Let's say I use bcrypt and want to increase the work factor every year. Is it possible to determine the work factor of an existing hash, or will I need to main

Let's say I use bcrypt and want to increase the work factor every year. Is it possible to determine the work factor of an existing hash, or will I need to maintain this information alongside the hash? The java and python bcrypt APIs don't have any function that returns the work factor. Can I increase the work factor of an existing hash, or must I wait until the user logs in and then use the plaintext password to generate a new hash? Is there a bcrypt API that provides a hash comparison function that addresses timing attacks? The py-bcrypt example code uses the '==' operator to compare hash strings, leaking timing information: # Check that an unencrypted password matches one that has # previously been hashed if bcrypt.hashpw(password, hashed) == hashed: print "It matches" else: print "It does not match" (from http://www.mindrot.org/projects/py-bcrypt/ http://www.mindrot.org/projects/py-bcrypt/)