How to increase PBKDF2-SHA256 iterations to 600,000 in Django 4.2.2 without forcing migrations or breaking existing passwords?

I have a Django 4.2.2 / Python 3.11.4 application where employee passwords are stored using PBKDF2-SHA256. Currently the code uses a hardcoded default hash and a runtime helper that calls make_password("123456"):

python
# current example
EMP_DEFAULT_PASSWORD = (
    "pbkdf2_sha256$36000$Gj09deAAUqW7$ih9vyun8PPwxvbG1+bhxB0TIQF+2IUfdhiDUf0AS0o4="
)

PASSWORD_HASHERS = [
    "django.contrib.auth.hashers.PBKDF2PasswordHasher",
]

def default_employee_password():
    """Return a password hash using the configured current hasher."""
    return make_password("123456")

Security requirement: increase PBKDF2-SHA256 iterations to at least 600,000 (subject to performance testing).

Constraints and concerns:

  • Existing users have hashes in the DB generated with 36,000 iterations — they must continue to authenticate without a forced reset.

  • Changing the model field default from a hardcoded hash to a callable or removing it previously caused an AlterField migration; I want to avoid unnecessary/destructive migrations that rewrite DB defaults or risk locking users out.

    • I want new passwords to use the stronger iteration count, and to phase in the stronger hashing without forcing all users to reset.

    enter image description here

Вернуться на верх