[GormanFletcher]

The external auth service's API would receive textual input (expecting a string read from a textbox), not binary. A hash that included null bytes would output those in hex as ASCII zeroes, which wouldn't cause the same problem when the external service received the value.

[jlokier]

And that is, in fact, how you should perform a hash before bcrypt as well.

bcrypt accepts text input, not binary.

So if you use a pre-hash, you pass the hex or base64 output from the hash to bcrypt.