cat << 'EOF' | git apply
diff --git a/lib/auth.py b/lib/auth.py
--- a/lib/auth.py
+++ b/lib/auth.py
@@ -3,6 +3,7 @@
 from abc import ABCMeta, abstractmethod
 from base64 import b64decode
 from functools import wraps
+import hmac
 
 LINUX_USER = os.getenv('USER', 'pi')
 
@@ -91,10 +92,53 @@
     display_name = 'Basic'
     name = 'auth_basic'
     config = {'auth_basic': {'user': '', 'password': ''}}
+    # Parameters for PBKDF2 password hashing
+    _PBKDF2_ALGORITHM = 'pbkdf2_sha256'
+    _PBKDF2_ITERATIONS = 260000
+    _PBKDF2_SALT_BYTES = 16
 
     def __init__(self, settings) -> None:
         self.settings = settings
 
+    def _hash_password(self, password: str) -> str:
+        """
+        Derive a secure hash for the given password using PBKDF2-HMAC-SHA256.
+        The returned format is: algorithm$iterations$salt_hex$hash_hex
+        """
+        salt = os.urandom(self._PBKDF2_SALT_BYTES)
+        password_bytes = password.encode('utf-8')
+        dk = hashlib.pbkdf2_hmac(
+            'sha256', password_bytes, salt, self._PBKDF2_ITERATIONS
+        )
+        return '{}${}${}${}'.format(
+            self._PBKDF2_ALGORITHM,
+            self._PBKDF2_ITERATIONS,
+            salt.hex(),
+            dk.hex(),
+        )
+
+    def _verify_password(self, password: str, stored: str) -> bool:
+        """
+        Verify a password against a stored PBKDF2-HMAC-SHA256 hash.
+        Supports the format produced by _hash_password.
+        """
+        try:
+            algorithm, iterations_str, salt_hex, hash_hex = stored.split('$', 3)
+        except ValueError:
+            # Stored value is not in the expected format.
+            return False
+        if algorithm != self._PBKDF2_ALGORITHM:
+            return False
+        try:
+            iterations = int(iterations_str)
+        except ValueError:
+            return False
+        salt = bytes.fromhex(salt_hex)
+        expected_hash = bytes.fromhex(hash_hex)
+        password_bytes = password.encode('utf-8')
+        dk = hashlib.pbkdf2_hmac('sha256', password_bytes, salt, iterations)
+        return hmac.compare_digest(dk, expected_hash)
+
     def _check(self, username: str, password: str) -> bool:
         """
         Check username/password combo against database.
@@ -107,10 +147,10 @@
         )
 
     def check_password(self, password: str) -> bool:
-        hashed_password = hashlib.sha256(
-            password.encode('utf-8')
-        ).hexdigest()
-        return self.settings['password'] == hashed_password
+        stored = self.settings['password']
+        if not stored:
+            return False
+        return self._verify_password(password, stored)
 
     def is_authenticated(self, request) -> bool:
         # First check Authorization header for API requests
@@ -148,10 +188,10 @@
 
     def update_settings(self, request, current_pass_correct):
         new_user = request.POST.get('user', '')
-        new_pass = request.POST.get('password', '').encode('utf-8')
-        new_pass2 = request.POST.get('password2', '').encode('utf-8')
-        new_pass = hashlib.sha256(new_pass).hexdigest() if new_pass else None
-        new_pass2 = hashlib.sha256(new_pass2).hexdigest() if new_pass else None
+        new_pass_raw = request.POST.get('password', '')
+        new_pass2_raw = request.POST.get('password2', '')
+        new_pass = new_pass_raw if new_pass_raw else None
+        new_pass2 = new_pass2_raw if new_pass2_raw else None
         # Handle auth components
         if self.settings['password']:  # if password currently set,
             if new_user != self.settings['user']:  # trying to change user
@@ -177,7 +217,7 @@
                 if new_pass2 != new_pass:  # changing password
                     raise ValueError('New passwords do not match!')
 
-                self.settings['password'] = new_pass
+                self.settings['password'] = self._hash_password(new_pass)
 
         else:  # no current password
             if new_user:  # setting username and password
@@ -186,7 +226,7 @@
                 if not new_pass:
                     raise ValueError('Must provide password')
                 self.settings['user'] = new_user
-                self.settings['password'] = new_pass
+                self.settings['password'] = self._hash_password(new_pass)
             else:
                 raise ValueError('Must provide username')
 
EOF