Rehash on Login

Hardware gets faster. Your bcrypt cost from 2018 may now be too low.

Strategy: when a user logs in:

1. Verify their password against the stored hash.
2. CHECK if the stored hash uses outdated parameters.
3. If yes: rehash with current parameters and update the database.

The argon2 library has needs_rehash() checks for memory + iteration parameters.

For users who NEVER log in: their hash stays at the old cost. Periodic forced rehash via password reset (or just accept the residual risk for inactive users).

This is the standard pattern for staying ahead of hardware advancement WITHOUT requiring all users to change passwords.