A web application developer is designing how user passwords will be stored in a database. She is concerned that even with hashing and per-user salts, attackers with modern GPU hardware could brute-force the stored password hashes very quickly. She wants a technique that deliberately increases the computational cost of computing each hash to slow down offline cracking attempts. Which technique best addresses her concern?