From 843034a8d653af5b711a4ff79292e46e26717038 Mon Sep 17 00:00:00 2001 From: Donald Stufft Date: Tue, 26 Mar 2013 12:56:40 -0400 Subject: [PATCH] Document password truncation with BCryptPasswordHasher --- docs/topics/auth.txt | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/docs/topics/auth.txt b/docs/topics/auth.txt index efc6e78413..677429db47 100644 --- a/docs/topics/auth.txt +++ b/docs/topics/auth.txt @@ -462,6 +462,17 @@ To use Bcrypt as your default storage algorithm, do the following: That's it -- now your Django install will use Bcrypt as the default storage algorithm. +.. admonition:: Password truncation with BCryptPasswordHasher + + The designers of bcrypt truncate all passwords at 72 characters which means + that ``bcrypt(password_with_100_chars) == bcrypt(password_with_100_chars[:72])``. + ``BCryptPasswordHasher`` does not have any special handling and + thus is also subject to this hidden password length limit. The practical + ramification of this truncation is pretty marginal as the average user does + not have a password greater than 72 characters in length and even being + truncated at 72 the compute powered required to brute force bcrypt in any + useful amount of time is still astronomical. + .. admonition:: Other bcrypt implementations There are several other implementations that allow bcrypt to be