Kestrel ran its own authentication for six years: a users table, bcrypt hashes, a homegrown session cookie and a growing list of edge cases. When they moved to Lintel this summer, the rule was simple. Nobody gets signed out and nobody resets a password.

Import the hashes, not the passwords

Lintel accepts bcrypt, scrypt, Argon2 and PBKDF2 hashes on import. Kestrel exported their users table, mapped the columns in the import tool and did a dry run against a staging instance. Every existing password kept working, and Lintel upgraded each hash to Argon2 the next time its owner signed in.

Run both systems for a week

For seven days, Kestrel’s API accepted both its old session cookie and a Lintel session token. New sign-ins went through Lintel, and old sessions kept working until they expired on their own, so nobody was signed out halfway through a task.

The numbers

2.1 million users imported in 38 minutes, with zero forced resets. Support tickets during migration week were lower than the week before, which the team still finds slightly suspicious.