Как хранить пароли: BCrypt, Argon2, PBKDF2 — и почему не SHA-256?

var hasher = new PasswordHasher<User>();
string hash = hasher.HashPassword(user, "S3cure!pass");
// "AQAAAAIAAYagAAAAE..." — base64: [версия формата][алгоритм][итерации][соль][хэш]

var result = hasher.VerifyHashedPassword(user, hash, providedPassword);
switch (result)
{
    case PasswordVerificationResult.Success: break;
    case PasswordVerificationResult.SuccessRehashNeeded:          // старый формат или мало итераций
        user.PasswordHash = hasher.HashPassword(user, providedPassword);
        await db.SaveChangesAsync();
        break;
    case PasswordVerificationResult.Failed: return Unauthorized();
}

builder.Services.Configure<PasswordHasherOptions>(o => o.IterationCount = 600_000);

public static class Pbkdf2Hasher
{
    private const int SaltSize = 16, HashSize = 32, Iterations = 600_000;
    private static readonly HashAlgorithmName Algorithm = HashAlgorithmName.SHA256;

    public static string Hash(string password)
    {
        byte[] salt = RandomNumberGenerator.GetBytes(SaltSize);          // криптостойкий ГСЧ, не Random
        byte[] hash = Rfc2898DeriveBytes.Pbkdf2(password, salt, Iterations, Algorithm, HashSize);
        return $"pbkdf2-sha256${Iterations}${Convert.ToBase64String(salt)}${Convert.ToBase64String(hash)}";
    }

    public static bool Verify(string password, string stored)
    {
        var parts = stored.Split('$');
        int iterations = int.Parse(parts[1]);
        byte[] salt = Convert.FromBase64String(parts[2]);
        byte[] expected = Convert.FromBase64String(parts[3]);
        byte[] actual = Rfc2898DeriveBytes.Pbkdf2(password, salt, iterations, Algorithm, expected.Length);
        return CryptographicOperations.FixedTimeEquals(actual, expected);   // не SequenceEqual и не ==
    }
}

string hash = BCrypt.Net.BCrypt.EnhancedHashPassword(password, workFactor: 12);   // "$2a$12$соль+хэш"
bool ok = BCrypt.Net.BCrypt.EnhancedVerify(password, hash);
// Enhanced — предварительно хэширует SHA-384, снимая ограничение 72 байта

byte[] salt = RandomNumberGenerator.GetBytes(16);
using var argon = new Argon2id(Encoding.UTF8.GetBytes(password))
{
    Salt = salt,
    MemorySize = 65536,          // KiB = 64 MB
    Iterations = 3,
    DegreeOfParallelism = 1
};
byte[] hash = await argon.GetBytesAsync(32);