A key derivation function (KDF) turns a password into cryptographic key material. Good KDFs are slow and, for modern password hashing, memory-hard, so offline guessing is expensive.
Common examples
PBKDF2 stretches with many HMAC iterations. Argon2id adds memory cost. Both need a unique salt per vault or user. After derivation, ciphers like AES-GCM encrypt data.
In AzAd Vault
AzAd Vault�s KDF is Argon2id. Details: Argon2id, comparison post, security.
Password hashing vs encryption keys
People conflate “hashing passwords for login” with “deriving encryption keys for a vault.” Both may use similar algorithms, but goals differ. Vault KDFs produce keys that must decrypt correctly every time; website password hashes should be slow to verify guesses without ever reversing to the original password.
AzAd Vault’s KDF path exists so your master password becomes key material for AES-GCM, not so AzAd Solutions can store a login hash of that password on a server for vault decryption. Keep master passwords long; algorithms amplify effort — they do not invent entropy you did not provide.
Choosing as a buyer
Ask: which KDF, which parameters, which cipher, is sync ciphertext-only, and does offline mode work? AzAd Vault answers: Argon2id, AES-256-GCM, optional Drive ciphertext, offline-capable apps on Android, Windows, and Chrome. Premium changes limits and Chrome passkeys — not a separate weak KDF track.
Practical takeaway
Remember the pipeline: master password → KDF (Argon2id) → key → AES-256-GCM ciphertext. Skipping any stage in DIY schemes is how homebrew password spreadsheets fail under real attackers.
Related reading on azadvault.com includes the security page, blog guides, and companion glossary entries for Argon2id, AES-256-GCM, and zero-knowledge. AzAd Solutions ships AzAd Vault for Android, Windows, and Chrome with a concrete Free tier (500 items, 20 labels, 10 TOTP) and Play-billed Premium.