> Of the documented rules only minimum password length is even an excusable rule. Fun fact: bcrypt, still quite popular, has an inherent password length limit.

> Of the documented rules only minimum password length is even an excusable rule. Fun fact: bcrypt, still quite popular, has an inherent password length limit. Everything beyond a certain point (56 bytes) is just ignored. It's possible to work around, but that's messy and you're no longer do "the" bcrypt, bye bye interoperability. And if you don't enforce it, someone might do something silly-but-apparently-harmless, like reuse a long passphrase with some randomness at the end. Edge case, but not impossible. Of course in 2020 you probably should be using things like Argon or something (actually haven't researched the current best in a couple of years, so no longer sure)., but AFAIR Rails, for example, still comes with just bcrypt by default.