In the supposed scenario that the server sucks, and it stores directly whatever you sent them, no rounds, no salt, nothing, what you are left with, is whatever

In the supposed scenario that the server sucks, and it stores directly whatever you sent them, no rounds, no salt, nothing, what you are left with, is whatever protection you did on the client side, so I'm thinking doing the rounds client-side. Now that I'm thinking about it, I don't know how practical it is to do the rounds on a low-spec device like a cheap android