The password updating is pretty seamless (so long as you don't need to share the database with an older Django project). PASSWORD_HASHERS = ( 'django.c

The password updating is pretty seamless (so long as you don't need to share the database with an older Django project). PASSWORD_HASHERS = ( 'django.contrib.auth.hashers.PBKDF2PasswordHasher', 'django.contrib.auth.hashers.PBKDF2SHA1PasswordHasher', 'django.contrib.auth.hashers.BCryptPasswordHasher', 'django.contrib.auth.hashers.SHA1PasswordHasher', 'django.contrib.auth.hashers.MD5PasswordHasher', 'django.contrib.auth.hashers.CryptPasswordHasher', ) You get a tuple of password algorithms that are supported. The higher on the list the greater priority it has, so if you have SHA1 passwords in your database, they will get converted to PBKDF2 when the user logs in the first time. If you decided to switch to BCrypt, you would first install py-bcrypt and change the tuple to put BCrypt at the top: PASSWORD_HASHERS = ( 'django.contrib.auth.hashers.BCryptPasswordHasher', 'django.contrib.auth.hashers.PBKDF2PasswordHasher', 'django.contrib.auth.hashers.PBKDF2SHA1PasswordHasher', 'django.contrib.auth.hashers.BCryptPasswordHasher', 'django.contrib.auth.hashers.SHA1PasswordHasher', 'django.contrib.auth.hashers.MD5PasswordHasher', 'django.contrib.auth.hashers.CryptPasswordHasher', ) and you're done. HOWEVER, if you are sharing the database with an older project that is still using Django 1.3 or less, make sure that 'django.contrib.auth.hashers.SHA1PasswordHasher' is on the top of the list (until all your projects are Django 1.4 or higher) otherwise your other installations won't be able to read the passwords since they won't support any of the newer password hashes.