Rather than emailing the passwords, you might want to look at the way Django does transparent upgrades of passwords. It has a prefix for the hashing algorithm

Rather than emailing the passwords, you might want to look at the way Django does transparent upgrades of passwords. It has a prefix for the hashing algorithm at the beginning, so it can check which algorithm is being used for each password: sha1$a1976$a36cc8cbf81742a8fb52e221aaeab48ed7f58ab4 So in your case, you could add a prefix 'txt$' in front of plain text passwords, and when the user successfully logs in, have it hash the password and save it in the database. The advantage of doing it the way Django does is that the "upgrade on successful login" lets you change your hash without causing problems with the users. Give the users a bonus or some reason for logging into their account and most of your passwords will get fixed automatically.