We wrote a plugin for this a while ago that uses crypt(3) with 5000 rounds SHA-256 and a 96 bit salt – it's the safest method I found that fit within Wordpress'

We wrote a plugin for this a while ago that uses crypt(3) with 5000 rounds SHA-256 and a 96 bit salt – it's the safest method I found that fit within Wordpress' password hash column without altering it, even if I'd have preferred scrypt (argon2 wasn't out yet). I guess we should open source it after all.