Home/ Questions/Q 7063351
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-28T04:42:12+00:00

When changing the password-hashing algorithm for an application, how should the system migrate the

  • 0

When changing the password-hashing algorithm for an application, how should the system migrate the values already saved in the database? I am well aware of the fact that I can’t migrate them in their hashed form but that I need to have the input data in order to calculate the new hash.

There are two situations in which I have access to the input data:

  1. During login
  2. When the user changes her password in her profile settings

obviously only during one of these I am able to save the new hash to the database to migrate the password.

Although all of my colleagues are voting for method one my gut tells me to not do that. Is there a recommended way?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    I see no reason not to do this on logon. Is there a reason you don’t want to do #1? You validate against the new hash, if that fails, validation against the old hash algorithm. If that works, I’d then write the new hash over the old one. This means that your passwords will be converted faster, since users probably logon more than they go to change their password. Unless you force people to, I doubt most will change it on their own.

    • 0