For what it's worth the php implementation of password hashing offers a function to determine whether it's time to rehash a password. https://www.php.net/manua

For what it's worth the php implementation of password hashing offers a function to determine whether it's time to rehash a password. https://www.php.net/manual/en/function.password-needs-rehash.php https://www.php.net/manual/en/function.password-needs-rehash... The idea is to alert an application program to the need to regenerate the hash at the time it has the plaintext password in hand (when the user has just presented it for login). This is a great idea; rehashing a long-standing bcrypt password with a larger work factor makes it safer. And, an extension or new version of the runtime can add a new hashing scheme. It would be sweet if other password-hashing APIs added the same kind of thing. User accounts can last far longer than LTS versions of software runtimes, and this can help future-proof them.