4. Expire all passwords and ask your users to come reset them. - No legacy code necessary Regular users should have no problems if there's an accompanying blog

4. Expire all passwords and ask your users to come reset them. - No legacy code necessary Regular users should have no problems if there's an accompanying blog post Non-regular users might just remember about your site/service and come back :) 5. Use bcrypt/password stretching. Store the work value alongside the password and upgrade it as people log in. To me that's not really keeping legacy code around; just an extra variable...