code: protected function updateCredentialHash(PasswordableInterface $identityObject, $password)
      {
          $cryptoService = $this->getMapper()->getPasswordService();
          if (!$cryptoService instanceof Bcrypt) {
              return $this;
          }
  
          $hash = explode('$', $identityObject->getPassword());
          if ($hash[2] === $cryptoService->getCost()) {
              return $this;
          }
  
          $identityObject->setPassword($cryptoService->create($password));
  
          return $this;
      }
docs: Update identity object password hash if cost has been changed
  
  @param PasswordableInterface $identityObject
  @param string $password
  @return self