title: How to upgrade a password storage scheme (change hashing-algorithm)
body: <p>I've been asked to implement some changes/updates to an intranet-site; make it 'future proof' as they call it.  </p>
  
  <p>We found that the passwords are hashed using the MD5 algorithm. (the system has been around since 2001 so it was adequate at time).<br>
  We would now like to upgrade the hashing-algorithm to a stronger one (BCrypt-hash or SHA-256).</p>
  
  <p>We obviously do not know the plaintext-passwords and creating a new password for the userbase is <em>not an option</em><sup>*)</sup>.</p>
  
  <p>So, my question is:</p>
  
  <p><strong>What is the accepted way to change hashing-algorithm without having access to the plaintext passwords?</strong><br>
  The best solution would be a solution that is entirely 'behind the scenes'.</p>
  
  <p><sub>
  *) we tried; tried to convince them, we used the argument of 'password age', tried to bribe them with coffee, tried to bribe them with cake, etc. etc. But it is <em>not an option</em>.
  </sub></p>
  
  <p><strong>Update</strong><br>
  I was hoping for some sort of automagic solution for solving the problem, but apparently there are no other options than just 'wait for the user to log in, then convert'.</p>
  
  <p>Well, at least now I now there is no other solution available.</p>