3 ms·
Maximum lengths only make sense if your password field is stored as a SQL CHAR(10) (or COBOL if they’re into that). Basically a fixed width field and that’s too
by colejohnson66 5y ago
Maximum lengths only make sense if your password field is stored as a SQL CHAR(10) (or COBOL if they’re into that). Basically a fixed width field and that’s too small for a hash. But even then, they’re a horrible idea.
- SAI_Peregrinus 5y agoThey also make sense if you're using bcrypt since it has a 72-byte max input length. More modern password hashing fuctiions don't have such a short limit, so you can set a much bigger max length to prevent excessive network traffic & processing (eg 1kB). Since functions like Argon2 have very large max limits (2^32-1 bytes for Argon2) it can make sense to set a shorter limit.