code: protected function needsPasswordRehash(array $userData)
      {
          // Return if password rehashing is not enabled
          if ($this->config["login"]["passwordRehash"] !== true) {
              return false;
          }
  
          // Password hash is created using a different algorithm than default
          if (isset($userData['encoder']) && $userData['encoder'] !== $this->config["encoder"]) {
              return true;
          }
          $encoder = $this->getPasswordEncoder($userData);
  
          // If password hash algorithm options have changed
          return $encoder->needsRehash($userData['pwhash']);
      }
docs: Returns whether a rehash is needed
  
  @param array $userData User data array
  @return boolean true if needed, false otherwise