btw it is important to stress that: 1) slow hash function. 2) per user random salt. 3) everything you want don't help if the password is "apple". So also you

btw it is important to stress that: 1) slow hash function. 2) per user random salt. 3) everything you want don't help if the password is "apple". So also you need: 4a) force users to passwords with required length / non alphanumerical chars, ... or 4b) relax the security requirements.