Extract compresses input keying material with a salt into a pseudorandom key PRK = HMAC(salt, IKM); Expand stretches it into output keying material OKM = T(1) ‖ T(2) ‖ … with T(i) = HMAC(PRK, T(i−1) ‖ info ‖ i), up to 255 hash lengths (8,160 bytes with SHA-256). The info string separates keys for different purposes so that one secret never yields the same key twice.
TLS 1.3's entire key schedule is HKDF with labels (HKDF-Expand-Label, RFC 9846 §7.1); HPKE, Signal, Noise, MLS and QUIC use it as well, and NIST approves the same two-step construction in SP 800-56C Rev. 2.
HKDF is not a password hash: it is fast by design, so feeding it a low-entropy password gives no protection against guessing. Use Argon2id, scrypt or PBKDF2 for passwords and HKDF for high-entropy secrets.