3 ms·

You could have a reasonable length limit (1kb maybe?) so you don't spend too much CPU time hashing the password.