pbkdf2 applies a pseudorandom function, such as hash-based message authentication code (hmac), to the input password or passphrase along with a salt value and repeats the process many times to produce a "derived key", which can then be used as a cryptographic key in subsequent operations. the added computational work makes password cracking much more difficult, and is known as key stretching.