Django's auth system handles updates safely and cleanly. Don't know about others, but the mechanism is simple: * The value stored in the DB is actually of the

Django's auth system handles updates safely and cleanly. Don't know about others, but the mechanism is simple: * The value stored in the DB is actually of the form "algorithm$iterations$salt$hash". * The current preferred algorithm and iterations are configurable in the settings. * When logging a user in, the algorithm/iterations in the stored value are used to check the password. * If the stored value's algorithm/iterations are out of sync with the preferred algorithm/iterations in the settings, then the last step of the login process is to re-hash the (verified correct) submitted password with the new preferred algorithm/iterations, and push that value back to the DB. Which creates a rolling refresh of the stored values as users log in, which in turn lets you gracefully change the algorithm or number of iterations.