A fast hash such as SHA-256 lets attackers test billions of guesses per second on GPUs. Password hashes add a unique random salt per password (defeating precomputed tables) and a tunable cost. OWASP's Password Storage Cheat Sheet recommends, in order: Argon2id (RFC 9106) with at least 19 MiB of memory, 2 iterations and parallelism 1; scrypt with N = 2¹⁷, r = 8, p = 1; bcrypt with a work factor of 10 or more (it truncates input at 72 bytes); and, where FIPS 140 is required, PBKDF2-HMAC-SHA256 with at least 600,000 iterations.
Store the algorithm and parameters with the hash (the PHC string format $argon2id$v=19$m=19456,t=2,p=1$…, bcrypt's $2b$10$…) so that costs can be raised later and old hashes upgraded at the next login. An optional pepper, a secret kept outside the database, adds protection if only the database leaks.
NIST SP 800-63B-4 requires salted, cost-hardened storage and, for passwords used as a single authentication factor, a minimum length of 15 characters. Passkeys remove the stored secret altogether: the server keeps only a public key.