Which algorithms are used to harden password handling against brute-force attacks for REST APIs?

PBKDF2, BCrypt, and SCrypt are key derivation functions specifically designed to make brute-force attacks against passwords computationally expensive. They achieve this by incorporating a salt and an iterative hashing process, making each password attempt take significantly longer than with simple cryptographic hash functions. SHA-512, SHA-384, SHA-256, SHA-1, and MD5 are cryptographic hash functions. While they provide one-way hashing, they are not designed with the same computational cost mechanisms as KDFs, making them less resistant to brute-force attacks, especially with modern hardware. MD5 and SHA-1 are also considered cryptographically weak for many applications due to known vulnerabilities.