I am working on trying to build some foundational knowledge on secure deployments of PostgreSQL. I’m currently on version 16. While only one measure of security protocol, my first step is to secure passwords for users using SCRAM 256. Given that the literature on this type of configuration is limited, I wanted to know what the recommendation is on the number of scram iterations that should be configured in my postgresql.conf file?

The default is 4096 and I don’t fully understand what a larger number would do in terms of securing my database cluster.

I’ve read the postgresql official documentation, searched through stack overflow, done a number of google searches, and tried to review different YouTube videos on the topic.