As I said, I use recaptcha to prevent bots, which would also include preventing phishing. Ultimately, if you are writing A SaaS you have to roll your own at so

As I said, I use recaptcha to prevent bots, which would also include preventing phishing. Ultimately, if you are writing A SaaS you have to roll your own at some point, but I agree it shouldn't include things like key derivation functions. Maybe I'm dense, but I just don't see how enforcing password strength on both the client and server is making me safer from hackers.