. If you just change the web config then DNN handles it pretty gracefully...
<addname="AspNetSqlMembershipProvider"type="System.Web.Security.SqlMembershipProvider"
connectionStringName="SiteSqlServer"enablePasswordRetrieval="false"
enablePasswordReset="true"requiresQuestionAndAnswer="false"
minRequiredPasswordLength="7"minRequiredNonalphanumericCharacters="0"
requiresUniqueEmail="false"passwordFormat="Hashed"applicationName="DotNetNuke"
description="Stores and retrieves membership data from the local Microsoft SQL Server database" />
I turned ON hashing and OFF password retrieval from the defaults.
You can still login with the old passwords (clever!). Membership table stores new a accounts, added under the new regime, as having a different password format.
If you try to get a password back then the page tells you - “This site does not support password retrieval but will email you a new random one.”
The only place it really goes wrong is if you return the web config to the original default setting and then try to get a password back, from a new regime account. At least it didn’t crash but it tells you there was an error recovering your password. The user would have to ask the admin to reset the account password.