[weird-eye-issue]

is_password_valid = hash_password(normalize_password_case(password) if version == 1 else password) == hashed_password

[pixl97]

Are we doing this client side or server side?

If you're actually using a 'strong enough' hash to prevent easy cracking if your hashed password database is leaked then you're doubling the server load which can be quite substantial in some cases.

[weird-eye-issue]

It's only being hashed once...

And obviously this is server side