Really no reason to truncate after hashing. The output size of any cryptographic hash function should be more than small enough to send down the wire and hash

Really no reason to truncate after hashing. The output size of any cryptographic hash function should be more than small enough to send down the wire and hash again properly. Really though, just reject passwords over a few KB. Nobody will ever notice that limit except for people trying to fuck with you.