I wrote an authentication platform a few years ago... I had a setting to allow a max passphrase length (because it was a govt requirement for a client), but if

I wrote an authentication platform a few years ago... I had a setting to allow a max passphrase length (because it was a govt requirement for a client), but if unset, it would be 1024 as a pragmatic limit on the payload (considering the hash length was less), I always thought that was reasonable.