Password length isn't a problem because you never store the actual password in the database. What you do is use a hashing function[0] in the provided password

Password length isn't a problem because you never store the actual password in the database. What you do is use a hashing function[0] in the provided password and you store this result in the database. And these hashes tend to have a fixed size output. So it doesn't matter if your original password had 10 or 200 characters, the resulting hash will have the same size. [0] - https://www.authgear.com/post/password-hashing-salting https://www.authgear.com/post/password-hashing-salting