No! How about you go FUCK yourself instead? If you hash it then the length should NOT MATTER!

@Jilano hahaha ye 😂 Just learned it might be due to buffer overflow... but still maxsize of 50? Hmmm...

@Jilano This has happened to me on more then one site. Oh god it pisses me off. They could do some basic validation before submitting.

Wish I had devrant when they told me my password could not contain any numbers or special characters.

@RakNoel Some people just want to watch the world burn.

Nothing wrong in that. Even if its hashed in database, its not good to send lots of data to a webserver. Also, while the password is hashed, the cleartext password has to be stored in RAM initially, thus theres risk of buffer overflow. Same reason to limit which characters, to rule ut any vulns in webserver software.

So a limit is a good idea. But not too short. I usually set my limit same as the byte length of hash, for example a SHA-256 password has a max of 32 characters.

And here is the reason:
An password longer than 32 characters on a SHA-256 is completely USELESS, as theres always one valid password that will hash to the same hash, that is shorter than 32 characters.
Imagine you hash the value 00...x252...00, to 11...x252..11, then you will end up with all values 00..x252..00 to 11..x252..11, but in a random order.

Of course, hashing a longer value, will make the hashes start repeating. Thus a bruteforcer will find the shorter password.

Get payback. Drop all their tables

Actually with default hashing 'settings', if passwords exceed a certain limit it will cause crashes 😅. But then you should also ask yourself what the fuck you're doing.

At least they said 3 less chars, and not invalid password 😒

@sebastian it matters because a good password is hard to bruteforce and easy to remember. A short password will likely be a dictionary, or some combo from rainbow tables, which makes bruteforce possible. Good passwords are passphrases. Nobody will ever bruteforce all combinations, so the existence of a non-memorable collision is pretty much irrelevant.

@sebastian might be because bcrypt takes too much time hashing longer passwords so devs put an arbitrary limit to prevent DoS attacks

@AndSoWeCode Yes but come on, 32 chars is enough, you don't need to write an entire book as your password.

@gitpush they said 3 chars left untill i had got the length under 30 and removed special chars...

@AndSoWeCode it was random gen.^^

@RakNoel Oh this is messed up :\

@linuxxx ...senpai, you're so fucking clutch😬

@sebastian What is enough should be the users' choice!
@KidLaser

@sebastian get rekd

I had seen a bug at a company where people were using the password field as a DDoS mechanism. Since unlimited length PW were allowed, people were uploading files to spam the server. And doing this with just a few hundred bots was completely feesible.

That being said, 64 characters is probably still reasonable. 32... Maybe... Ehhh. 64 seems safer.

@meowth 64 is resonable if youre using SHA512. If you are using SHA256, then 32 is more resonable.

Length matters. Long passwords take much longer to hash if it's done properly. One can easily crash a server with just a long password. Limits must be placed. Unless the hashing algorithm differs depending on the length of the introduced password.