title: Crypto - Express.js is PBKDF2 HMAC-SHA1 enough?
body: <p>Using the Express.js framework and crypto to hash a password with pbkdf2 I read that the default algorithm is HMAC-SHA1 but i dont understand why it hasnt been upgraded to one of the other families or SHA. </p>
  
  <pre><code>crypto.pbkdf2(password, salt, iterations, keylen, callback)
  </code></pre>
  
  <p>Is the keylen that we provide the variation of the the SHA we want? like SHA-256,512 etc?</p>
  
  <p>Also how does HMAC change the output?</p>
  
  <p>And lastly is it strong enough when SHA1 is broken?</p>
  
  <p>Sorry if i am mixing things up.</p>