You can still do that on-demand retraction as long as the hash is fed something from the database that you can change. IIRC, Django uses both password and last

You can still do that on-demand retraction as long as the hash is fed something from the database that you can change. IIRC, Django uses both password and last login timestamp inside the hash. If you needed to invalidate someone's token you could just add 1 millisecond to their last login time.