You might want to take a look at how Django does it, which is more or less an accepted best practice. https://docs.djangoproject.com/en/1.10/topics/auth/passwor

You might want to take a look at how Django does it, which is more or less an accepted best practice. https://docs.djangoproject.com/en/1.10/topics/auth/passwords/#password-upgrading-without-requiring-a-login https://docs.djangoproject.com/en/1.10/topics/auth/passwords...