Key stretching can make the difference between recovering a secret nearly instant to nearly impossible, but it has had a fun history with bugs, footguns, and "features". This talk will answer many common questions and myths on key stretching and PAKEs. What to avoid, what to use, minimum safe settings for key stretching, side-channel attacks, and when key stretching is necessary with PAKEs. PAKEs can prevent all sorts of attacks and should be used on encrypted cloud services. Most encrypted cloud services that use a password can greatly benefit from PAKEs. By the end, you'll learn enough to be able to make toy key stretching algorithms and toy PAKEs. Just don't push those toys to prod.