Why is there a limit on input length?

[davemerrill]

The original javascript-bcrypt library on which this is based doesn't have that limitation, as far as I'm aware. None is documented for it that I've seen, and I've tested it successfully with much longer inputs.

Password length is a basic difficulty multiplier for brute force crack attempts, so ideally long passwords are allowed, even encouraged.

[dcodeIO]

see also: #15

[davemerrill]

Apologies for the duplicate issue. I wasn't aware that bCrypt/Blowfish had a max length, many less secure systems don't. Seems unfortunate to me, but I'm sure there must be valid reasons for it.