ad

v3.0.17 - 2018-09-25

Commits

• Add ripemd160 test 9da9d9c
• Do not inline rmd160Func b498c9b
• Fix RIPEMD160 support 68729a6

v3.0.16 - 2018-04-20

Merged

• default to SHA1 for native #76

Commits

• fix standard indentation 740d93e
• tests: fix JS/sync tests not being run 1416637
• increase sync.js internal coverage 4e07660
• travis: add 8 and 9 d82c51b

v3.0.15 - 2018-04-01

Merged

• Throw if password / salt is not a buffer or string #77
• Update README.md for async recommendation #75

Commits

• throw if password / salt is not a buffer or string 2410eb0
• typos 9dae437
• Update README.md ad85843

v3.0.14 - 2017-09-08

Merged

• use the local implementations if crypto.bpkdf2Sync #72

Commits

• use the local implementations if either crypto.bpkdf2Sync doesn't exist OR it doesn't contain the marker string 9132b7a

v3.0.13 - 2017-08-02

Merged

• fail better when node version loaded in browser #71
• remove unnecessary r, T values #68

Commits

• tests: add dkLen < and > c3d2998
• align definitions with assignment, formatting 5c50528
• lib/sync*: avoid inner-loop T copy 74b80d3
• sync: align definitions with assignment c818cf1
• remove unused r variable 9e0d168
• travis: drop 0.12 0985c3e
• sync-browser: consistent exports 90ac748
• just remove microtime 0fa9638
• standard --fix 8281fc6

v3.0.12 - 2017-05-11

Merged

• fix #60 - use browser.js in the browser, instead of index.js; include lib folder in the published package #62

Fixed

• fix #60 - use browser.js in the browser, instead of index.js; include lib folder in the published package (#62) #60

Commits

• switch to optional dep #63, 65 7d246e9

v3.0.11 - 2017-05-11

Commits

• update files 3313867

v3.0.10 - 2017-05-11

Merged

• node for the node, js for the browser #59
• real optimizations #57
• benchmark #56
• do our own hmacing #54

Commits

• use native crypto when available cdaf5c0
• actually add bench fa2e0a1
• passing tests 216a6a7
• hmac ourselves 9699045
• use hashes directly 89e0e80
• correctly test both fb56873
• avoid Buffer.concat 96518aa
• formatting dd3467c
• some fixes 15b2cbf
• cleanup fec6652
• formating dc2e15a
• fix coverage ae3f2a5
• move stuff around 52c3960
• 100% ef38b2b
• trailing space 03832fb
• reduce coverage 2f720b4
• switch to optional dep 8423738
• fix style 5b33204

v3.0.9 - 2016-10-05

Merged

• protect 0.10 users by throwing #47

Commits

• warn 0.10 users by throwing 5e63f63

v3.0.8 - 2016-09-22

Fixed

• package: add engines #46

Commits

• package: 1 too many indentations bffd057
• package: 90% branch coverage is fine for now c3d57f9

v3.0.7 - 2016-09-16

Merged

• browser: avoid process.version split before process.browser #44

v3.0.6 - 2016-09-14

Merged

• tests: fix UTF-8 encoding #42
• Add browserify dependency, rename index.html to bundle.html #41
• package: add browser.js #39

Commits

• add browserify and remove mocha from test/index.html f28965d
• rename index.html to bundle.html 7d850d2

v3.0.5 - 2016-09-12

Merged

• use tape instead of mocha #35
• tests: remove binary assumption, fixes #34 #36
• README: add documentation, close #31 #33
• fix coverage #32
• [trivial] update README.md #28
• [trivial] rename async-shim.js to node-shim-async.js #29
• update travis & standard #24
• browser: delay async computation, fixes #13 #14

Fixed

• Merge pull request #36 from crypto-browserify/testfix #34
• tests: remove binary assumption, fixes #34 #34
• Merge pull request #33 from crypto-browserify/dcousens-patch-1 #31
• README: add documentation, close #31 #31
• README: fix pbkdf2 spelling, resolves #20 #20
• Merge pull request #14 from crypto-browserify/dcousens-patch-1 #13
• browser: delay async computation, fixes #13 #13

Commits

• add node-shim.js 5eaa6ba
• browser: default the encoding 94e7979
• update tests 931b7d5
• package: update standard dd02315
• move checkParameters to separate file 93ffd51
• tests: merge to avoid double up of code 59f6577
• travis: update config 7ab61b4
• update README.md 8bf4958
• pull out type checking e6b815f
• browser: s/testParams/checkParameters/ 7730a55
• package: add files field to package.json 3ee45ed
• rename async-shim.js to node-shim-async.js 2268e11
• browser: return null for error c470de1
• .travis: test node 6 9f949d4

3.0.4 - 2015-03-27

Merged

• Fix shim encoding and more reliably close child process #12

Commits

• async errors and exiting 2bcfba8
• tests: add failing utf8 test ea1ddaf
• fix 2 types of errors 0cbba29
• fix standard formatting issues 93b06d3
• fix shim encoding a57d9c6
• index/browser: rename MAX_INT to MAX_ALLOC 9f6fb05
• package: use standard 3.0.0 941b46b

v3.0.3 - 2015-02-15

Commits

• repo name a6516d9
• change name 471fb83

3.0.2 - 2015-02-15

Merged

• fix bug in encoding #10

Commits

• tests: add non-printable fixture handling and example fixture 040707d
• add 0.12 and iojs to travis 45165c4

3.0.1 - 2015-01-29

Commits

• modularize 68c6c36
• all: standard cmpliance 2f5ff3b
• add shim 386d4af
• add browser tests b88ad8d
• package: add coveralls and re-order 5834697
• package: add standard test suite e504eed
• package: update repository URL b217d1a
• tests: remove unnecessary semicolon/vars 24f8ab3
• package: add coveralls c5b6d51
• index: remove unnecessary __pbkdf2Export e51121f
• index: fix digest algorithm typo 558b3dd
• README: update repository URL f1fc7b4
• package: latest devDependencies 9624836
• package: use latest create-hmac ffd5b94
• package: update description 7fbec99

2.0.1 - 2014-09-25

Merged

• move istanbul to dev dependencies #1

2.0.0 - 2014-09-24

Commits

• pbkdf2: add async impl. and invalid tests 16d209e
• README: update to latest API c2f01cf
• index: re-order var declarations 8ad010d

1.0.1 - 2014-09-17

Commits

• index: adds implementation 1792996
• fixtures: adds test fixtures 33e999e
• Initial commit f17b827
• package: adds package.json 2782f71
• README: add badges + usage instructions 51ac17d
• index: adhere to node.js spec 98ec635
• travis: adds yml 965f37f
• README: add credits aa9ac2f
• README: no need for there 0f6c37f