Don’t trim a password to 64 characters about huge

[panique]

Because a.) in reality, nobody would use such long passwords and b.) to prevent database field flooding. People could turn off max POST size in their browsers (or send a naked POST request) and provide a password with 10000000000 chars, what would kill the database. To keep it clean, the db field and the password are limited to 64 chars.

[minitech]

But the password is hashed at a fixed length, so the database won’t be killed. And — 100% truthfully here — my Gmail password is a 97-character phrase. =) There is the possibility of DoS with the hash, but the length of the password is not that important under PHP’s server-enforced POST limit. And even then, you can cut it to something that just avoids crazy people like me; say, 1024.

[panique]

Boom, good point! The char limit was intented to be used only for the username, but somehow i started to use it on passwords too. I'll fix that! Merci...

[panique]

New limit is now 1024. Just to be sure, maybe some people use this without proper apache/php settings, so doing a crypt calculation with thousands of chars might slow down the system.