If you are migrating from other software like phpBB or IPB, these steps can probably be modified to work as well, provided you know how passwords are authenticated.
Simple Machine Forum's password authentication is as follows: sha1(strtolower(username) . password) which basically uses the username as a salt.
Since Xenforo currently only comes with a vBulletin importer, it's going to assume that for imported users, the password will be in the form of md5(md5(password . salt).
To remedy this, we need to modify some xF files to accept SMF's authentication scheme. I'm not sure if we are technically allowed to edit these files, so if not please remove this post.
Before we do that, we have to make sure Impex preserves the original hash, but I don't think I should go into detail here since it's vBulletin/Jerry's code. Basically edit the Impex files so that after importing into vB, the original password hash is unaltered. Remember to expand the relevant mysql column to accept enough characters beforehand.
If you don't preserve the hash, Impex will spit out md5(md5(sha1(strtolower(username) . $password)) . salt) which won't work with this method but I suspect it would be relatively easy to come up with an alternative if you are familiar with PHP.
Preparing to Import into XF:
Go into /library/XenForo/Importer/vBulletin.php
Find line 680
'salt' => $user['salt']
'salt' => $user['username']
Go into /library/XenForo/Authentication/vBulletin.php
Find line 19
return md5(md5($password) . $salt);
return sha1(strtolower($salt) . $password);