3 ms·
Unless any of your users ever try and use a >72 character password.
by ris 7y ago
Unless any of your users ever try and use a >72 character password.
- masklinn 7y agoTBF that's super easy to work around: just prehash the key. In fact, an other risk of bcrypt is that any nul byte will truncate the key, so you probably want to hash the password with something else (SHA384 or SHA512/256 for instance) then base64/base85-encode it before passing it to bcrypt.