It’s hard to get right. In my experience plenty of developers fool themselves into thinking it’s not that hard. The problem is they’ve never read an NIST standard or spent time learning state of the art black hat techniques. If you don’t keep up you’ll implement something out dated or broken and not even know it.