http://security.stackexchange.com/questions/17949/why-are-passwords-limited-to-16-characters http://security.stackexchange.com/questions/17949/why-are-pa... If

http://security.stackexchange.com/questions/17949/why-are-passwords-limited-to-16-characters http://security.stackexchange.com/questions/17949/why-are-pa... If you are to abide by CWE-521: Weak Password Requirements. Then all passwords must have a min and max password length. There are two reasons for this. For one, hashing a large amount of data can cause significant resource consumption on behalf of the server and would be an easy target for Denial of Service. Especially if the server is using key stretching such as PBKDF2. The other concerns is hash length-extension attacks or the prefixing attack against MD5. However If you are using a hash function that isn't broken, such as bcrypt or sha-256 and you aren't using an HMAC, then this shouldn't be a concern.