> You could show a warning that the extra chars beyond 50-55 will be ignored. Or you could use a better KDF, e.g. scrypt (even PBKDF2 is better on this metric)

> You could show a warning that the extra chars beyond 50-55 will be ignored. Or you could use a better KDF, e.g. scrypt (even PBKDF2 is better on this metric). Artificial password-length restrictions are symptomatic of poor design.