yeah, i was right. there is a native SHA256 available in web browsers. so you can just make it do either some thousands of hash on the hash of the hash of the password, or you can also make it generate a stream and then hash the stream (just concatenated hash , with the hash of the hash joined and do that until it uses up some kilobytes, and then repeat that, depending on how memory hard or long each brute force attempt would be done. since it is almost as fast as a binary native hash function you can make it pretty strong, and still normally have the user's nsec unlocked in a second or so. each attempt on the password will cost that much time so it reduces the opportunity of an attacker who may have temporary access or access only when you are on some wifi network or so.