J
jeremy
21 minutes
Django Rehashes a Stored Password at Login When PBKDF2 Iterations Rise
The stored hash `pbkdf2_sha256$<iterations>$<salt>$<hash>` records its iteration count; when it is below the current default, a successful `check_password` re-hashes the password with the new count and saves it, so users who never log in keep the old hash.