Don't forget to build a hash round counter into whatever bcrypt/scrypt setup you use. Don't just take the salt+password and run it through bcrypt once – do it a

Don't forget to build a hash round counter into whatever bcrypt/scrypt setup you use. Don't just take the salt+password and run it through bcrypt once – do it as many times as your hardware setup permits, and store that counter as part of the hash (~bcrypt~DKM303mGdoadyHerichurkman~5000~de455ae…). As your computing power grows, you can increase the number of rounds. If you ever replace your login algorithm like Kickstarter did, give your users a few months to log in to upgrade their stored hashed password. Then purge any outdated hashes. Let those users do password resets.