PBKDF2

PBKDF2 (Password-Based Key Derivation Function 2) derives a cryptographic key from a password by running HMAC (usually HMAC-SHA-256 or HMAC-SHA-512) for a configurable number of iterations, with a salt mixed in. OWASP currently recommends at least 600,000 iterations for PBKDF2-HMAC-SHA-256. It is the only password-hashing function approved by FIPS 140, which is why it stays in heavy use for compliance-driven systems (1Password, LastPass, Wi-Fi WPA2-PSK, macOS FileVault). The weakness compared to Argon2 and scrypt is that PBKDF2 is not memory-hard, so attackers with GPUs and ASICs scale linearly with hardware spend.