The first two are good enough, but shouldn't be the only protection. In general salts (adding an per password random string to the raw password) and pepper(addd

The first two are good enough, but shouldn't be the only protection. In general salts (adding an per password random string to the raw password) and pepper(addding an random string that is shared across the application) should be added. Pbkdf2 is quite old and has an attack vector from ASICs and FPGA, but is still quite widespread for applications and protocols.