KDFs only add 10-20 bits of security in terms of attack costs, there's only so much you can do to make 8 character passwords safe. If you control the parameter

KDFs only add 10-20 bits of security in terms of attack costs, there's only so much you can do to make 8 character passwords safe. If you control the parameters you can improve that boundary-- say, FDE with a KDF that uses 8GB of RAM and 10 seconds to compute-- but consumer products are limited.