Comment by magicalhippo

Potentially ignorant question, why would they go for bcrypt over say HKDF[1], especially since they mix in public data like the username and potentially userid?

[1]: https://datatracker.ietf.org/doc/html/rfc5869