hash_pbkdf2

Generate a PBKDF2 key derivation of a supplied password

&reftitle.description; `string` `hash_pbkdf2` `string` `algo` `string` `password` `string` `salt` `int` `iterations` `int` `length` 0 `bool` `raw_output` false
&reftitle.parameters;

`algo`

- Name of selected hashing algorithm (i.e. `md5`, `sha256`, `haval160,4`, etc..) See `hash_algos` for a list of supported algorithms.

`password`

- The password to use for the derivation.

`salt`

- The salt to use for the derivation. This value should be generated randomly.

`iterations`

- The number of internal iterations to perform for the derivation.

`length`

- The length of the output string. If `raw_output` is &true; this corresponds to the byte-length of the derived key, if `raw_output` is &false; this corresponds to twice the byte-length of the derived key (as every byte of the key is returned as two hexits).

  If `0` is passed, the entire output of the supplied algorithm is used.

`raw_output`

- When set to &true;, outputs raw binary data. &false; outputs lowercase hexits.

&reftitle.returnvalues;

Returns a string containing the derived key as lowercase hexits unless `raw_output` is set to &true; in which case the raw binary representation of the derived key is returned.

&reftitle.errors;

An `E_WARNING` will be raised if the algorithm is unknown, the `iterations` parameter is less than or equal to `0`, the `length` is less than `0` or the `salt` is too long (greater than `INT_MAX``- 4`).

&reftitle.examples;

### `hash_pbkdf2` example, basic usage

    <?php
    $password = "password";
    $iterations = 1000;

    // Generate a random IV using mcrypt_create_iv(),
    // openssl_random_pseudo_bytes() or another suitable source of randomness
    $salt = mcrypt_create_iv(16, MCRYPT_DEV_URANDOM);

    $hash = hash_pbkdf2("sha256", $password, $salt, $iterations, 20);
    echo $hash;
    ?>

&example.outputs.similar;

    120fb6cffcf8b32c43e7

&reftitle.notes;

The PBKDF2 method can be used for hashing passwords for storage. However, it should be noted that `password_hash` or `crypt` with `CRYPT_BLOWFISH` are better suited for password storage.

&reftitle.seealso;

- `crypt`
- `password_hash`
- `hash`
- `hash_algos`
- `hash_init`
- `hash_hmac`
- `hash_hmac_file`