We are not talking about 100 bytes of password here, but megabytes of garbage. See https://www.djangoproject.com/weblog/2013/sep/15/security/ https://www.django

We are not talking about 100 bytes of password here, but megabytes of garbage. See https://www.djangoproject.com/weblog/2013/sep/15/security/ https://www.djangoproject.com/weblog/2013/sep/15/security/, also known as CVE-2013-1443. "A password one megabyte in size, for example, will require roughly one minute of computation to check when using the PBKDF2 hasher."