What are the potential issues or pitfalls when transitioning a system from md5 to password_hash for password storage?

Issue: One potential pitfall when transitioning from MD5 to password_hash for password storage is that existing user passwords hashed with MD5 will no longer be valid. To solve this issue, you can prompt users to reset their passwords upon their next login, allowing you to rehash their passwords using the password_hash function. 

// Check if user's password needs to be updated
if (password_needs_rehash($hashedPassword, PASSWORD_DEFAULT)) {
    // Prompt user to reset password
    // Update user's password with password_hash function
}

Keywords

md5 password_hash password storage security hashing algorithm

Related Questions