Adding SSO after many users already signed up -- how to migrate them?

[RGJ (Richard - Communiteq)]

This is a built in function.

$hash = hash_pbkdf2('sha256', 'YourPassword', 'YourSalt', 64000, 64, false);

@EGreg

What if one of the characters ends up being 0 because ‘a’ was xored with ‘a’ – what happens to that string? Aren’t strings null-terminated?

Typically hash algorithms operate on binary data and the result is hex- or Base64-encoded upon output. So that’s not an issue.