I noticed you are using pbkdf2 to convert password to key. It's recommended to use ARGON2 nowadays.

From some googling, pbkdf2 increases CPU usage to make brute force harder, scrypt increases memory usage to make brute force harder. ARGON2 increases CPU and RAM usage to make brute force harder.

There are other advantages as well, and it is considered the best key derivation function right now.