PBKDF2HMAC Key Derivation

Passwords are terrible keys. They're short, predictable, and full of the wrong kind of entropy. PBKDF2HMAC_Derive exists to fix that: it stretches a password-like secret into a proper key of whatever length you want, and it does it slowly on purpose, so that brute-forcing the password costs the attacker real compute. If you've ever used a password manager, this is the same class of algorithm your master password runs through.

The name breaks down as: Password-Based Key Derivation Function 2, with HMAC as the underlying pseudorandom function. Mechanically it runs your password through a hash, repeatedly - each iteration feeds on the previous one - with a salt mixed in, and the salt is the part that makes two people with the same password get different keys. That's why the salt input exists and why you should never reuse one across derivations.

Here's what you actually touch:

• message - the password/secret. Must be BYTESLIKE, so convert your text to bytes first.
• salt - the nonce. The tooltip says it plainly: use the pack's SystemRandom / Random Nonce Generator node to make this. A predictable salt defeats the whole point.
• algorithm - the hash underneath: SHA256 or SHA512 are the sensible picks; the list also has SHA3, BLAKE2, and the legacy SHA1/MD5 if you're matching an existing spec.
• iterations - defaults to a beefy 1,200,000. This is your cost knob: higher = slower derivation = harder brute force. It's also the reason the node can feel like it's hung for a second or two - that's the point, not a bug.
• length - derived key length in bytes, default 32.

The single output, derived_key, is BYTESLIKE. Feed it into a symmetric encryption node to actually use it, or into PBKDF2HMAC_Verify's expected_key on the check side.

It's one node in the pack's key-derivation family - KBKDF, HKDF, scrypt, Argon2id and more sit alongside it, and they're all thin wrappers over Python's cryptography library, so you're getting the real implementations, not toy crypto.

Install: ComfyUI Manager → "ComfyUI ARG Toolkit" → install → restart, or:

cd ComfyUI/custom_nodes
git clone https://github.com/AzelusLightvale/ComfyUI-ARG-Toolkit

Restart ComfyUI; it's under ARG Toolkit/Cryptography/Modern/Key Derivation. No model files.

Two things to remember. One: salt, iterations, algorithm and length are all baked into the derivation - change any of them later and you get a different key, and verification will fail. Write them down or keep them in the workflow. Two: at the default 1.2M iterations this node is deliberately slow, and if you're testing a workflow by iterating on it, that's a minute you'll feel. Drop the iteration count to something small while you're building, then crank it back up for the real run.