For production passwords, use a modern KDF (Argon2id) unless you specifically need PBKDF2 for compatibility.