You only have to do it when you in-place upgrade the entire table, and once when the user initially logs in after that.<p>Once the user has logged in successfully, you can replace new_hash(old_hash(password)) with simply new_hash(password).<p>This is less useful for optimistic upgrades like bcrypt-&gt;argon2i, but is <i>absolutely critical</i> if you find yourself taking over responsibility for a database that has a password column full of, say, MD5s.<p>Waiting for each and every user to log in to upgrade those vulnerable hashes is suicidal.