openssl_pbkdf2 derives cryptographic key bytes from a password using PBKDF2.
The examples explain the data format, expected results and the difference between this API and nearby cryptographic operations.
What It Does
The operation is intended for: openssl_pbkdf2 derives cryptographic key bytes from a password using PBKDF2.
The OpenSSL extension must be enabled.
Syntax and Return Value
openssl_pbkdf2(string $password, string $salt, int $key_length, int $iterations, string $digest_algo = ...): string|false| Parameter | Purpose |
|---|---|
| $password (string) | Secret password input. Never print or log a live password. |
| $salt (string) | A salt with the exact required length; use random_bytes for password-derived keys. |
| $key_length (int) | Use the PHP signature above to determine the exact expected input type; validate untrusted inputs before calling. |
| $iterations (int) | Use the PHP signature above to determine the exact expected input type; validate untrusted inputs before calling. |
| $digest_algo (string) | Use the PHP signature above to determine the exact expected input type; validate untrusted inputs before calling. |
The declared return type is shown above. Errors can include false results or exceptions depending on this API: Store the salt and work factor to reproduce the key. For website password storage use password_hash instead.
Example 1: Basic Operation
Persist salt and derivation settings; for authentication password_hash is simpler.
<?php
$salt = random_bytes(16);
$key = openssl_pbkdf2("example-password", $salt, 32, 600000, "sha256");
echo strlen($key);Example 2: A Different Use Case
A password-derived key is deterministic for the same salt and changes for independent salts.
<?php
$salt = random_bytes(16);
$first = openssl_pbkdf2("demo-password", $salt, 32, 600000, "sha256");
$second = openssl_pbkdf2("demo-password", $salt, 32, 600000, "sha256");
var_dump(hash_equals($first, $second));Practical Example: Checking the Result
A password-derived key is deterministic for the same salt and changes for independent salts.
<?php
$salt = random_bytes(16);
$first = openssl_pbkdf2("demo-password", $salt, 32, 600000, "sha256");
$salt = random_bytes(16);
$second = openssl_pbkdf2("demo-password", $salt, 32, 600000, "sha256");
var_dump(!hash_equals($first, $second));Important Behavior and Edge Cases
Store the salt and work factor to reproduce the key. For website password storage use password_hash instead.
Store the salt and work factor to reproduce the key. For website password storage use password_hash instead.
Comparison with Related Functions
| Approach | Key distinction |
|---|---|
| openssl_pbkdf2 | openssl_pbkdf2 derives cryptographic key bytes from a password using PBKDF2. |
| Related technique | hash_pbkdf2 is another implementation with different output-encoding defaults. |
Common Beginner Mistakes
| Mistake | Correct approach |
|---|---|
| Confusing this operation with a neighboring cryptographic or security mechanism | hash_pbkdf2 is another implementation with different output-encoding defaults. |
| Ignoring a security prerequisite or failure case | Store the salt and work factor to reproduce the key. For website password storage use password_hash instead. |
Key Takeaways
- openssl_pbkdf2 derives cryptographic key bytes from a password using PBKDF2.
- Store the salt and work factor to reproduce the key. For website password storage use password_hash instead.
- hash_pbkdf2 is another implementation with different output-encoding defaults.
Apply this behavior to a real application only after confirming the required extension, configuration and failure handling on the deployment runtime.