4 ms·

Forgive my ignorance as I've never set up anything like this, but how do you then deal with the potential for extremely long passwords? Can that be detrimental

• hnbad 4y ago
  It's reasonable to put measures in place so users can't transmit excessively large amounts of data where they are not expected, login forms being one example. But there is a lot of wiggle room between maxlength=8 and allowing people to upload the source code of DOOM as their password.
• nibbleshifter 4y ago
  You don't store the password. You store a cryptographic hash of the password, which will always be a fixed length. This makes the actual password length irrelevant to back end storage.
• nzach 4y ago
  Password length isn't a problem because you never store the actual password in the database. What you do is use a hashing function[0] in the provided password and you store this result in the database. And these hashes tend to have a fixed size output. So it doesn't matter if your original password had 10 or 200 characters, the resulting hash will have the same size. [0] - https://www.authgear.com/post/password-hashing-salting https://www.authgear.com/post/password-hashing-salting