diff -urp password_policy.old/constraints/constraint_history.inc password_policy/constraints/constraint_history.inc
--- password_policy.old/constraints/constraint_history.inc	Fri May  8 14:19:02 2009
+++ password_policy/constraints/constraint_history.inc	Mon Oct 19 09:32:37 2009
@@ -26,13 +26,50 @@ function password_policy_constraint_hist
  * Password validation.
  */
 function password_policy_constraint_history_validate($password, $constraint, $uid) {
-  return !in_array(md5($password), _password_policy_constraint_history_old_passwords($constraint, $uid));
+  $old_hashes = _password_policy_constraint_history_old_passwords($constraint, $uid);
+  foreach ($old_hashes as $hash) {
+    if (_password_policy_check_hash($password, $hash)) {
+      return FALSE;
+    }
+  }
+
+  return TRUE;
+}
+
+function password_policy_constraint_history_validate_js($account) {
+  if (drupal_valid_token($_GET['token'], $account->uid)) {
+    $password = $_POST['password'];
+    $constraint = intval($_POST['constraint']);
+    print drupal_to_js(password_policy_constraint_history_validate($password, $constraint, $account->uid));
+  }
+  exit();   
 }
 
 /**
  * Javascript portion.
  */
 function password_policy_constraint_history_js($constraint, $uid) {
+  if (_password_policy_phpass_enabled()) {
+    $token = drupal_get_token($uid);
+    $s = '';
+    $s .= "  var data={ password: value, constraint: $constraint };\n";
+    $s .= "  $.ajax({\n";
+    $s .= "    type: \"POST\",\n";
+    $s .= "    url: Drupal.settings.basePath + '?q=password_policy/history/$uid&token=$token',\n";
+    $s .= "    data: data,\n";
+    $s .= "    timeout: 1000,\n";
+    $s .= "    dataType: \"json\",\n";
+    $s .= "    async: false,\n";
+    $s .= "    success: function (data) {\n";
+    $s .= "               if (!data) {\n";
+    $s .= "                 strength=\"low\";\n";
+    $s .= "                 msg.push(translate.constraint_history);\n";
+    $s .= "               }\n";
+    $s .= "             }\n";
+    $s .= "  });\n";
+    return $s;
+  }
+
   drupal_add_js(drupal_get_path('module', 'password_policy') .'/constraints/scripts/webtoolkit.md5.js');
   $pass = _password_policy_constraint_history_old_passwords($constraint, $uid);
   $s = '';
diff -urp password_policy.old/password_policy.install password_policy/password_policy.install
--- password_policy.old/password_policy.install	Sun Oct 26 11:21:06 2008
+++ password_policy/password_policy.install	Sat Oct 10 12:46:14 2009
@@ -109,9 +109,9 @@ function password_policy_schema() {
           'not null' => TRUE,
         ),
         'pass' => array(
-          'description' => t("User's password (md5 hash)."),
+          'description' => t("User's password hash."),
           'type' => 'varchar',
-          'length' => 32,
+          'length' => 60,
           'not null' => TRUE,
         ),
         'created' => array(
@@ -154,5 +154,14 @@ function password_policy_schema() {
       'indexes' => array('uid' => array('uid')),
     ),
   );
+}
+
+/**
+ * Alter table password_policy_history to accommodate phpass hash
+ */
+function password_policy_update_6001() {
+  $ret = array();
+  $ret[] = update_sql("ALTER TABLE {password_policy_history} CHANGE pass pass varchar(60) NOT NULL");
+  return $ret;
 }
 
diff -urp password_policy.old/password_policy.module password_policy/password_policy.module
--- password_policy.old/password_policy.module	Thu Jun  4 21:48:40 2009
+++ password_policy/password_policy.module	Mon Oct 19 09:28:40 2009
@@ -143,6 +143,13 @@ function password_policy_menu() {
     'page arguments' => array(4),
     'access arguments' => array('unblock expired accounts'),
   );
+  $items['password_policy/history/%user_uid_optional'] = array(
+    'page callback' => 'password_policy_constraint_history_validate_js',
+    'page arguments' => array(2),
+    'access callback' => user_edit_access,
+    'access arguments' => array(2), 
+    'type' => MENU_CALLBACK,
+  ); 
   return $items;
 }
 
@@ -702,7 +709,54 @@ function _password_policy_start($expirat
  *   Clear text password.
  */
 function _password_policy_store_password($uid, $pass) {
-  db_query("INSERT INTO {password_policy_history} (uid, pass, created) VALUES (%d, '%s', %d)", $uid, md5($pass), time());
+  $hash = _password_policy_hash_password($pass);
+  db_query("INSERT INTO {password_policy_history} (uid, pass, created) VALUES (%d, '%s', %d)", $uid, $hash, time());
+}
+
+/**
+ * Generate a password hash.
+ *  IF   phpass module is enabled, generates using phpass,
+ *  ELSE regular md5
+ *
+ * @param $pass
+ *   Clear text password.
+ */
+function _password_policy_hash_password($pass) {
+  if (_password_policy_phpass_enabled()) {
+    return _password_policy_phpass_hash($pass);
+  }
+  return md5($pass);
+}
+/**
+ * Check a password against a known hash
+ * @return
+ *   TRUE if hashes match
+ */
+function _password_policy_check_hash($pass, $known_hash) {
+  if (_password_policy_phpass_enabled()) {
+    $phpass = _password_policy_new_phpass();
+    return $phpass->CheckPassword($pass, $known_hash);
+  }
+
+  return md5($pass) == $known_hash;
+}
+
+// -----------------------------------------------------------------------
+// phpass helpers
+function _password_policy_phpass_enabled() {
+  return module_exists('phpass') && variable_get('user_hash_method', 'phpass') == 'phpass';
+}
+function _password_policy_new_phpass() {
+  // initialize phpass
+  require_once(drupal_get_path('module', 'phpass') .'/PasswordHash.php');
+  $phpass = new PasswordHash(variable_get('user_hash_strength', 8), variable_get('user_hash_portable', TRUE));
+  return $phpass;
+}
+function _password_policy_phpass_hash($pass) {
+  $phpass = _password_policy_new_phpass();
+
+  // get a new secure hash
+  return $phpass->HashPassword($pass);
 }
 
 /**