{"record":{"id":"08f691a60fd4e04f","repo":"ory/hydra","slug":"errbcryptpasswordlengthreached","errorCode":"ErrBcryptPasswordLengthReached","errorMessage":"passwords are limited to a maximum length of 72 characters","messagePattern":"passwords are limited to a maximum length of 72 characters","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"oryx/hasherx/hasher_bcrypt.go","lineNumber":15,"sourceCode":"package hasherx\n\nimport (\n\t\"context\"\n\n\t\"github.com/pkg/errors\"\n\t\"go.opentelemetry.io/otel\"\n\t\"go.opentelemetry.io/otel/attribute\"\n\t\"golang.org/x/crypto/bcrypt\"\n\n\t\"github.com/ory/x/otelx\"\n)\n\n// ErrBcryptPasswordLengthReached is returned when the password is longer than 72 bytes.\nvar ErrBcryptPasswordLengthReached = errors.Errorf(\"passwords are limited to a maximum length of 72 characters\")\n\ntype (\n\t// Bcrypt is a hasher that uses the bcrypt algorithm.\n\tBcrypt struct {\n\t\tc BCryptConfigurator\n\t}\n\t// BCryptConfig is the configuration for the bcrypt hasher.\n\tBCryptConfig struct {\n\t\tCost uint32 `json:\"cost\"`\n\t}\n\t// BCryptConfigurator is the interface that must be implemented by a configuration provider for the bcrypt hasher.\n\tBCryptConfigurator interface {\n\t\tHasherBcryptConfig(ctx context.Context) *BCryptConfig\n\t}\n)\n\nfunc NewHasherBcrypt(c BCryptConfigurator) *Bcrypt {\n\treturn &Bcrypt{c: c}","sourceCodeStart":1,"sourceCodeEnd":33,"githubUrl":"https://github.com/ory/hydra/blob/4174065ffb052799890f7480f5360a877a67ffc1/oryx/hasherx/hasher_bcrypt.go#L1-L33","documentation":"ErrBcryptPasswordLengthReached is a sentinel error from ory/x hasherx returned by validateBcryptPasswordLength when a password exceeds 72 bytes, the bcrypt algorithm's hard input limit (bcrypt only uses the first 72 bytes). The hasher rejects the password up front instead of silently truncating it, so callers don't get a false sense of security.","triggerScenarios":"Calling a Bcrypt hasher's GenerateHash/ComparePassword (which calls validateBcryptPasswordLength at hasher_bcrypt.go:60) with len(password) > 72.","commonSituations":"Users pasting long passphrases or generated secrets (SSH keys, JWTs, base64 blobs) as passwords; apps that don't enforce a max length on signup; switching from a hasher without a limit (e.g. argon2) to bcrypt.","solutions":["Truncate or reject passwords longer than 72 bytes in your application's signup/password-change flow before hashing","Enforce a maxLength=72 validation on password inputs in the UI and API","Pre-hash long inputs with SHA-256 and base64-encode the digest before bcrypt if you must support arbitrary-length secrets","Fall back to a hasher without the 72-byte limit (e.g. argon2id) if long passphrases are a requirement"],"exampleFix":"// before\nhasher.GenerateHash(ctx, password) // panics/errors when len(password) > 72\n// after\nif len(password) > 72 {\n    return fmt.Errorf(\"password must be at most 72 characters\")\n}\nhash, err := hasher.GenerateHash(ctx, password)","handlingStrategy":"validation","validationCode":"func validatePassword(pw string) error {\n    if len(pw) > 72 {\n        return fmt.Errorf(\"password must be at most 72 characters, got %d\", len(pw))\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":"if err := hasher.GenerateHash(ctx, pw); errors.Is(err, hasherx.ErrBcryptPasswordLengthReached) {\n    // prompt user to choose a shorter password\n}","preventionTips":["Enforce maxLength=72 on all password inputs (UI and API)","Validate length before hashing, not after","Remember the limit is bytes, not runes — multibyte characters count more","Consider pre-hashing with SHA-256 if arbitrary-length secrets must be supported"],"tags":["bcrypt","password","validation","hashing"],"backgroundTag":"bcrypt-password-too-long","analyzedSha":"4174065ffb052799890f7480f5360a877a67ffc1","analyzedAt":"2026-09-03T14:52:41.581Z","contentChangedAt":"2026-09-03T14:52:41.581Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}