diff --git a/sha256.lua b/sha256.lua
index 615e50b..df929c1 100644
--- a/sha256.lua
+++ b/sha256.lua
@@ -10,6 +10,7 @@ local shr = bit32.rshift
 local bxor = bit32.bxor
 local bnot = bit32.bnot
 local band = bit32.band
+local unpack = unpack or table.unpack
 
 local K = {
     0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1,
@@ -25,6 +26,56 @@ local K = {
     0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2,
 }
 
+local h0 = {
+    0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a,
+    0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19,
+}
+
+local function compress(h, w)
+    local h0, h1, h2, h3, h4, h5, h6, h7 = unpack(h)
+    local K = K
+
+    -- Message schedule.
+    for j = 17, 64 do
+        local wf = w[j - 15]
+        local w2 = w[j - 2]
+        local s0 = bxor(rol(wf, 25), rol(wf, 14), shr(wf, 3))
+        local s1 = bxor(rol(w2, 15), rol(w2, 13), shr(w2, 10))
+        w[j] = w[j - 16] + s0 + w[j - 7] + s1
+    end
+
+    -- Block.
+    local a, b, c, d, e, f, g, h = h0, h1, h2, h3, h4, h5, h6, h7
+    for j = 1, 64 do
+        local s1 = bxor(rol(e, 26), rol(e, 21), rol(e, 7))
+        local ch = bxor(band(e, f), band(bnot(e), g))
+        local temp1 = h + s1 + ch + K[j] + w[j]
+        local s0 = bxor(rol(a, 30), rol(a, 19), rol(a, 10))
+        local maj = bxor(band(a, b), band(a, c), band(b, c))
+        local temp2 = s0 + maj
+
+        h = g
+        g = f
+        f = e
+        e = d + temp1
+        d = c
+        c = b
+        b = a
+        a = temp1 + temp2
+    end
+
+    return {
+        (h0 + a) % 2 ^ 32,
+        (h1 + b) % 2 ^ 32,
+        (h2 + c) % 2 ^ 32,
+        (h3 + d) % 2 ^ 32,
+        (h4 + e) % 2 ^ 32,
+        (h5 + f) % 2 ^ 32,
+        (h6 + g) % 2 ^ 32,
+        (h7 + h) % 2 ^ 32,
+    }
+end
+
 --- Hashes data using SHA256.
 --
 -- @tparam string data Input bytes.
@@ -38,56 +89,68 @@ local function digest(data)
     local padlen = -(#data + 9) % 64
     data = data .. "\x80" .. ("\0"):rep(padlen) .. (">I8"):pack(bitlen)
 
-    -- Initialize state.
-    local h0, h1, h2, h3 = 0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a
-    local h4, h5, h6, h7 = 0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19
-
     -- Digest.
+    local h = h0
     for i = 1, #data, 64 do
-        local w = {(">I4I4I4I4I4I4I4I4I4I4I4I4I4I4I4I4"):unpack(data, i)}
-
-        -- Message schedule.
-        for j = 17, 64 do
-            local wf = w[j - 15]
-            local w2 = w[j - 2]
-            local s0 = bxor(rol(wf, 25), rol(wf, 14), shr(wf, 3))
-            local s1 = bxor(rol(w2, 15), rol(w2, 13), shr(w2, 10))
-            w[j] = w[j - 16] + s0 + w[j - 7] + s1
-        end
-
-        -- Block function.
-        local a, b, c, d, e, f, g, h = h0, h1, h2, h3, h4, h5, h6, h7
-        for j = 1, 64 do
-            local s1 = bxor(rol(e, 26), rol(e, 21), rol(e, 7))
-            local ch = bxor(band(e, f), band(bnot(e), g))
-            local temp1 = h + s1 + ch + K[j] + w[j]
-            local s0 = bxor(rol(a, 30), rol(a, 19), rol(a, 10))
-            local maj = bxor(band(a, b), band(a, c), band(b, c))
-            local temp2 = s0 + maj
-
-            h = g
-            g = f
-            f = e
-            e = d + temp1
-            d = c
-            c = b
-            b = a
-            a = temp1 + temp2
-        end
-
-        h0 = (h0 + a) % 2 ^ 32
-        h1 = (h1 + b) % 2 ^ 32
-        h2 = (h2 + c) % 2 ^ 32
-        h3 = (h3 + d) % 2 ^ 32
-        h4 = (h4 + e) % 2 ^ 32
-        h5 = (h5 + f) % 2 ^ 32
-        h6 = (h6 + g) % 2 ^ 32
-        h7 = (h7 + h) % 2 ^ 32
+        h = compress(h, {(">I4I4I4I4I4I4I4I4I4I4I4I4I4I4I4I4"):unpack(data, i)})
     end
 
-    return (">I4I4I4I4I4I4I4I4"):pack(h0, h1, h2, h3, h4, h5, h6, h7)
+    return (">I4I4I4I4I4I4I4I4"):pack(unpack(h))
+end
+
+--- Hashes a password using PBKDF2-HMAC-SHA256.
+--
+-- @tparam password string The password to hash.
+-- @tparam salt string The password's salt.
+-- @tparam iter number The number of iterations to perform.
+-- @treturn string The 32-byte derived key.
+--
+local function pbkdf2(password, salt, iter)
+    expect(1, password, "string")
+    expect(2, salt, "string")
+    expect(3, iter, "number")
+    assert(iter % 1 == 0, "iteration number must be an integer")
+    assert(iter > 0, "iteration number must be positive")
+
+    -- Pad password.
+    if #password > 64 then password = digest(password) end
+    password = password .. ("\0"):rep(-#password % 64)
+    password = {(">I4I4I4I4I4I4I4I4I4I4I4I4I4I4I4I4"):unpack(password)}
+
+    -- Compute password blocks.
+    local ikp = {}
+    local okp = {}
+    for i = 1, 16 do
+        ikp[i] = bxor(password[i], 0x36363636)
+        okp[i] = bxor(password[i], 0x5c5c5c5c)
+    end
+
+    local hikp = compress(h0, ikp)
+    local hokp = compress(h0, okp)
+
+    -- 96-byte padding.
+    local pad96 = {2 ^ 31, 0, 0, 0, 0, 0, 0, 0x300}
+
+    -- First iteration.
+    local pre = (">I4I4I4I4I4I4I4I4I4I4I4I4I4I4I4I4"):pack(unpack(ikp))
+    local hs = {(">I4I4I4I4I4I4I4I4"):unpack(digest(pre .. salt .. "\0\0\0\1"))}
+    for i = 1, 8 do hs[i + 8] = pad96[i] end
+    hs = compress(hokp, hs)
+
+    -- Second iteration onwards.
+    local out = {unpack(hs)}
+    for _ = 2, iter do
+        for i = 1, 8 do hs[i + 8] = pad96[i] end
+        hs = compress(hikp, hs)
+        for i = 1, 8 do hs[i + 8] = pad96[i] end
+        hs = compress(hokp, hs)
+        for i = 1, 8 do out[i] = bxor(out[i], hs[i]) end
+    end
+
+    return (">I4I4I4I4I4I4I4I4"):pack(unpack(out))
 end
 
 return {
     digest = digest,
+    pbkdf2 = pbkdf2,
 }