Use PBKDF2 when checking tokens to limit brute-force attacks