5 ms·
> If you must cap password length, only do so based on the maximum POST size allowable by your servers. This is commonly well above 1MB. Seriously. Yeah, no. I
by jwilk 9y ago
> If you must cap password length, only do so based on the maximum POST size allowable by your servers. This is commonly well above 1MB. Seriously.
Yeah, no. If someone submits a megabyte-long password, it's not because they like it super strong; it's because they're trying to DoS the server.
A sensible password length limit is probably a few kilobytes.
- taberiand 9y agoAnd for God's sake, ensure the length checks performed at login are the same ones used on account creation. More than a few times have I been stuck at login because my 20+ character auto- generated password was silently truncated to some arbitrary length between creation and login.
- davchana 9y agoIndia's version of 401k account, eNPS does that, will accept all passwords, but silently truncates at 14 char length, and when you try to login, throws error.
- notfed 9y agoBetter advice: have the client pre-hash the password before sending to the server.