> It's a learning curve for us. That's why this kind of feedback is important. Then I would suggest you to look out to the opposite problem, denial of service

> It's a learning curve for us. That's why this kind of feedback is important. Then I would suggest you to look out to the opposite problem, denial of service via long passwords (assuming that you correctly use a slow key derivation function). e.g. Django now accept passwords with at most 4096 bytes because attackers used gigantic passwords that took a long time to hash