That's what I do, though care should be taken that you can't then login against the old passwords by putting md5(password) in the password field. Usually you d

That's what I do, though care should be taken that you can't then login against the old passwords by putting md5(password) in the password field. Usually you do this by decorating the bcrypt(md5(p)) entries in some way so you can recognize which ones are tested with bcrypt() vs bcrypt(md5()).