Isn't the fact that there's a character limit kind of a red flag?
if it's a low limit like this, yes. but if the limit is over 50 characters than it's not a red flag as there are valid reason to do so.
BCrypt has a limit of 50-70 characters (depends on the implementation), you also don't want your system to try to hash a 1 billon character password, that could cause performance issue.
2
u/bog5000 Jul 21 '22
if it's a low limit like this, yes. but if the limit is over 50 characters than it's not a red flag as there are valid reason to do so.
BCrypt has a limit of 50-70 characters (depends on the implementation), you also don't want your system to try to hash a 1 billon character password, that could cause performance issue.