I was using hash_pbkdf2 earlier today when I noticed something strange.

The normal way to generate a hash is to output the entire string like the code below which outputs a 128 character string (128 chars, 4 bit each, 512bit total):
echo hash_pbkdf2("sha512", "123456", "test", 30000, 0);

However I made a minor error which I noticed output a whole heap of extra data:
echo hash_pbkdf2("sha512", "123456", "test", 30000, 512);

What are the extra hex output by this bad code, I was under the impression that SHA-512 could only output a maximum of 512bits?


1 Answer 1


According to the function definition, you specified a bit length of 512. By default (raw_output = False) the extra bits come from the derived key.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .