> Alternatively, require the existing password in the same form and you don't have to check against hashes, since you have the plaintext password right there.

> Alternatively, require the existing password in the same form and you don't have to check against hashes, since you have the plaintext password right there. Presumably, you will also have a forgot password flow that allows you to change your password without entering the old one. People will make things easy for themselves. Coming up with good passwords is hard. Having to rotate passwords just seems like a lot of busywork and people will make it as easy for themselves as possible.