now using SHA-256 iterated 2^14 times to provide some brute force resistance