---
id: hkdf
version: "0.0.3"
license: UNKNOWN
license_treatment: permissive
maintenance: dormant
---

# hkdf — HMAC-based Extract-and-Expand Key Derivation Function (HKDF)

License: permissive · Maintenance: dormant · Downloads: 102.0K/mo

## What it is and what it does

HKDF is a cryptographic key derivation function that implements the HMAC-based Extract-and-Expand Key Derivation Function as specified in the draft RFC. It takes input key material (typically a password or shared secret) and derives one or more cryptographically strong keys suitable for use in encryption, authentication, or other cryptographic operations. The package provides both a functional interface (separate `hkdf_extract()` and `hkdf_expand()` functions) and a wrapper class (`Hkdf`) for convenience.

The functional interface defaults to SHA-512 for hashing, while the wrapper class defaults to SHA-256. Both allow you to specify a custom hash function. The extract phase produces a pseudorandom key (PRK) from input material and an optional salt; the expand phase then generates output key material of a specified length, optionally parameterized by context information. This is useful when you need to derive multiple independent keys from a single source or when you need to convert weak input into strong cryptographic material.

Use it for:

- Derive encryption keys from a user password in a password-based key derivation workflow.
- Generate multiple independent session keys from a single shared secret in a protocol handshake.
- Expand a master key into subkeys for different purposes (e.g., encryption, authentication, integrity).
- Implement cryptographic protocols that require HKDF-based key material generation.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Implements HMAC-based Key Derivation Function (HKDF) with extract-and-expand operations for deriving cryptographic keys from input key material.

No. The package is dormant (last release 2015-06-16, classifiers list only Python 2.6–3.4, all end-of-life), has high install friction (source-only), and offers no runtime dependencies to ease integration. Install only if you are maintaining legacy Python 2 code that already depends on it.

## Install

pip install hkdf
uv add hkdf
poetry add hkdf

## Installing hkdf

Before you install: High install friction due to source-only distribution (hkdf-0.0.3.tar.gz). Maintenance is dormant—last release was 2015-06-16 and last commit 2024-01-17, with no recent activity. Classifiers indicate support only for Python 2.6, 2.7, 3.3, 3.4, all of which are end-of-life.

License in practice: Licensed under BSD (permissive), which permits commercial and private use with minimal restrictions. No notable licensing constraints for most use cases.

Quickstart:

from hkdf import hkdf_extract, hkdf_expand
from binascii import unhexlify

prk = hkdf_extract(unhexlify(b"8e94ef805b93e683ff18"), b"asecretpassword")
key = hkdf_expand(prk, b"context1", 16)

No runtime dependencies, but package is source-only and classifiers list only Python 2.6–3.4, all end-of-life versions. Compatibility with modern Python versions is unverified.

Verify before relying:

- Whether the package actually works on Python 3.5 or later despite classifiers listing only 2.6–3.4.
- Whether any security review or audit has been performed on the HKDF implementation since 2015.
- Current maintenance status and whether the author is accepting pull requests or bug reports.

## Package facts

- License: UNKNOWN (permissive)
- Python support: unspecified
- Install friction: high
- Maintenance: dormant
- Downloads: 102.0K/month (top 15,000 on PyPI)
- Known vulnerabilities: none known

## Tags

key derivation function, hkdf hmac, cryptographic key generation, extract expand kdf, hmac key derivation, key material derivation, key-derivation, cryptography, dormant

[View on SkillFed](https://skillfed.io/packages/hkdf) · [View on PyPI](https://pypi.org/project/hkdf/)