Sorry, I was trying to point out that you can have it both ways. As pixelcort suggested, do a one-time upgrade of all (weak) hashes to newScheme(oldScheme(passw

Sorry, I was trying to point out that you can have it both ways. As pixelcort suggested, do a one-time upgrade of all (weak) hashes to newScheme(oldScheme(password). But then as users login, you can upgrade them to just newScheme(password). No need to force a reset just because people haven't logged in recently. I'm familiar with Django, and they happen to have some nice docs on both parts of the process: bulk upgrade to stronger scheme by wrapping [1] and individual upgrade on login [2]. But the technique isn't unique to Django. [1]: https://docs.djangoproject.com/en/1.10/topics/auth/passwords/#password-upgrading-without-requiring-a-login https://docs.djangoproject.com/en/1.10/topics/auth/passwords... [2]: https://docs.djangoproject.com/en/1.10/topics/auth/passwords/#password-upgrading https://docs.djangoproject.com/en/1.10/topics/auth/passwords...