Specifically this. I know most bcrypt implementations are around 50 characters for, but I'm pretty certain that's not the case with scrypt.
From a developer of the successor of scrypt:
...question that is related to both scrypt and yescrypt. Is there a maximum input length for passwords?
For the likely purposes of your question, no, there's no such length limit. (Of course, in practice computers have limited memory and integer variables in C have limited range, so there is some sort of large limit.)
I recommend that you do have some sane limit on the length of username and password inputs in your web app anyway. Something that would never get in the way of reasonable usage, but would prevent obviously erroneous (maybe malicious) inputs from getting to deeper layers.
I know bcrypt has a limit of 71 characters.
It's 72 for bcrypt.
Alexander
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With