diff --git a/backend/build.gradle.kts b/backend/build.gradle.kts
index 38d6ba0..85f2b08 100644
--- a/backend/build.gradle.kts
+++ b/backend/build.gradle.kts
@@ -35,6 +35,7 @@ dependencies {
     implementation(libs.koin)
     implementation(libs.koin.logger)
     implementation(libs.otp)
+    implementation(libs.kdf)
     implementation(libs.hash)
     implementation(libs.encoding)
     implementation(libs.logback)
diff --git a/backend/gradle/libs.versions.toml b/backend/gradle/libs.versions.toml
index 6ac4321..d74b70b 100644
--- a/backend/gradle/libs.versions.toml
+++ b/backend/gradle/libs.versions.toml
@@ -6,6 +6,7 @@ postgres = "42.7.5"
 flyway = "11.7.0"
 koin = "4.0.3"
 otp = "1.1.0"
+kdf = "1.0.0"
 hash = "1.1.0"
 encoding = "1.1.0"
 logback = "1.5.18"
@@ -37,6 +38,7 @@ koin = { module = "io.insert-koin:koin-ktor", version.ref = "koin" }
 koin-logger = { module = "io.insert-koin:koin-logger-slf4j", version.ref = "koin" }
 
 otp = { module = "com.infendro:otp", version.ref = "otp" }
+kdf = { module = "com.infendro:kdf", version.ref = "kdf" }
 hash = { module = "com.infendro:hash", version.ref = "hash" }
 encoding = { module = "com.infendro:encoding", version.ref = "encoding" }
 
diff --git a/backend/src/main/kotlin/com/infendro/account/util/SecureHasher.kt b/backend/src/main/kotlin/com/infendro/account/util/SecureHasher.kt
index 5fce593..c61c9d4 100644
--- a/backend/src/main/kotlin/com/infendro/account/util/SecureHasher.kt
+++ b/backend/src/main/kotlin/com/infendro/account/util/SecureHasher.kt
@@ -1,26 +1,27 @@
 package com.infendro.account.util
 
 import com.infendro.encoding.Hex
-import javax.crypto.SecretKeyFactory
-import javax.crypto.spec.PBEKeySpec
+import com.infendro.hash.SHA256
+import com.infendro.kdf.PBKDF2
 import kotlin.random.Random
 
-// TODO implement PBKDF2
 object SecureHasher {
-    private val factory = SecretKeyFactory.getInstance("PBKDF2WithHmacSHA256")
+    private val kdf = PBKDF2(SHA256)
     private val random = Random.Default
 
     fun hash(
         value: String,
         salt: String,
     ): String {
-        val spec = PBEKeySpec(value.toCharArray(), Hex.decode(salt.toByteArray()), 100_000, 256)
-        return factory.generateSecret(spec).encoded
-            .let { Hex.encode(it).toString() }
+        val value = value.encodeToByteArray()
+        val salt = Hex.decode(salt.encodeToByteArray())
+        return kdf.hash(value, salt, 100_000, 32)
+            .let { Hex.encode(it).decodeToString() }
     }
 
     fun generateSalt(): String {
-        return ByteArray(16).also { random.nextBytes(it) }
-            .let { Hex.encode(it).toString() }
+        return ByteArray(16)
+            .also { random.nextBytes(it) }
+            .let { Hex.encode(it).decodeToString() }
     }
 }