To be specific about my claim: throwing away the earlier version and replacing it with the argon-wrapped version cannot make the user&#x27;s original password <i>easier</i> to recover, because it adds no new information about the password. To convince yourself of that, imagine that there was some function `argon(hash)` that made the password easier to recover. Why wouldn&#x27;t an attacker run that function themselves? In the very worst case a bad hash function that takes one second to run could only speed up the attacker&#x27;s job by one second.<p>Wrapped hashes <i>could</i> have other side effects for probing non-hacked sites -- for example, attackers could probably figure out which chain a user has based on timing, which would let them narrow down a bit when the user last logged in. Hash chains could also theoretically reduce the total output space for the final hash, making it easier to brute force a password through the login form of a non-hacked site. I don&#x27;t consider either of those likely to matter, but you might.