The `pbkdf2` library provides a Python implementation of the Password-Based Key Derivation Function 2 (PBKDF2), as specified in RSA PKCS#5 v2.0. It is designed to derive cryptographic keys from a password and a salt, leveraging iterative hashing to increase the computational cost for brute-force attacks. The library's last release was in June 2011, and while functional, modern Python applications are generally advised to use the built-in `hashlib.pbkdf2_hmac` function, which offers better performance and active maintenance.
pip install pbkdf2Verified import paths — ran on the pinned version, not inferred.
This quickstart demonstrates deriving a key using the `PBKDF2` class with a randomly generated salt and a high iteration count. It also shows the `crypt` helper function, though explicit use of `PBKDF2` is often preferred for control over the hashing algorithm and iterations.
Migrate to `hashlib.pbkdf2_hmac` for new projects and consider for existing ones. Example: `from hashlib import pbkdf2_hmac; key = pbkdf2_hmac('sha256', password_bytes, salt_bytes, iterations, dklen=32)`.Always explicitly specify a strong hash function like SHA-256 or SHA-512 when using PBKDF2, especially if migrating to `hashlib.pbkdf2_hmac`. The `pbkdf2` library (dlitz/python-pbkdf2) does not offer a direct way to change the HMAC algorithm for the `PBKDF2` class itself; this is another reason to prefer `hashlib.pbkdf2_hmac`.
Always use a high iteration count, typically hundreds of thousands, and increase it over time as computing power grows. `iterations = 600000` or higher is a good starting point for 2026.
Generate a unique salt for each password using `os.urandom(16)` (or more bytes) and store it securely with the derived key/hash. Never use a fixed or easily guessable salt.
Ensure all PBKDF2 parameters (password, salt, iterations, desired key length, and HMAC hash algorithm) are identical across implementations. Convert passwords and salts to byte strings consistently (e.g., `password.encode('utf-8')`). Explicitly set the hash algorithm, e.g., 'sha256'. Confirm the derived key length (`dklen`) is the same. Python's `hashlib.pbkdf2_hmac` is often easier to synchronize.Verify the correct installation with `pip show pbkdf2` and check the import: `from pbkdf2 import PBKDF2` or `from pbkdf2 import crypt`. If `pbkdf2.py` is directly in the path, it might be picked up instead of the installed package. Consider using the fully qualified name `pbkdf2.PBKDF2` or `pbkdf2.crypt` if `from pbkdf2 import ...` causes issues due to other modules named `pbkdf2`.
Encode the password and salt to byte strings before passing them to `PBKDF2` or `crypt`. For example: `password.encode('utf-8')` and `salt.encode('utf-8')` (if salt is a string) or `os.urandom(16)` for binary salt.No dependency data recorded yet.