I\'ve been asked to implement some changes/updates to an intranet-site; make it \'future proof\' as they call it.
We found that the passwords are hashed using the MD5
Add passwordChange datetime field to the database.
All password set before day X, check using MD5
All passwords set after day X, check using BCrypt or whatever.