Your files stay on your device

# HKDF Key Derivation

RFC 5869 extract-then-expand key derivation with explicit salt and info.
SHA-256SHA-384SHA-512HexBase64Base64urlClearTextHexBase64Input keying material (IKM)

The secret you are stretching: never a URL, never persisted.
TextHexBase64Salt (optional)

Empty means the RFC 5869 default: hash-length zero bytes.
TextHexBase64Info (optional)

Context/purpose binding, e.g. the key id the output is for.
Output length (bytes)

1-64 bytes. This page refuses KDF-as-fountain usage.

HKDF (RFC 5869, extract-then-expand) over your inputs: WebCrypto deriveBits in this tab.
Nothing in yet

Paste, drop, or type to begin. Everything stays on this device.

## Next door in Crypto

- [AES-GCM Encrypt](/crypto/aes-gcm)
- [HMAC](/crypto/hmac)
[All crypto tools](/crypto)

---

Canonical HTML: https://nutter.tools/crypto/hkdf
Markdown version: https://nutter.tools/crypto/hkdf/index.md
Plain-text version: https://nutter.tools/crypto/hkdf/index.txt
Agent index: https://nutter.tools/llms.txt