$ accounts secured with PBKDF2-SHA256 + random salt
✓ PBKDF2-SHA256, 310,000 iterations (OWASP 2023 minimum) ✓ unique random 16-byte salt per account ✓ your actual password is never stored anywhere ✓ uses browser's native Web Crypto API — no external libraries