3 ms·

I don't know what the reason actually is, but I assumed it was slow by design to make it harder to compromise, similar to bcrypt.