{"record":{"id":"9abae9b7679d7d9f","repo":"spring-projects/spring-security","slug":"password-cannot-be-more-than-72-bytes","errorCode":null,"errorMessage":"password cannot be more than 72 bytes","messagePattern":"password cannot be more than 72 bytes","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"crypto/src/main/java/org/springframework/security/crypto/bcrypt/BCrypt.java","lineNumber":616,"sourceCode":"\t * @param passwordb the password to hash, as a byte array\n\t * @param salt the salt to hash with (perhaps generated using BCrypt.gensalt)\n\t * @return the hashed password\n\t */\n\tpublic static String hashpw(byte passwordb[], String salt) {\n\t\treturn hashpw(passwordb, salt, false);\n\t}\n\n\tprivate static String hashpw(byte passwordb[], String salt, boolean for_check) {\n\t\tBCrypt B;\n\t\tString real_salt;\n\t\tbyte saltb[], hashed[];\n\t\tchar minor = (char) 0;\n\t\tint rounds, off;\n\t\tStringBuilder rs = new StringBuilder();\n\n\t\t// Enforce max length for new passwords only\n\t\tif (!for_check && passwordb.length > 72) {\n\t\t\tthrow new IllegalArgumentException(\"password cannot be more than 72 bytes\");\n\t\t}\n\t\tif (salt == null) {\n\t\t\tthrow new IllegalArgumentException(\"salt cannot be null\");\n\t\t}\n\n\t\tint saltLength = salt.length();\n\n\t\tif (saltLength < 28) {\n\t\t\tthrow new IllegalArgumentException(\"Invalid salt\");\n\t\t}\n\n\t\tif (salt.charAt(0) != '$' || salt.charAt(1) != '2') {\n\t\t\tthrow new IllegalArgumentException(\"Invalid salt version\");\n\t\t}\n\t\tif (salt.charAt(2) == '$') {\n\t\t\toff = 3;\n\t\t}\n\t\telse {","sourceCodeStart":598,"sourceCodeEnd":634,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/crypto/src/main/java/org/springframework/security/crypto/bcrypt/BCrypt.java#L598-L634","documentation":"BCrypt.hashpw() enforces a maximum password length of 72 bytes for new passwords (when for_check is false). Bcrypt only uses the first 72 bytes of input, so longer passwords would be silently truncated; this library throws instead to avoid a false sense of security. Checking existing hashes is exempt.","triggerScenarios":"BCrypt.hashpw(password, salt) with passwordb.length > 72 bytes (note bytes, not chars — multi-byte UTF-8 characters count more).","commonSituations":"Users pasting long passphrases or PEM keys as passwords; UTF-8 multibyte characters pushing a 60-char password over 72 bytes; not pre-hashing long inputs.","solutions":["Limit passwords to 72 bytes at input validation","If long secrets are required, pre-hash: SHA-256 the input then Base64 and bcrypt that (with the caveats of null bytes)","Encode consistently (UTF-8) so byte length is predictable and document the limit"],"exampleFix":"// before\nString hash = BCrypt.hashpw(password, salt);\n// after\nif (password.getBytes(StandardCharsets.UTF_8).length > 72) {\n    throw new IllegalArgumentException(\"Password exceeds 72 bytes\");\n}\nString hash = BCrypt.hashpw(password, salt);","handlingStrategy":"validation","validationCode":"if (password.getBytes(StandardCharsets.UTF_8).length > 72) {\n    throw new IllegalArgumentException(\"Password must be at most 72 bytes\");\n}","typeGuard":"boolean bcryptSafe(String pw) {\n    return pw != null && pw.getBytes(StandardCharsets.UTF_8).length <= 72;\n}","tryCatchPattern":"try {\n    hash = BCrypt.hashpw(pw, salt);\n} catch (IllegalArgumentException e) {\n    if (e.getMessage().contains(\"72 bytes\")) { /* reject or pre-hash the password */ }\n}","preventionTips":["Enforce a max password length (e.g. 64 chars) at registration/validation time","Count bytes (UTF-8), not chars — multibyte characters inflate length","Document the 72-byte bcrypt limit in password policy"],"tags":["bcrypt","spring-security","password","length-limit"],"backgroundTag":"payload-too-large","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}