It is a known good practice to use slow password hashing algorithms with a tunable iteration count to increase the difficult of a successful bruteforce attack on a password hash.
I quote part of an answer by Thomas Pornin on Information Security Stackexchange.
As much as possible ! This salted-and-slow hashing is an arms race between the attacker and the defender. You use many iterations to make the hashing of a password harder for everybody. To improve security, you should set that number as high as you can tolerate on your server, given the tasks that your server must otherwise fulfill. Higher is better.
A high iteration count for the password hashing function will lead to a slight delay when a user is attempting to register or login. Are there studies that show how long a user is willing to wait before thinking that something is wrong?