Consider something like https://pythonhosted.org/passlib/modular_crypt_format.html https://pythonhosted.org/passlib/modular_crypt_format.html and support all yo

Consider something like https://pythonhosted.org/passlib/modular_crypt_format.html https://pythonhosted.org/passlib/modular_crypt_format.html and support all your old hash-functions. If you really want to migrate people to the new hash functions, you can: * Fully expire the accounts (and send emails asking them to reset their password) * If they successfully login to their account and you have the plain text password, you can re-hash that using argon2i. * Have them reset their password on next sign in before allowing them to do anything. * Let the user know their account has less security than it could, and they can upgrade the security by changing their password. Afaik, there is nothing you can do to upgrade their passwords, modulo argon2'ing the result of another hash function - I am simply too unclear on the safety of this approach so I don't do it.