How to harden user/login password?
On MacOS you can use PBKD2 (Password Based Key Derivation 2) to create secure password verifiers. This is an accepted method by NIST. Supply a random salt (you can save it with the hashed password) and an iteration count such the the derivation takes around 100ms.

When saving a password verifier just using a hash function is not sufficient and just adding a salt does little to improve the security. Instead iterate over an HMAC with a random salt for about a 100ms duration and save the salt with the hash. Better yet use a function such as PBKDF2, Rfc2898DeriveBytes, Argon2, password_hash, Bcrypt or similar functions. The point is to make the attacker spend substantial time finding passwords by brute force.

See NIST Digital Identity Guidelines

See this How to use CommonCrypto for PBKDF2 in Swift 2 &amp; 3
 or example code.