EVPKDF Generator
Derive a key and IV from a password and salt with OpenSSL's EVP_BytesToKey (EVPKDF) using MD5, SHA-1, SHA-256, SHA-384 or SHA-512. Runs in your browser; output in hex and base64.
Input
Treated as UTF-8 text.
Leave empty for no salt (`openssl enc -nosalt`).
OpenSSL's `-md` default is 1; CryptoJS EvpKDF also defaults to 1.
Multiple of 8. 256 for AES-256, 128 for AES-128.
Multiple of 8; 0 to derive only a key. 128 for AES-CBC.
Output
More ways to use this tool
REST API
curl -X POST https://api.iotools.cloud/v1/tool/evpkdf-generator \
-H "Authorization: Bearer YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"password": "secret passphrase",
"salt": "0011223344556677",
"algorithm": "md5",
"iterations": "1",
"keyBits": "256",
"ivBits": "128"
}'Swap in your own key from your account. The tool's fields are the body — no wrapper.
Ask an AI agent
Use the IOTools `evpkdf-generator` tool (EVPKDF Generator) on this input:
YOUR_INPUT_HEREPaste this at any agent connected to the IOTools MCP server, then add your input.
Embed widget
<iframe
src="https://iotools.cloud/embed/evpkdf-generator/"
width="100%" height="520" frameborder="0" scrolling="no" loading="lazy"
title="EVPKDF Generator — iotools.cloud"
sandbox="allow-scripts allow-forms allow-same-origin allow-downloads allow-popups allow-popups-to-escape-sandbox"
allow="clipboard-write"
style="width:100%;border:1px solid #e5e7eb;border-radius:12px;overflow:hidden"></iframe>
<script src="https://iotools.cloud/embed.js" async></script>Drop this into your own page — free, no key required, just a link back.
| Cost per API/MCP call | From 5 credits |
|---|---|
| Need more credits? | View pricing |
Also available with
Guides
Derive an encryption key and IV from a password using OpenSSL's EVP_BytesToKey (EVPKDF), entirely in your browser. Choose MD5, SHA-1, SHA-256, SHA-384 or SHA-512, add an optional hex salt, and get the key and IV in hex and base64.
What is EVPKDF?
EVP_BytesToKey is the key-derivation routine behind the classic openssl enc -k <password> command and the default key derivation in CryptoJS (EvpKDF). It hashes the password plus salt, then keeps hashing the previous digest together with the password and salt until it has enough bytes for the key and the IV. Matching it exactly is what lets you decrypt files produced by older OpenSSL versions or Salted__ strings from CryptoJS.
How to use this tool
- Enter the password.
- Paste the salt as hex (OpenSSL uses 8 bytes; leave empty for
-nosalt). - Pick the hash algorithm — MD5 for OpenSSL 1.0 / CryptoJS, SHA-256 for OpenSSL 1.1 and later.
- Set the iterations (1 by default), key size and IV size. AES-256-CBC needs 256 and 128 bits.
- Copy the key and IV, then use them in the AES Encryption / Decryption tool.
Everything runs locally — your password and salt are never sent anywhere.
FAQ
Is EVP_BytesToKey secure?
It's considered weak: with one iteration and a fast hash, passwords are cheap to brute-force. Use it only for compatibility with existing data. For new work choose PBKDF2 or Argon2.
How do I confirm it matches OpenSSL?
Run openssl enc -aes-256-cbc -md md5 -k "your password" -S <salt hex> -P and compare the printed key and iv with this tool's output.