@benjojo I have a suspicion.... Code doesn't properly handle $pdkdf2:..., probably because of some migration? (Were passwords previously stored plaintext?). Smells like epic fail, though.