Hacker News new | ask | show | jobs
by LeoPanthera 3574 days ago
256 characters is ~1536 bits depending on what characters you use.

There is secure, and there is silly. NIST recommends 80 bits for passwords. Anything over 128 bits is excessive, anything over 256 bits is silly.

2 comments

I'm not complaining about them not supporting 256, I just find it strange the arbitrary limits imposed.

A site I signed up for today limited it at 42. Why?

And even if 128 is way over excessive, does it actually make a difference to the server? Obviously you don't want to be hashing multi megabyte passwords, but don't most password hashing systems need a certain sized key to work, so it's padded out to that point anyway? And once it's processing further "iterations", the size of the first password is pretty much irrelevant.

bcrypt, for example, is limited to 50-70 character inputs, depending on the implementation.
If you use a password manager there is practically no cost to the user to use any number of characters. Why not go for something insanely large from the user perspective?