[SahAssar]

I don't think that'd work in this case since the SHA-1 was salted, so you'd need to store the SHA-1 salt in a separate column, then calculate Bcrypt(SHA-1(input + salt)), right?

[msbarnett]

Obviously they had to be storing the salt to begin with, so yes you’d keep using that salt column and use user input+salt as the input to SHA-1.

[CiPHPerCoder]

The legacy_password flag can also be a text field containing a salt. If it's empty, you have a non-legacy password.