Django 6.1 raises PBKDF2 default to 1.5M iterations, rewrites hashes on login

Django 6.1 changed the default PBKDF2 iteration count from 1,200,000 to 1,500,000, adding roughly 50–90 ms of CPU time per login. On successful authentication the stored hash is silently rewritten to the new count, but hashes already set above it, such as 3,000,000 iterations, are downgraded to 1,500,000.

• PBKDF2 iterations: 1,200,000 in Django 6.0 vs 1,500,000 in 6.1
• Login costs 50–90 ms more CPU; throughput scales nearly linearly to 4 cores
• Stored hash is rewritten on login with no migration: 1.2M to 1.5M
• A 3,000,000-iteration hash is reduced to 1,500,000 on next login