Hacker News new | ask | show | jobs
by python273 1713 days ago
stretches or cost is number of hashing rounds, so not related to password length.

bcrypt has 72 bytes password length limit [0]. If the password is shorter, it gets extended to 72 bytes anyways, so longer passwords (10 chars vs 70 chars) are not making time difference.

The password can be pre-hashed to allow arbitrary sized passwords [1], but I don't think 10 chars vs 10000 would make a significant difference. I think most of the time will be spent on bcrypt rounds, not on pre-hashing.

> Happened to me.

While trying to find stretches quote, I found this post [2], so maybe it was not bcrypt? :)

[0] https://en.wikipedia.org/wiki/Bcrypt#Maximum_password_length

[1] https://en.wikipedia.org/wiki/Bcrypt#Solution_3_-_Pre-hash_p...

[2] https://news.ycombinator.com/item?id=26270129