Consider something like <a href="https:&#x2F;&#x2F;pythonhosted.org&#x2F;passlib&#x2F;modular_crypt_format.html" rel="nofollow">https:&#x2F;&#x2F;pythonhosted.org&#x2F;passlib&#x2F;modular_crypt_format.html</a> and support all your old hash-functions. If you really want to migrate people to the new hash functions, you can:<p>* Fully expire the accounts (and send emails asking them to reset their password)<p>* If they successfully login to their account and you have the plain text password, you can re-hash that using argon2i.<p>* Have them reset their password on next sign in before allowing them to do anything.<p>* Let the user know their account has less security than it could, and they can upgrade the security by changing their password.<p>Afaik, there is nothing <i>you</i> can do to upgrade their passwords, modulo argon2&#x27;ing the result of another hash function - I am simply too unclear on the safety of this approach so I don&#x27;t do it.