A larger input will take longer, but for the ranges normally used for passwords it shouldn't be noticable. You want a maximum length to prevent denial of servic

A larger input will take longer, but for the ranges normally used for passwords it shouldn't be noticable. You want a maximum length to prevent denial of service attacks. The maximum depends on the hash you're using; Bcrypt has a 56 bytes limit for example.