Personally, I would go ahead and use BCrypt. The algorithm may not be NIST-listed, but it's been around long enough (13 years now, and the Blowfish cipher itself almost 20) that I'd trust it. By comparison, MD5 was shown to be vulnerable a mere 5 years after its introduction and was considered completely broken in 18 years.
The only known attack on the Blowfish cipher in its 20 years is a known-plaintext attack, requiring an exponential number of known input messages and resulting ciphertexts (2^8n+1 where n is the number of rounds of the Feistel cipher; for standard 16-round Blowfish that's 2^129) to derive the key. For BCrypt, this same attack is infeasible; first, there's only ever one plaintext that is "valid" for BCrypt (the ASCII string "OrpheanBeholderScryDoubt"), and second, the key that would be reverse-engineered by feeding in other plaintexts is the result of the exponentially-complex key derivation function that obfuscates the password in the first place. There was a vulnerability shown in one C implementation of it for Unix systems, that broke the algorithm if it were fed a password containing non-base-ASCII characters; as a result, new algorithms that do not have the vulnerability should be prefaced with the BCrypt variant "$2y$" (though most still use the older "$2a$" which is ambiguous; the algorithm that generated the hash could be secure, but maybe not).
Now, while I prefer BCrypt, PBKDF2's no slouch. Although SHA-1 is considered vulnerable because of its constant, relatively low complexity, the estimated cost to break a single hash by renting enough CPU from a cloud provider to execute that attack would be about $2.77 million. In PBKDF2, SHA-1 is used as an HMAC, meaning SHA-1 hashing is performed at least twice per iteration of the derivation function. With 5,000 iterations and a key length of 320 bits (requiring two sets of 5,000 iterations, one for each half of the derived key), any vulnerability in breaking a single hash is offset by the fact that you'd have to reverse-engineer twenty thousand of them (adding complexity on the order of 2^14.3, making the complete attack something like 2^175).
Multiplying the $2.7 million cost to crack one SHA hash by the increased complexity gives you... a price tag of about $55.4 billion to break one PBKDF2 hash "the long way" (knowing nothing about the input password). Anyone who has that kind of scratch, and wants your secret, will find a cheaper way.
