I am building an application that needs to locally store sensitive data, that is encrypted using the SHA-256 of a password provided by the user. It uses AES for encryption.
I am worried that some users may choose to use a weak password, that could be brute-forced by an attacker that gets that file and wants to read the content.
I am thinking that, in order to get the hash, a nonce must be appended to that password, and the first nonce for which the hash has the first X bits set to zero, that's the key that must be used. If X is set to 20, around 1 million hashes should be calculated in average to get the valid key from the password provided by the user.
This way the user might take 1 second to calculate the key (depending on their machine), making it extremely harder to brute-force it by guessing passwords.
Of course, this is something I came up with, and I guess that's why I shouldn't use it. Is there any widely tested alternatives for this?