As far as I know, that is correct.[1]
Any change, whether for work factor or algorithm in code still waits for the user to come back and attempt a login, at which point you update the database stored attributes and the hash.<p>I think that if you can update a user&#x27;s password without them inputting, then you have two problems.<p>[1]not authoritative advice.<p><i>edit: seems that comments suggest doing the md5(bcrypt(hash)) can be used to upgrade across the board</i>