scrypt derive
Derive a key from a password with scrypt, on your device.
Runs on your device. The file is never uploaded.
scrypt derive turns a password and a salt into a hex key, 32 bytes long by default, with N at 16384, r at 8 and p at 1. An N that is not a power of two is refused. The salt is a text box holding the word salt, so defaults leave every password sharing one.
Questions
What does this produce?
A derived key as hex, using scrypt from hash-wasm. The defaults are N of 16384, r of 8, p of 1, and a 32-byte output, with the salt taken as text and defaulting to the word salt. It is deterministic: the same password, salt and parameters give the same hex every time, which is what makes it usable as a key derivation step.
Why is there no scrypt verify tool?
Because the output is not a self-describing encoded string, unlike bcrypt and Argon2id. It is a bare hex key with no parameters attached to it. To check a password later, run this tool again with the same salt and parameters and compare the hex yourself. That is also why you have to record N, r, p, the salt and the key length alongside the result.
What do N, r and p mean, and what will it refuse?
N is the CPU and memory cost and must be a power of two, r is the block size, and p is parallelism. Bad values are refused with "n must be a power of 2 >= 2", "r must be a positive whole number", "p must be a positive whole number" and "keylen must be a positive whole number". Memory use rises with N and r, and this runs in your browser tab, so a large N can make the page pause.
Is the salt random?
No, and that differs from bcrypt hash and Argon2id hash on this site, which both generate 16 random bytes. Here the salt is a text option you type, defaulting to the word salt, and it is used exactly as given. For password storage you need a distinct random salt per password, stored alongside the result. Leaving the default in place gives every password the same salt, which removes the point of having one.
Can I use it as a general key derivation function?
Yes, that is what it is doing. The option is labelled password but any text works, and you set the output length in bytes. If your input is already high-entropy key material rather than a password, HKDF derive is the better fit: it is built for that case and is far faster, because it is not trying to be slow.
Does anything leave the browser?
No. scrypt runs as WebAssembly in a Web Worker in this tab. The password, the salt and the derived key stay in page memory, nothing is uploaded, and nothing is stored between runs. The site works offline after the first visit, so you can disconnect the network and derive a key anyway.