I'm writing a password manager, right now for each individual site, I already used master password + random salt with PBKDF2 to generate encryption key to encrypt its password (each site has its own salt).

Is it still secure to use master password + another random salt with PBKDF2 to generate hash for master password (this hash will be store in DB for user authentication)? Or should I use a hashing algorithm like SHA-256?

  • 1
    What's the point of not using the master password+slat directly for encrypting a given password ? I don't see how your system improves security.
    – Stephane
    Jul 7, 2015 at 8:05
  • @Stephane because master password+salt will be store in db to authenticate user, and I certainly don't want to store the encryption key in the clear.
    – gzup
    Jul 7, 2015 at 9:51

1 Answer 1


Since PBKDF2 could be use to generate as much bytes as you want/need, you can of course use it for both master password hashing and key generation. You don't even need to use different salt, just generate a n bytes hash, then generate n+m bytes, discard the first n bytes and use the other m bytes as key.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.