Your files stay on your device

HKDF key derivation

RFC 5869 extract-then-expand key derivation with explicit salt and info.
SHA-256SHA-384SHA-512HexBase64Base64urlClearTextHexBase64Input keying material (IKM)

The secret you are stretching: never a URL, never persisted.
TextHexBase64Salt (optional)

Empty means the RFC 5869 default: hash-length zero bytes.
TextHexBase64Info (optional)

Context/purpose binding, e.g. the key id the output is for.
Output length (bytes)

1-64 bytes. This page refuses KDF-as-fountain usage.

HKDF (RFC 5869, extract-then-expand) over your inputs: WebCrypto deriveBits in this tab.
Paste, drop, or type to begin. Everything stays on this device.

More hashing & encryption tools

- AES-GCM encrypt (/crypto/aes-gcm)
- HMAC (/crypto/hmac)
All hashing & encryption tools (/crypto)

Canonical HTML: https://nutter.tools/crypto/hkdf/
Markdown version: https://nutter.tools/crypto/hkdf/index.md
Plain-text version: https://nutter.tools/crypto/hkdf/index.txt
Agent index: https://nutter.tools/llms.txt