Javascript web-based key derivation

Question

Is there a website with a key derivation function running entirely in client-side Javascript?

The string which is used to generate the key cannot be seen outside the client.

It shouldn't use a run-of-the-mill hash function like SHA2 but something more suitable like Scrypt, and it should use a large character set, not just A-F0-9.

There are either too many possible answers, or good answers would be too long for SE's Q&A format. Please add details to narrow the answer set or to isolate an issue that can be answered in a few paragraphs. — Mike Ounsworth, Jul 27 '15 at 19:25
@MikeOunsworth If there are too many possible answers give me one. — wlad, Jul 27 '15 at 19:26
Javascript isn't my area of expertise so I can't offer anything specific, but the question, as stated, is rather broad (what do you mean by "The string which is used to generate the key cannot be seen outside the client"?). Given your high rep on Mathematics.SE, I'm sure you can edit the question to have more context and be more focused. — Mike Ounsworth, Jul 27 '15 at 19:31

wlad · Answer 1 · 2015-07-27T19:54:56.243

2

http://anandam.name/pbkdf2/ - I think this does it. It says demo but I think it does the job.

https://www.dailycred.com/article/bcrypt-calculator - So does this.

edited Jul 27 '15 at 19:54

answered Jul 27 '15 at 19:45

wlad

111
4

score 1 · Answer 2 · answered Jul 27 '15 at 19:38

1

You can use javascript-bcrypt or crypto-js for PBKDF2. I don't know any scrypt JS implementations so I don't want to recommend one (you can always Google). While you mention scrypt in your question, I think that bcrypt and PBKDF2 are the most widely used functions.

answered Jul 27 '15 at 19:38

Neil Smithline

14,842
4
39
55

I would like it to run in the browser. The point is that I can run it on any computer and recover my passwords. Also large character set. – wlad Jul 27 '15 at 19:40
1

I believe that those libraries will run in browsers. Are you using a really old browser or one that has JS disabled? If not, I think you should be fine. Am I mistaken? – Neil Smithline Jul 27 '15 at 19:43
my question said website. Currently online. Thanks for telling me about PBKDF2 though. – wlad Jul 27 '15 at 19:46
@NaN you could write your own website to do this, too. – schroeder Jul 27 '15 at 19:57
That was my thought too @schroeder. – Neil Smithline Jul 27 '15 at 19:58

Javascript web-based key derivation

2 Answers2