Skip to content

Conversation

@ayushthoren
Copy link

This PR fixes password hashing failures caused by bcrypt’s hard limit of 72 bytes on input passwords.

Currently, the full password is passed directly into bcrypt.hashpw(), which results in the error:
ValueError: password cannot be longer than 72 bytes, truncate manually if necessary

These changes manually truncate the password to avoid this issue.

@UrsusMortiferum
Copy link

UrsusMortiferum commented Nov 14, 2025

@ayushthoren, we shouldn't be silently truncating passwords. Disabling a test would be a better approach.

There was already a backlash around it few years ago when people discover that ProtonMail is silently cutting their passwords - reddit post - ProtonMail cuts (silently) passwords at 73 characters

@ayushthoren
Copy link
Author

Ah, you're right... I think I needed to look at this from the perspective of fixing the test, not the code, since it seems to be expected that the test will fail. Because of this, I think rather than disabling the test entirely, it might be better to switch the Exception from None to ValueError in this case?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants