A better comparison for this situation would be: 1 second in my browser and 1 year to bruteforce on attacker's server cluster v.s. 0.5 seconds in my browser

A better comparison for this situation would be: 1 second in my browser and 1 year to bruteforce on attacker's server cluster v.s. 0.5 seconds in my browser and 1 year to bruteforce on attacker's server cluster or 1 second in my browser and 2 years to bruteforce on attacker's server cluster The idea is to choose the method that is most efficient for you, because doing so allows you to choose a work factor that makes things harder for the attacker without sacrificing usability.