AkousaHKDF Key Derivation
Derive cryptographic keys using HMAC-based Key Derivation Function.
About HKDF Key Derivation
HKDF Key Derivation implements the HMAC-based Extract-and-Expand Key Derivation Function standardized in RFC 5869, which derives one or more cryptographically strong keys from input keying material using a two-step process: first extracting a pseudorandom key using HMAC and an optional salt, then expanding it to the desired output length using an info context label that domain-separates different key uses. HKDF with SHA-256 is the KDF used in TLS 1.3, Signal Protocol, Noise Protocol Framework, and most modern key agreement protocols. This tool lets you experiment with HKDF parameters and verify outputs against RFC 5869 test vectors.
How to Use
Enter the input keying material as hex or text — this is typically a Diffie-Hellman shared secret or a pre-shared key. Optionally provide a salt (if omitted, HKDF uses a zero-filled byte string of hash length) and an info context string that domain-separates the derived key from other uses. Set the desired output key length in bytes and select the hash algorithm (SHA-256 for standard use, SHA-512 for higher security). Click Derive to see the extracted pseudorandom key (PRK) and the final derived key material (OKM) in hex.
Common Use Cases
- Cryptography engineers deriving separate encryption and authentication keys from a single Diffie-Hellman shared secret using domain-separated HKDF info labels per the TLS 1.3 key schedule specification
- Protocol designers verifying HKDF-SHA256 output against the official RFC 5869 test vectors to confirm their implementation is correct before integrating into a production cryptographic protocol
- Security researchers generating deterministic key material for end-to-end encryption testing without needing a full key exchange by using a fixed IKM and known salt in a controlled environment
- Application developers implementing multi-purpose key hierarchies that derive separate per-session keys for encryption, MAC, and IV generation from a single master secret using distinct info labels
- Cryptography students learning key derivation concepts by interactively adjusting HKDF parameters and observing how changing the salt, info, or hash algorithm produces completely different output keys