Search code examples
phpsecurityphp-password-hash

PHP password_hash() password_verify() maximum password length?

What is the maximum password length I can use with PHP 5.5 password_hash() and password_verify()?

Solution

  • Ok, let's go through this.

    The function does have a password length limit. Just like all strings in PHP, it is limited to 2^31-1 bytes.

    To be clear, there's no way for PHP to deal with anything larger than that (today at least).

    So the function itself is limited. But what about the underlying crypto algorithms.

    BCrypt is limited to processing the first 72 characters of password. However, this is not commonly a problem as explained in this answer.

    So in short, yes it does have an effective limit (it will only "use" the first 72 chars with the default and only algorithm), And no this is not a problem and nor should you try to "fix" or "mitigate" it.