> Many implementations of bcrypt truncate the password to the first 72 bytes, following the OpenBSD implementation. https://en.m.wikipedia.org/wiki/Bcrypt http

> Many implementations of bcrypt truncate the password to the first 72 bytes, following the OpenBSD implementation. https://en.m.wikipedia.org/wiki/Bcrypt https://en.m.wikipedia.org/wiki/Bcrypt This sounds undesirable to me, so I'd support sha256 and an alternative. I'd also recommend adding a max password length to any API. No point in allowing million character passwords.