Key Derivation Function (KDF) usage for password storage Is it safe to use a KDF implementation in order to store passwords?
More broadly, is this standard? Do IT-companies really use KDF? Or do they usually rely on other algorithms?
If you have any practical example for the second question, I would appreciate it.
Yes and no, depending on what you mean by &quot;storing passwords&quot;.
If you mean &quot;storing my own passwords in a password store&quot;, then &quot;no&quot;, since this is clearly not the goal of a KDF. But if you mean &quot;storing authentication data in a database to authenticate our users&quot;, then yes, since passwords stored in that way are really hard to recover.
And &quot;yes&quot;, companies do use KDF and will keep using it more and more. Notably because NIST has standardized their usage in their latest publication on password storage: NIST.SP.800-63b which says that:

Verifiers SHALL store memorized secrets [i.e. passwords] in a form that is resistant to offline attacks. Memorized secrets SHALL be salted and hashed using a suitable one-way key derivation function.
Key derivation functions take a password, a salt, and a cost factor as inputs then generate a password hash. Their purpose is to make each password guessing trial by an attacker who has obtained a password hash file expensive and therefore the cost of a guessing attack high or prohibitive.

and also because nowadays, data leakages are extremely damageable to any company's PR.
There are two different kind of KDFs:

those for when you have a poor entropy and are afraid of Dictionary Attacks (typically if you store humanly memorable passwords), e.g. Argon2, Balloon, PBKDF, etc.
those that you use when you have a good entropy, which would for example be the case if you rely on the DH protocol to establish a common key. Like e.g. HKDF which is thought for such need-case.

The type I'm talking about here is of the first sort, when you store passwords in a database in order to authenticate users.
I personally have a preference for Argon2. Since other like PBKDF2, can be implemented on ASIC devices, which makes brute-force attacks using such devices much easier, or have less parameters one can tweak... Plus it was chosen as the winner of the password-hashing competition.
Now regarding whether KDFs are actually used, you can simply take a look at most password authentications out there and I believe you'll see that the most important ones do... For instance, LastPass advertises using PBKDF2 to protect your password-store main password and you can tweak yourself the number of iteration done. The Django's framework documentation also mention PBKDF2 as being its default algorithm.
Finally, Wikipedia has a nice list of things using PBKDF2. (Which is still the most used KDF, despite the existence of theoretically better ones.)