django-bcrypt

In Django, as I recall, you just check for a hashing indicator that's prefixed to the hashed password, and do something like this on a user's log-in: if hashed_password.startswith("sha$"): hashed_password = bcrypt(hashed_password) (or `... = "bc$" + bcrypt(hashed_password)`. However it's done.) Here is the relevant code for django-bcrypt: https://github.com/dwaiter/django-bcrypt/blob/master/django_.... In your case, you could probably do this: if not hashed_password.startswith("bc$")\ and sha(entered_password) == hashed_password: hashed_password = "bc$" + bcrypt(entered_password) You don't have the prefix identifier, but that's okay; you just roll out an equivalent now instead, so you only have to check the start of the hash string and do the conversion, if it hasn't already been performed. Of course, you

Hopefully not bcrypt, since dwaiter already has that one solved with django-bcrypt[1]. [1] - https://github.com/dwaiter/django-bcrypt

Why couldn't they use SHA2 and make it go around X times? The bcrypt plugin [1] maintains backwards compatibility with old passwords just fine. Also, if you are cool with rolling your own registration forms/etc. you can easily just set the email as the username and email. You lose the more obscure but technically valid characters for email (a-z A-Z 0-9 @.+-_ are all fine), but 99% of emails work fine in the Django username field. Or maybe I just haven't hit some obvious problem with that implementation yet... [1] https://github.com/dwaiter/django-bcrypt/