And if anyone raises a concern about accepting and transferring arbitrarily long passwords to the backend: Just take a quick digest hash of it on the client sid

And if anyone raises a concern about accepting and transferring arbitrarily long passwords to the backend: Just take a quick digest hash of it on the client side (SHA512 or something) and send that UNcryptographic hash of the password to the backend to be properly cryptographically hashed there like regular. The digest hash becomes the password and the user is happy to not encounter any arbitrary restrictions on length. This is how dropbox does it: https://blogs.dropbox.com/tech/2016/09/how-dropbox-securely-stores-your-passwords/ https://blogs.dropbox.com/tech/2016/09/how-dropbox-securely-...