Changing password hash and iv on (successful) user login I've implemented a system for my login page (with php) that will update the password hash and initialization vector (for openssl) on each login. So essentially, every time the user successfully logs in, the initialization vector for openssl is re-created in the following way: 

1. generate 16 random bytes.
2. Hash the bytes with SHA256.
3. Store the hash in the database.


For encrypting the passwords:

1. Grab the newly created IV.
2. Cut the IV to a 16-byte-long string using a secret algorithm.
3. Use the shortened IV in the openssl_encrypt function, 
   along with the secret key and plaintext password.


Overall, the password is stored as a SHA256 hash of the openssl output, and the IV is stored as a SHA256 hash.

How strong is this method? Does updating the database user credentials increase or decrease the chances of a decryption in any event?
the initialization vector for openssl is re-created 
  1. generate 16 random bytes.
  2. Hash the bytes with SHA256.
  3. Store the hash in the database


if you generate 16 random bytes (128b), there is no reason to hash it


  password is stored as a SHA256 hash of the openssl output.
  How strong is this method?


you're encrypting the password what has a principial weakness - it is reversible. Once someone get access to your system (therefore all the code and configuration including your secret key), all user passwords are to be revealed. The user passwords should be stored as salted hash, so they are unrecoverable. 

Seems you are effectively storing a salted hash of the password, that is good. However the sha256 is relatively fast function, you better to use PBKDF2 (slow hash) to mitigate dictionary or brute-force attack. There is a nice article how to do it properly


  Does updating the database user credentials increase or decrease the chances of a decryption in any event?


The problem is once someone get access to the database and  and all the configuration, the adversary will have all information needed to decrypt all the passwords.

Next - if the passwords won't change themselves, I see no reason for re-hashing the passwords, it just increases complexity of your application.