It's not so simple but also not an obscene amount of effort. Even with a Micro framework the first iteration should be there after a week or two. Probably most

It's not so simple but also not an obscene amount of effort. Even with a Micro framework the first iteration should be there after a week or two. Probably most effort is 2FA and the whole E-Mail sending, verification etc. Especially testing this :/ Reliable implementations for hash functions are available for literally any language that is used in production. They take care of all the problematic parts. (In fact nobody should write this by himself or herself) I'm sure as a custom implementer it's still possible to accidentally sneak in something time-dependent (still difficult to exploit, with smart rate limiting in place, I would say forget it) or a null/whitespace bug (easy to exploit but might require custom tooling). But that's just a matter of testing and having a 2nd pair of eyes look over it. How do you know an off-the-shelve solution doesn't have the same problems or different ones? With a limited time/money budget auditing someone else's code is far more effort than doing the same thing with the own code.