我认为没有理由不在登录时执行此操作.你有理由不想做#1吗?您验证新的哈希，如果失败，验证旧的哈希算法.如果可行，那么我将在旧哈希上写入新哈希.这意味着您的密码将被更快地转换，因为用户登录的次数可能比更改密码的次数要多.除非你强迫人们这样做，否则我怀疑大多数人会自己改变它.

I see no reason not to do this on logon. Is there a reason you don't want to do #1? You validate against the new hash, if that fails, validation against the old hash algorithm. If that works, I'd then write the new hash over the old one. This means that your passwords will be converted faster, since users probably logon more than they go to change their password. Unless you force people to, I doubt most will change it on their own.